Tech?:Did I get spyware from Google or somewhere else that affects my Google results?

finnman69 | 5/4/4 | finnman69

[FierceDraka]

I'm trying right now to get rid of one on a friend's PC that won't even let "Hijack This!" run. It shuts it down cold. It isn't CWS since I've run CWshredder and gotten rid of that one. This new one won't let anything but AdAware run and that doesn't find anything.

I'm running SpySweeper trial version now. I don't even know what the bloody thing is named! Any thoughts?

What's the little bugger doing, browser hijacking? Does it show up in the task or processes list? There's a link on this thread to a page that has every Windows process known. You can narrow it down from there, and find information on removing the pest.

That's what I'd do, anyway.

[Bloody Sam Roberts]

I'ts pretty harmless. It's hijacking the IE homepage and not letting most spyware programs run.

I can run HJT in Safe Mode and do the fixes on the entries (it adds a LOT of host file entries that redirect to porno sites) but when I boot in normal mode they all come back.

CWShredder says it CWS.Smartsearch.2 and it remove an items called CSW.GoogleMS and about:blank each time but it just comes back.

Nothing I've seen yet shows up in any running processes. It's not a fatal type of bug but it is uber-annoying.

I'll look through the list of Win procs at the link you suggested and see what I can find. Nasssty little spywareses. We hates them.

[FierceDraka]

Nasssty little spywareses. We hates them.

You might have to uninstall IE through add/remove windows components, and reinstall it. No, that wouldn't work. The crap is still there. This sounds like an insidious little turd you've got there.

[Bloody Sam Roberts]

Yeah. However, I have hope. I found this procedure on a help forum that I am hoping will do the trick.

Use a tool like regmon (to monitor who writes to registry entries).
http://www.sysinternals.com/ntw2k/source/regmon.shtml
Set the filter (in the options settings) to search for "smartsearch" (or whatever you're looking for)
This will give you the name of the program that keeps trying to update the registry keys with the smartsearch.ws entries. Identify the .exe program from the regmon results, and kill the .exe program from the "Task Manager". Then go ahead and manually delete this .exe file (it will generally be a hidden file). Now manually delete the entries in the registry.

I'll try this when I get home later. It sounds like it should work since all I need is the name of the executable that keeps sending out its little army of turds.

[Danette]

Wow, this worked! Thanks Freepers!

[Long Cut]

I've been battling the devils at CWS for over a week now.

I've run Symantec, installed ZoneAlarm, Ad-Aware, CWSShredder, HiJackThis!, Spywareblaster, and all the latest MS upgrades and patches.

I seem to have it under control now. However, every now and then Ad-Aware finds those same CWS registry keys somewhere.

This has been a nightmare all week. It seems that this month CWS has simply exploded all over the place...It seems that everyone I know has gotten it, or some version of it.

It drives me NUTS that some COMPANY is doing this...do they or any of their affiliates actually think anyone is going to give them any business due to this?

Isn't this kind of thing illegal in some way? Whomever does this must be either sick, stupid, or just plain twisted, because there's a LOT of people out there right now that'd burn down their headquarters if they could find it.

[Long Cut]

BTT. After checking around, I find that the CWS bug and all its affiliates are running wild. Keep your antispyware stuff updated.

I wonder why it's not made the news yet?

[RJS1950]

Download CoolWebShredder from any of about a dozen sites and run it. Then download Spybot and run it. My brother's browser was recently hijacked by CoolWebSearch and this was the way we got rid of the pests. Run them at least once a week depending on the amount of surfing you do.

[RJS1950]

It isn't just IE that is affected, I've seen these hijackers on mozilla and on linux machines.

[pnz1]

I found this by a search.. I didn't want to make a new topic. I have something on my PC called Internet Optimizer and it directs it to a site called ShopNav. Will some of the AdAware, etc. get rid of that?

[Xenalyte]

I have the SAME DAMN PROBLEM. However, I cannot solve it, since I cannot update my virus and AdAware definitions, since I cannot perform any automatic updates, since I can't access HTTPS sites.

I am this close to putting a railroad spike through my hard drive.

[Xenalyte]

If I switched to a Mac, I wouldn't be able to play any of my games, and I don't feel like waiting a year for them to become available for that platform.

Just face it, yo . . . Macs are for pointy-bearded graphic artists who are, frankly, elitist snobs.

If not, games would be developed concurrently for Macs. As it is, Mac users I've met look down on gamers.

[stuck_in_new_orleans]

Maybe someone can help me....

I have the following URL on my IE homepage:
res://apmza.dll/index.html#27063

I have run:
Search and destroy
AdWare
Spy Sweeper
and Norton

I have also changed my homepage URL in the tools/options section

And it still keeps taking me back to this home page, can anyone help?

[stuck_in_new_orleans]

bump

!

I have the following URL on my IE homepage: res://apmza.dll/index.html#27063

I have run:

Search and destroy

AdWare Spy Sweeper Hijackthis CWSshredder and Norton I have also changed my homepage URL in the tools/options section and everything will get cleaned up, BUT as soon as I restart our computer I get this from Adware....

so it keeps coming back! and then when I open IE .....the URL is changed once again to the corrupted homepage. We are at our witts end, can someone please help??

Thanks alot!

davidW

[GretchenM]

I'm sorry to say I don't know how to fix the problem other than to do what I would do in your situation: call a friend who is a PC systems administrator, or call your favorite computer shop that works on PC's.

[GretchenM]

I've been thinking about your predicament. If you have Windows XP, you can do a System Restore to a date prior to when you had the problem, and see if that obliterates the intrusive material.

[Bloody Sam Roberts]

You have an instance of CoolWebSearch spyware/browser hijacker on your PC. This must be removed before any other cleaning can be done. It can be a wee nasty.

Go to these two links and download these pieces of free software:

CWShredder

HiJackThis!

Run CWShredder firsrt. It will detect and clean the nasty that is breeding the hijacker on your system. Be warned that it may come back after a reboot or Windows restart or even within a minute of just waiting. It depends on what variant you have. You should go to www.merijn.org and read up on it.

Then run the HiJackThis program. It will genereate a listing of items that are set up to be associated with your Browser...good and bad. Copy and paste the results here on this thread and I will look at it and tell you what should be deleted. Warning: it will list good items that are necessary as well as the bad ones so don't delete anything unless you are sure of what you are looking at.

Hopefully that will take care of your problem if it isn't a particularly virulent variant of CoolWebSearch like I had.

[Bloody Sam Roberts]

Sorry. I just read your second post. I see you've already tried what I suggested.

The thing you have to get rid of is what AdAware keeps finding:
C:\Windows\netlk32.exe

Do a search for this file and see if Windows can see it. If not, it is a 'hidden' file and you can try to change its attributes so it is not hidden or you can start up your system with a system disk (emergency boot disk) which will put you in DOS mode. If you are NOT running Win XP, then you can run the following commands exactly and it will remove the file:

C:
cd windows
del netlk32.exe

Remove the 3.5" floppy and then reboot. It should now be gone. Run AdAware again to be sure.

If it isn't then you have a registry key or keys that are recreating it at boot up. You will then need to search your registry for "netlk32.exe" and delete each instance and then go to DOS mode and start over. If you are not familiar with using "regedit" then don't do it. Find someone who is. Or...maybe someone here can assist.