MSN Spyware?

Self ^ | Feb 27, 2004 | self

[OldCorps]

My daughter used AOL IM and MSN hotmail last night. Probably some other stuff too. OS is Windows ME. This morning after booting up i clicked on IExplorer. The computer went to this webpage, showing the usual MSN webpage:

http://www.browser-page.com/home.html

the computer then opened another page:

http://www.adwarehunter.com/creatives/alert1.gif

The crazy thing is, I went back to tools, internet options, and reset my homepage back to the Washington Times, and saved changes. I closed down all other operations and reopened IE. Browser again went back to the MSN homepage. What gives?

Now i'm really mad, so I ran both spybot and lavasoft adaware (not simutaneously) , and neither one picked up anything. Then went to settings...add/install programs...and deleted anything unfamiliar.

This junk still runs when i click IE.

[OldCorps]

Anyone seen this or have the same problems? Any suggestions?

thanks

[Ethrane]

Go get ad-aware and/or spybot (preferably both)...install them and make sure you have the latest updates.

I've had great success with both programs cleaning up typical "spyware" issues after the kids get on the computer.

There are free versions of both.

Just google search the program names to find the websites and download.

Hope this helps!

[Gordian Blade]

You need to download and run a program like Ad-Aware, which finds and removes spyware/adware from your computer. Many programs that you download from the net secretly place these into your system and in such a way that you cannot easily remove them without a program specifically designed to seek and destroy. Do a Google search on Ad-Aware and you should be able to find the free version. There are other programs that do the same thing also. Good luck!

[Agnes Heep]

Check your hosts file to see if entries have been made recently that would map your home page address to the adware address.

[jktulsaok]

That's a browser hijacking, caused by spyware. There are a number of free programs that will remove it. Here's a good one http://www.safer-networking.org/

[Cicero]

I don't use MSN, so I haven't seen this. Microsoft used to do this in the past when you installed a new version of Internet Explorer, but if you changed the home page back in settings, it would only do it once. But I don't see why MSN would be doing this.

It's very doubtful that AOL is involved in this particular problem, since AOL and MSN are competitors.

Maybe someone will have a specific answer, but meantime I would suggest using AdAware and Spybot Search&Destroy to look for adware and remove it. Adawarehunter may be a site that looks for and interferes with AdAware. There is another little program at Lavasoft, recently released, called Ad-aware Cloak 1.0 that can be installed if some program on the web is shutting down AdAware. That could also be what is happening. You can see the details on that at BetaNews:

http://fileforum.betanews.com/detail.php3?fid=1075830644

[steplock]

THat is one VERY nasty virus/scumware/spyware you have on your computer.

It took me 3 hours to remove it from a friend's computer (thanx to Win-Me).

#1 TURN OFF System Restore!
#2 Download, Install & Run AdAware & Spybot at least twice each
#3 On-Line go to http://housecall.antivirus.com/housecall/start_corp.asp (set this scan for Auto Clean - you'll see where)

#4 rerun adaware & spybot until you see ZERO problems

#5 Hopefully your computer still functions after all this

#6 http://v4.windowsupdate.microsoft.com/en/default.asp and get the CRITICAL updates

Do all this, there are a couple more programs that may be necessary - I'll check back here and see if you need them.

[Lexington Green]

I'll watch for informed replies because I just encountered the same problem... like my browser's been hijacked by adsearch and other basturds.

[OldCorps]

wow, kinda like runing counter-counter measures. this battle with spam and spyware is getting out of control.

To all:

thanks for the tips.

[steplock]

I said to turn off the System Restore because that is where this POS is residing - no matter where you find and delete it, if restore is operating, it will simply restore itself.

It is nasty.

[Stu Cohen]

Sound like it could be a "Browser Helper". These basically don't help you, but help the company get more hits on it's homepage. They are not always flagged as spyware or adware, since they don't techincally spy or send any information to anyone ... they just change settings of certain programs.

There is a tool to remove this. Do a search for "BHO Cop". It is similar to adaware, except that this one searches and removes BHO's.

It's worth a shot.

One more piece of advice. Don't use AOL or MSN unless you absolutely have to. I know that subject has been beaten to death ... but it's good advice.

[freedomlover]

bump 4 tonite

[Stu Cohen]

Oh.

BHO = Browser Helper Object

[Hodar]

Do a search for the file "hosts"; there is NOT a suffix to this. You may open it with notepad, or wordpad. This is a simple text file that tells your PC whom to use for the nameserver, and what websites (if any) to immediately disconnect from. It can also over-ride some of your settings, thus forcing you where you may not want to go.

So, open it with Wordpad or Notepad. You may find that there are some weird entries, if so you may delete them and save the file. Wordpad or Notepad will save the file, but will call it hosts.txt. That's OK.... just go back in with explorer and remove the .txt part.

Then there's always the easy way.... if you open 'Internet Settings', did one of those sites just reset your home page? If so, you can set it back to what you had it, and apply it as your home page again.

[steplock]

Here are a couple more (in my opinion necessary)...

spywareblaster Prevents most spywarez from being installed - Keeps out 90%+
http://webzoom.freewebs.com/bluzman32/spywareblastersetup.exe

http://www.snapfiles.com/get/systemwiper.html this utility will erase ALL temporary files/cookies/etc (programmable)

As with ALL security systems - UPDATE UPDATE UPDATE UPDATE !!!!

[rogueleader]

You need to stop using IE.

Get Mozilla Firefox.

http://www.mozilla.org/

[steplock]

In addition to being a security risk, Windows' "Messenger Service" is being used to "Spam" Windows users across the Internet.

This 22 kbyte "Shoot The Messenger" utility gives users immediate control over the Windows Messenger service.

http://grc.com/stm/shootthemessenger.htm

.

[Future Useless Eater]

`

[SengirV]

Buy a Mac, it will solve all your computing problems.

Don't listen to the M$ drones that will blast me with follow ups, they still have their heads buried in the sand - this ain't your '95 Mac anymore =)

[MD_Willington_1976]

What OS are you running...if it's XP Home or Pro then MSMSG.EXE (messenger) loads up if you check your email anyway, and it runs in the background forever until you kill it with the task manager...

Later

MD

[txflake]

like my browser's been hijacked by adsearch and other basturds

Mine, too. It's driving me nuts. Anybody else have the executable lefeatures causing trouble?

[Cicero]

You are probably right. Norton advises that you have to turn of System Restore when you remove many recent email viruses, because otherwise the bad files will be restored.

This is dangerous, because when you turn it off, it gets rid of the restore points, which means you have no way to restore the system at that point if something further goes wrong. But it seems as if you have little or no choice.

[MD_Willington_1976]

I would but I could buy a nice used car for the same price as a new mac...

[MD_Willington_1976]

http://store.apple.com/1-800-MY-APPLE/WebObjects/AppleStore.woa/70702/wo/So60tlmoNJi22lG1jDU1jiAun7u/2.0.7.1.0.5.3

$6,678.90...

[bioprof]

i started having this problem ( and a LOT of others ) when I installed the MSN 9 upgrade....never had a problem before this.....

[dts32041]

Ain't that the truth.

[Cicero]

I run XP Pro. But I've used Gibson Research's Shoot the Messenger to turn of MS Messenger. Also his other little progams.

[txflake]

Then MSN wiped out all my mail. All of it.

[chiller]

BUMP

[Bon mots]

I had a similar problem. Spybot didn't fix it. Neither did "Hijack This". "CW Shredder" did!!

Good luck!

[agsloss]

I had a similar problem when my IE browser was hijacked by Shopnav. I followed the steps at www.pestpatrol.com, which involved deleting the registry keys. It took several tries (I'm not sure I was following the directions correctly), but it was finally back to normal. PestPatrol also has a program you can buy that will remove it for you.

Good luck.

[Kiss Me Hardy]

thanks

[Bon mots]

I think this shredder is specialized for the "Cool Web Search" Hijacker... you can also try "Hijack This"

As a prophylactic against future hijackings... first of all, run your updates (virus and MS), but you can also install an anti-hijack program like this:


Browser Hijack Blaster!

[js1138]

you've been had by spyware. In addition to the other fixes you get, try this five star fix.

http://www.javacoolsoftware.com/spywareblaster.html

You do not necessarily need to choose between different spyware removers. They all have their strengths. Most do not run continuously. The remove or disable spyware and shut down.

You need to get the latest updates for any of these tools on a regular basis and run the latest version. Spyware Blaster is particularly cool, because in most cases it will prevent the installation of spyware, not just remove it. Some of these suckers imbed themselves like the Alien into your system. I have seen systems where you had to uninstall Windows networking and reinstall it from scratch.

[50sDad]

Another good thing is to get a startup manager program. (Examples, anyone? I'm away from home.) Most of them let you "untick" stuff you didn't even know was executing every time you boot up. This often will prevent background hijacks from activating on boot up, and let your spyware hunters work more efficiently.

I lowered my IE zone control at work to visit legitimate websites for my job, and like the insectoids on Enterprise last week, the little vermin skittered right in and set up shop. What a bear!

[Thud]

ping

[Bon mots]

"Hijack This!"



Do not run Hijack This from Winzip. Unpack it into its own folder!!

If you need some other free tools like this, have a look at this page:
http://www.lurkhere.com/~nicefiles/

[skinny old man]

I had four Icons suddenly appear on my desktop,and and the Internt Exployer Icon wouldn't work.Through Tech Assistance with Road Runner we determined the Browser wasn't working.I got on line through My Computer.I was able to uninstall two of the Icons.At time the machine takes a long time to load a page.Getting on to Free Republic doesn't seem to be a problem.

Skinny Old Man

[Terry Mross]

It happens to me all the time. I finally figured out how to go back and use the "restore" feature and reset everything back a few says. I'm a computor idiot and this took me forever. Prior to figuring that out I was reloading all of my software.

[NativeSon]

Anyone seen this or have the same problems? Any suggestions?

I'm not wearing my T.F.H. but yestersday at work we had a problem with Internet Exploder, if your home page was set to MSN it would dump the system.

[js1138]

Restore is not a good solution to a spyware infection.

[OldCorps]

bump

[.38sw]

Bookmarking for later. Good info here.

[frankenMonkey]

or perhaps... something else.

[upchuck]

You might give Spyhunter from http://www.enigmasoftwaregroup.com/ a try. It has found stuff on my system that adaware and spybot overlooked, even though the defs were up to date. The Spyhunter scan is free. You have to buy (29.99, I think) the removal tool. But the scanner will tell you the names of the files it found. So just deleting those files may solve your problem.

[RonPaulLives]

You might give Spyhunter from http://www.enigmasoftwaregroup.com/ a try.

Hey, upchuck! Haven't talked to you in a while. Just wanted to let you know that I use Spyhunter here on my job, and it is great. Spent a significant amount of time at work today installing it on a number of machines.

[Tailback]

ping for later

[MD_Willington_1976]

My 18 month old son would have that toy ripped apart in no time flat...

[OldCorps]

thanks steplock for your advice. everything running fine. we'll see if the stuff pops up again.

funny thing is, i've run windows update many times in the past. It would always tell me that i need to install 2 critical updates, (something to IE, i think). every time i downloaded them, i'd go back and see if they took. they didn't.

however, this time i turned off system restore as you suggested, and the update went through. Many thanks, amigo.

regards,

[OldCorps]

btw, you said the program resided in system restore? when i reran adaware, it only found bots in cookies, nothing in restore.

should i go turn on restore now?

thanks again,