Help

[George Turnbull]

Hi,

My explorer has been hit. When started, I'm being whisked off to

http://youfindall.net/101/

My problem is that my IE (5.5) de-install info has been deleted so a
deletion using the Windows software deinstall is a no go. If I try to
delete all of the IE files manually, they reappear (one after the other)
within seconds (I've used Norton and several other tools to check for
viruses - none found). Using recomended anti-hijack tools only works if I
do use them before every internet session (Hijack This and Adware 6).
Several people with more PC knowledge than I have have said "scrub the
system and re-install everything", but that will only be a last resort.

Has anyone out there got a better idea?

--
George Turnbull, Bekscher Berg 43 , 33100 Paderborn, Germany
email: gizmot@t-online.de
Tel.No.: +49 5252 931383
Fax.No.:+49 5252 931384

[Tom Reynolds]

Have you tried Spybot Search and Destroy [free]
http://security.kolla.de/index.php?l...&page=download
It will find things that Ad-Aware misses.
Be sure and get the latest updates after you download it.
You may need to update Ad-Aware also.

Good Luck,
Tom
"George Turnbull" <gizmot@t-online.de> wrote in message
news:bi835b$1fb$01$1@news.t-online.com...
> Hi,
>
> My explorer has been hit. When started, I'm being whisked off to
>
> http://youfindall.net/101/
>
> My problem is that my IE (5.5) de-install info has been deleted so a
> deletion using the Windows software deinstall is a no go. If I try to
> delete all of the IE files manually, they reappear (one after the other)
> within seconds (I've used Norton and several other tools to check for
> viruses - none found). Using recomended anti-hijack tools only works if I
> do use them before every internet session (Hijack This and Adware 6).
> Several people with more PC knowledge than I have have said "scrub the
> system and re-install everything", but that will only be a last resort.
>
> Has anyone out there got a better idea?
>
> --
> George Turnbull, Bekscher Berg 43 , 33100 Paderborn, Germany
> email: gizmot@t-online.de
> Tel.No.: +49 5252 931383
> Fax.No.:+49 5252 931384
>
>

[YoKenny]

George Turnbull wrote:
> Hi,
>
> My explorer has been hit. When started, I'm being whisked off to
>
> http://youfindall.net/101/
>
> My problem is that my IE (5.5) de-install info has been deleted so a
> deletion using the Windows software deinstall is a no go. If I try to
> delete all of the IE files manually, they reappear (one after the
> other) within seconds (I've used Norton and several other tools to
> check for viruses - none found). Using recomended anti-hijack tools
> only works if I do use them before every internet session (Hijack
> This and Adware 6). Several people with more PC knowledge than I have
> have said "scrub the system and re-install everything", but that will
> only be a last resort.
>
> Has anyone out there got a better idea?

Coolwebsearch browser rape hijackers!

http://www.spywareinfo.com/~merijn/cwschronicles.html

Get a good HOSTS file to stop these ba*tards.
http://www.mvps.org/winhelp2002/hosts.htm

Get SpywareBlaster to stop them from being installed. Update the reference
file to get the latest definitions.
http://www.javacoolsoftware.com/spywareblaster.html

[George Turnbull]

Thanks Guys!

The good news is that I managed to find a file called bootconf.exe which was
repsonsible for re-hijacking my homepage
at every start-up. So far I've had no problems.
Norton found it and so far I've had no problems. Lets hope it stays that
way.

Thanks again

--
George Turnbull, Bekscher Berg 43 , 33100 Paderborn, Germany
email: gizmot@t-online.de
Tel.No.: +49 5252 931383
Fax.No.:+49 5252 931384

[Jay T. Blocksom]

On Sat, 23 Aug 2003 18:00:25 +0200, in <alt.privacy.spyware>, "George
Turnbull" <gizmot@t-online.de> wrote:
>
> Hi,
>
> My explorer has been hit. When started, I'm being whisked off to
>
> http://youfindall.net/101/
>
> My problem is that my IE (5.5) de-install info has been deleted so a
> deletion using the Windows software deinstall is a no go.
[snip]

Permanent solution: <http://www.litepc.com/ieradicator.html>

(Note that to use this with Win2K-SR2 or later or WinXP will require that
you first disable WFP; see <http://www.jsifaq.com/SUBK/tip5300/rh5392.htm>.)

> If I try to
> delete all of the IE files manually, they reappear (one after the other)
> within seconds (I've used Norton and several other tools to check for
> viruses - none found).
[snip]

If you mean "upon rebooting", that does indeed sound like WFP in action.
Otherwise, it sounds like you've got something else nasty going on.

> Using recomended anti-hijack tools only works if I
> do use them before every internet session (Hijack This and Adware 6).
> Several people with more PC knowledge than I have have said "scrub the
> system and re-install everything", but that will only be a last resort.
>
[snip]

You may very well already be at that point, especially considering that
"phantom resurrection" behavior. And in any event, it's probably the only
way to be *sure* you've excused ALL the demons.

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[Jay T. Blocksom]

On Thu, 28 Aug 2003 19:18:33 -0400, in <alt.privacy.spyware>, Jay T.
Blocksom <usenet01+SPAMBLOCK@appropriate-tech.net> wrote:
>
[snip]
>
> You may very well already be at that point, especially considering that
> "phantom resurrection" behavior. And in any event, it's probably the
> only way to be *sure* you've excused ALL the demons.

Arrrgggghhh. Some typos are worse than others.

Obviously (or maybe not), that was supposed to be "the only way to be *sure*
you've excised ALL the demons."
^^^^^^^

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -