Page 1 of 3 123 LastLast
Results 1 to 10 of 26

Thread: weird, spyware?? virus??

  1. #1
    Senior Member
    Join Date
    Apr 2002
    Posts
    161

    weird, spyware?? virus??

    Hi, I started Internet Explorer today, and my default start page was changed to: http://search-click.com/
    Also if I try to browse to my router's address by typing 192.168.1.1 it redirects me to: http://www.lookfor.cc/index.php?pin=


    If I type http://192.168.1.1 it works fine. I have ran Spybot S&D and Ad-aware as well as fully updated Norton AV. And found no viruses or spyware. Also I got a sex pop-up today when I accessed AO!
    Has anybody encountered this same problem, what is going on?? Maybe new spyware which isn't detected by current progs.


    thanks

    J

  2. #2
    Senior Member
    Join Date
    Dec 2001
    Posts
    884
    On your S&D, Norton, and Ad-aware, have you done the updates and gotten the very latest definitions?

  3. #3
    Senior Member
    Join Date
    Aug 2003
    Posts
    1,018
    Try here:

    http://forums.techguy.org/t186709/s9...7b044f9a6.html

    One word of caution...if you go with Hijackthis, be very careful....it is unforgiving if you accidentally delete the wrong thing.

  4. #4
    Senior Member Wazz's Avatar
    Join Date
    Apr 2003
    Posts
    288
    See my post here: http://www.antionline.com/showthread...856#post674059 This should do it for you.... You may also want to check your Trusted and Restricted sites list for anything weird in Internet Explorer if you use it (Tools, Internet Options).....Good Luck
    "It is a shame that stupidity is not painful" - Anton LaVey

  5. #5
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    You might also try:

    http://www.webattack.com/get/hostadmin.html

    And check what is in your Windows "hosts" folder............some of the more recent stuff hides there.

    Cheers

  6. #6
    Senior Member Wazz's Avatar
    Join Date
    Apr 2003
    Posts
    288
    Exactly nihil, that's what my post I mentioned above had to do with. That is most definately the problem.
    "It is a shame that stupidity is not painful" - Anton LaVey

  7. #7
    Senior Member
    Join Date
    Apr 2002
    Posts
    161
    Wazz: I have deleted all entries in the "hosts" file except the 127.0.0.1 loopback, but I have still got the same problem, what else can I try?

    thanks

  8. #8
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    Try http://www.merijn.org/downloads.html

    Get CWShredder and HijackThis (already suggested). Run CWShredder and then re-boot. If yoy still have a problem, run HijackThis, save the log and post it here.

    Good Luck

  9. #9
    Senior Member Wazz's Avatar
    Join Date
    Apr 2003
    Posts
    288
    Ok, I should probably do a little Tut on this but I'm to lazy.....so what I usually do is: 1) Make sure you home page is set to Blank (or something you choose), 2) Check your Allowed/Restricted sites list in the Internet Explorer/Security options, 3) Delete All of your cookies manually, 4) Recheck the Hosts file, 5) Check MSconfig for anything fishy, 6) Do a find in the Registry for http://www.lookfor.cc/index.php?pin= or http://search-click.com/ and 6) Hit the system with an Adware and Spybot scan again with the latest Defs. Hopefully, that will do it....if not we'll try to figure something else out.....Good Luck.
    "It is a shame that stupidity is not painful" - Anton LaVey

  10. #10
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    Spybot S&D does not get rid of everything CWShredder is an additional tool. Whilst you are on Merijn's site you might as well get "Startup List" as well and check what is autostarting on your machine.

    Good luck

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •