David Olafsson wrote:
> Hi there. I need some serious help here. There is some kind of a
> nasty parasite on my IE, my office computer no less, and I can't seem
> to get rid of it with any program I can find....believe me I've spent
> hours on this. The symptoms include one or more of the following:
> ---my IE homepage is re-directed to a dummy home page, usually
> "http://homepage", this is a very aggressive re-direct, it keeps
> re-appearing no matter how many times I exit, and it deletes my
> homepage and resets it to "http://homepage"
> --I get an aggressive popup that says "MS Support Security Alert--Your
> Internet usage is being tracked! Everyone can spy on you right now!
> Protect your online privacy and visit and download Free soft at
> http://security.com" This popup repeats itself endlessly no matter
> how many times I try to delete it
> ---a growing collection of shortcuts are placed on my desktop and on
> my IE Favorites, including shortcuts to "Intellosearch, ltd",
> "Microsearch", "Microsoft Security System", "Online Pharmacy",
> "Viagra", the list just keeps growing...many of these shortcuts lead
> to bogus, dead-end sites (just like "security.com")
> ---other re-direct sites eventually appear, including some search
> sites and porn sites, e.g. "cool-search.com", "xxxxx.com", and/or
> "xxx69.com"...these are mostly deadends, although sometimes an actual
> porn link page will appear;
> ---my Internet temporary files show that these moves are triggered by
> the continued insertion of a program called "5.exe", which is inserted
> regularly in groups of three. The three sources of the program "5.exe"
> are listed as http://man.cykahax.com/5.exe,
> http://beta.softdevelops.com/5.exe, and http://alltheporn.com/5.exe.
> I have gone to all 3 sites attempting to get uninstall information and
> can obtain no information, despite requests to the webmaster(s).
> ---the program "5.exe" is not listed in my "Add/Remove Programs" in
> Windows, and I can't find evidence of it elsewhere (such as in Windows
> Downloads folder).
>
> Does anyone recognize this one? Can anyone help? This is a nasty
> one. Moreover, it's on my work computer, I can't seem to get rid of
> it, and I'm worried I'm going to get into a heap of trouble!
>
> Thanks for any help you can offer!

Get CWShredder and unzip and run it.
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Read about CWS:
http://www.spywareinfo.com/~merijn/cwschronicles.html

HijackThis to look for remnants.
http://mjc1.com/mirror/hjt/