Help! Nasty scumware has taken over my IE, no relief from Ad-aware or Spysweeper

[David Olafsson]

Hi there. I need some serious help here. There is some kind of a
nasty parasite on my IE, my office computer no less, and I can't seem
to get rid of it with any program I can find....believe me I've spent
hours on this. The symptoms include one or more of the following:
---my IE homepage is re-directed to a dummy home page, usually
"http://homepage", this is a very aggressive re-direct, it keeps
re-appearing no matter how many times I exit, and it deletes my
homepage and resets it to "http://homepage"
--I get an aggressive popup that says "MS Support Security Alert--Your
Internet usage is being tracked! Everyone can spy on you right now!
Protect your online privacy and visit and download Free soft at
http://security.com" This popup repeats itself endlessly no matter
how many times I try to delete it
---a growing collection of shortcuts are placed on my desktop and on
my IE Favorites, including shortcuts to "Intellosearch, ltd",
"Microsearch", "Microsoft Security System", "Online Pharmacy",
"Viagra", the list just keeps growing...many of these shortcuts lead
to bogus, dead-end sites (just like "security.com")
---other re-direct sites eventually appear, including some search
sites and porn sites, e.g. "cool-search.com", "xxxxx.com", and/or
"xxx69.com"...these are mostly deadends, although sometimes an actual
porn link page will appear;
---my Internet temporary files show that these moves are triggered by
the continued insertion of a program called "5.exe", which is inserted
regularly in groups of three. The three sources of the program "5.exe"
are listed as http://man.cykahax.com/5.exe,
http://beta.softdevelops.com/5.exe, and http://alltheporn.com/5.exe.
I have gone to all 3 sites attempting to get uninstall information and
can obtain no information, despite requests to the webmaster(s).
---the program "5.exe" is not listed in my "Add/Remove Programs" in
Windows, and I can't find evidence of it elsewhere (such as in Windows
Downloads folder).

Does anyone recognize this one? Can anyone help? This is a nasty
one. Moreover, it's on my work computer, I can't seem to get rid of
it, and I'm worried I'm going to get into a heap of trouble!

Thanks for any help you can offer!

[YoKenny]

David Olafsson wrote:
> Hi there. I need some serious help here. There is some kind of a
> nasty parasite on my IE, my office computer no less, and I can't seem
> to get rid of it with any program I can find....believe me I've spent
> hours on this. The symptoms include one or more of the following:
> ---my IE homepage is re-directed to a dummy home page, usually
> "http://homepage", this is a very aggressive re-direct, it keeps
> re-appearing no matter how many times I exit, and it deletes my
> homepage and resets it to "http://homepage"
> --I get an aggressive popup that says "MS Support Security Alert--Your
> Internet usage is being tracked! Everyone can spy on you right now!
> Protect your online privacy and visit and download Free soft at
> http://security.com" This popup repeats itself endlessly no matter
> how many times I try to delete it
> ---a growing collection of shortcuts are placed on my desktop and on
> my IE Favorites, including shortcuts to "Intellosearch, ltd",
> "Microsearch", "Microsoft Security System", "Online Pharmacy",
> "Viagra", the list just keeps growing...many of these shortcuts lead
> to bogus, dead-end sites (just like "security.com")
> ---other re-direct sites eventually appear, including some search
> sites and porn sites, e.g. "cool-search.com", "xxxxx.com", and/or
> "xxx69.com"...these are mostly deadends, although sometimes an actual
> porn link page will appear;
> ---my Internet temporary files show that these moves are triggered by
> the continued insertion of a program called "5.exe", which is inserted
> regularly in groups of three. The three sources of the program "5.exe"
> are listed as http://man.cykahax.com/5.exe,
> http://beta.softdevelops.com/5.exe, and http://alltheporn.com/5.exe.
> I have gone to all 3 sites attempting to get uninstall information and
> can obtain no information, despite requests to the webmaster(s).
> ---the program "5.exe" is not listed in my "Add/Remove Programs" in
> Windows, and I can't find evidence of it elsewhere (such as in Windows
> Downloads folder).
>
> Does anyone recognize this one? Can anyone help? This is a nasty
> one. Moreover, it's on my work computer, I can't seem to get rid of
> it, and I'm worried I'm going to get into a heap of trouble!
>
> Thanks for any help you can offer!

Get CWShredder and unzip and run it.
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Read about CWS:
http://www.spywareinfo.com/~merijn/cwschronicles.html

HijackThis to look for remnants.
http://mjc1.com/mirror/hjt/