Article View: alt.comp.virus
Article #26Re: Hijacker - advice sought on how to get rid of this - OFF TOPIC
From: Big Will
Date: Sat, 08 Jan 2005 09:33
Date: Sat, 08 Jan 2005 09:33
68 lines
3807 bytes
3807 bytes
Bruce wrote: > sh4d03 <sh4d03@TPG.com.au> wrote in news:41d733af$1@dnews.tpgi.com.au: > > >>A Whiteford wrote: >> >>>My background has reset to a black screen with a title "Warning >>>You're in Danger" and a blurb about spyware etc. If I click on the >>>screen it takes me to the following web site: >>>http://213.159.117.130/?affid=NAT-12 >>> >>>which basically is urging me to buy their product to remove spyware. >>> >>>I've run AdAware and it's made no difference. I've also tried >>>resetting the desktop from the Display within the Control Panel. If >>>I choose a Windows theme it uses only the sounds/pointers and doesn't >>>change the desktop to the theme. >>> >>>Advice from anybody who knows how to get rid of this hijacker >>>appreciated. >>> >>>Thanks >>> >>> >> >>Don't assume that AdAware is the be-all and end-all of anti-spyware >>programs. Yes I use it myself but I also use SpySweeper, SpyBot and >>Spyware Blaster. Have a look at some of these products as well and see >>if they can help you. But also as -max has suggested look at running a >>check for viruses as well. >> >>Sh4d03 > > > Yes, indeed. I'm no expert, but I just finished cleaning a teenager's > machine, and I had to use AdAware, Spybot, Hijackthis, Trend Sysclean, > Bitdefender, and McAfee to do the job. > > I had no viruses, but plenty of spyware, adware, and trojans. What > worked the best for me was manually deleting registry entries that > Bitdefender and Hijackthis found, examining the startup tab in msconfig, > and the running processes in the task manager. > > I sometimes felt like I was chasing my tail, as it was an iterative > process. > > Good luck, > Bruce Run the following in order (from safe mode with networking if on an NT based system). housecall.trendmirco.com www.pandasoftware.com/activescan (but don't give them your real e-mail) Lavasoft (www.lavasoft.nu) Spybot (www.safer-networking.org) The Cleaner (www.moosoft.com) CWShredder (www.spywareinfo.com/~merijn or http://computercops.biz/downloads-cat-14.html) www.ravantivirus.com security.symantec.com Than post a Hijack This log to an HJT forum. Some HJT forums are www.spywareinfo.com, www.computercops.biz, www.tomcoyote.com/forums. You can download HJT from www.tomcoyote.com. ------------ And now a word from our sponsor ------------------ For a quality usenet news server, try DNEWS, easy to install, fast, efficient and reliable. For home servers or carrier class installations with millions of users it will allow you to grow! ---- See http://netwinsite.com/sponsor/sponsor_dnews.htm ----
Technical Details
Message-ID:
<41dfaa18@darkstar>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!newshub.sdsu.edu!tethys.csu.net!news-hog.berkeley.edu!newsfeed.berkeley.edu!ucberkeley!darkstar!not-for-mailReferences:
<%vABd.98953$K7.79699@news-server.bigpond.net.au> <41d733af$1@dnews.tpgi.com.au> <Xns95D1BAB3B52C9parcxmannetscapenet@216.148.227.77>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,f57b018056746121 X-Google-Thread: 10d683,f57b018056746121 X-Google-Attributes: gidfcd68,gid10d683,public X-Google-Language: ENGLISH,ASCII-7-bit Date: Sat, 08 Jan 2005 01:33:14 -0800 From: Big Will <ALL_YOUR_BASE@ARE_BELONG_TO_US> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 Newsgroups: alt.comp.virus,aus.computers.ibm-pc Subject: Re: Hijacker - advice sought on how to get rid of this - OFF TOPIC References: <%vABd.98953$K7.79699@news-server.bigpond.net.au> <41d733af$1@dnews.tpgi.com.au> <Xns95D1BAB3B52C9parcxmannetscapenet@216.148.227.77> In-Reply-To: <Xns95D1BAB3B52C9parcxmannetscapenet@216.148.227.77> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit NNTP-Posting-Host: utc-d0032.resnet.ucsc.edu Message-ID: <41dfaa18@darkstar> X-Trace: darkstar 1105177112 169.233.44.32 (8 Jan 2005 01:38:32 -0800) Lines: 68 Path: arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!newshub.sdsu.edu!tethys.csu.net!news-hog.berkeley.edu!newsfeed.berkeley.edu!ucberkeley!darkstar!not-for-mail