Lousy spyware...

[phrozen_dreamz]

Ok there is something that is causing IE to change it's defaut page to http://www.nkvd.us . I used Spybot Search and Destroy and it showed a registry entry that was used to do this. I removed it. Now it's back a week later. Anyone have a problem with this? I havent installed any new apps for about a month. I dunno.
HELP PLEASE!!!

[phrozen_dreamz]

HELP!

[mlv56]

Other than running Spybot, what other anti-spyware software are you running??? It may be the result of a CoolWeb Search variant.

Have you run CWShredder which would address the problem if it was the result of a CoolWeb Search infection.

http://www.merijn.org/downloads.html

If you don't already have SpywareBlaster and SpywareGuard installed, you might consider installing both programs to provide protection from being infected with spyware. If you haven't got these two programs installed and you choose to do so you should make sure that you download all the updates for those programs.

http://www.javacoolsoftware.com/spywareblaster.html

http://www.wilderssecurity.net/spywareguard.html

If not already installed, in addition to running Spybot, you might also consider installing Ad-Aware. It can clean somethings that Spybot definitions don't get. If you run both Spybot and Ad-Aware, you should reboot between using one or the other.

http://www.lavasoftsupport.com/index...howtopic=11613

http://www.lavasoftusa.com/

Failing all the above, you may have to download Hijackthis, run a scan and post the scan results on a board for an expert to read and give advice on what items to fix. Do Not attempt any fixes in the scan produced by Hijackthis without expert advice, unless you are knowledgeable with what can and cannot be checked for fixing with Hijackthis. Having Hijackthis fix a wrong item can have disasterous effects on your system.

http://www.merijn.org/downloads.html

http://boards.cexx.org/viewforum.php...7b4f20402fd73d

Hope this helps

[crystaldragon]

There have been a lot of people having trouble with Homepage hijacking lately. I've seen at least 1 thread about it every other day for a couple of weeks now.

You might want to take a look Here. Also using Spy bot's immunize feature helps. Using a hosts file will also help a lot. Beemer has a good one and instuction on using it for xp and w2k on his webpage

JD

[vass0922]

even easier

switch to Opera or mozilla
requires zero extra apps to get the same functionality!
You dont' get spyware, you don't get hijacked.

(not thread crapping, but these are serious problems with a fairly easy fix without requiring 30 different applications to fend off IE bugs)

To get rid of it I'd also suggest AdAware

also check start --> run --> msconfig (for win98/SE/ME/XP) to see whats starting up automatically that internet explorer was SO kind to install for YOUR benefit.

[jpivonka]

Besides AdAware and Spybot I run Mike Lin's StartUp Monitor and StartUp Control Panel to help me prevent and manage stuff that wants to load itself without my help.
http://www.mlin.net/
They work fine for me, and have identified a couple of unwanted self loaders and helped kill them. Startup Control Panel seems more complete and clearer than MSConfig, for that purpose. And Startup Monitor lets me know everytime something is registered to run at startup, and lets me decide yea or nay on whether it gets to do that.

But probably the most important thing I do, is what vass0922 suggests: I use Mozilla.

And I just tested both Mozilla and IE for the URL spoofing vulnerability, IE, fully patched, failed.
http://www.secunia.com/internet_expl...spoofing_test/
That's one way people end up on web pages they did not intend to go to, and catch nasty bugs they did not want to get.

Oh yeah... .hta is disabled here too, by "HTAstop.exe"

[demon_wolf]

I had a similar problem.....One Month later and the problem hasn't shown up again. Heres how I did it:

Run AdAware and Spybot. (Just to clean up the system)

Next....Make sure your desired homepage is correct.

Run Registry Mechanic from WinGuides.

http://www.winguides.com/regmech/

There is a free download demo....But the full version is worth purchasing.

It basically cleans up your registry.....and so far Ive never had a problem with it.