Help with some dirty fucking spyware

CaptainJSparrow · 2004-03-14, 12:35 PM

Before you read below...do not click on the link that I put in because I think it could do the same to your PC that it did to mine.

LL owners, be careful of the sites that you open when you validate sites...I am pretty sure that this is how my PC got infected.

Somehow, I think it happened while validating sites submitted to my LL, some shitbag reset my default homepage in Internet Explorer to this: res://mshp.dll/index.html#37049 ...and I can't change it. I go into ie, tools, Internet Options, programs, and hit "Reset Web Settings" and it will do it temporarily. When I restart my computer that res://mshp.dll/index.html#37049 is back as my default.

I've run the latest Spybot Search and Destroy to no avail.

Does anyone know how to reset my default home page so this spyware goes away. Is there anything else that I need to look at on my PC?

Thanks!

Jim · 2004-03-14, 12:47 PM

Take a look here
http://forums.techguy.org/t203900/se...1ebe49a02.html

CaptainJSparrow · 2004-03-14, 01:00 PM

Thanks Jim! I'm reading it now and will let everyone know if this works.

CaptainJSparrow · 2004-03-14, 02:05 PM

Ok, I think it is now fixed. Jim the place that you recommended had good advice, the only thing was the link that they said to click on for "CWShredder" didn't work. I went to google and found this:

http://www.sherrylynn.us/CWShredder.exe

I loaded it and it seemed to work.

Thanks for the help Jim and I hope this helps anyone else that has this problem.

Surfn · 2004-03-14, 02:27 PM

I only had some a bad shit once. Fortunately I'm completly comfortable tweaking the windows registry and went in and deleted all the crap.

I do use Adaware from time to time to check, and if it finds something rather than having it delete it or quarantine it, I go to the registry myself and remove it.

Linkster · 2004-03-15, 08:37 AM

Captn

if you need more stuff to check the PC - this is the authors download page - he also has a program called hijackthis hat goes along with cwshredder to totally disinfect from spyware - I dont even run much except adaware from lavasoft and these programs when I get infected reviewing sites and it has always taken care of the problems

http://www.spywareinfo.com/~merijn/downloads.html

note that these programs get updated pretty frequently so its best to D/L the most recent one from the authors site each time you want to run it - it's almost a daily battle to keep up with the spyware kiddies

CaptainJSparrow · 2004-03-15, 09:41 AM

Thanks Linkster!

I downloaded it and ran it. My logs look Ok, is there anything in particular that anyone can recommend that I look for?

Linkster · 2004-03-15, 10:58 AM

Are you still having any problems after running the cwshredder?

stev0 · 2004-03-15, 12:46 PM

Spyware is such a pain in the ass... might want to look into running Adaware. It's pretty good at catching most if not all of it... and it's got a monitoring utility (in the paid version, the free one just scans and removes).

Jim · 2004-03-15, 12:49 PM

One thing I do when I get something nasty like that is also recommended on that site. I just take the URL that I am sent to and search it on any search engine. That is how I found that place. It will usually point you in the right direction to get rid of it.

Jim · 2004-03-15, 12:52 PM

And I have Norton's Internet Suite and 3 spyware programs but things still get through. I hate that crap...

The funny thing is...right after I posted that the other day, I all of a sudden had a new Start page, my google bar went away and I had popups

I searched the URL of the new Start Page and sure enough, I found directions on how to get rid of it.

2004-03-14, 12:35 PM	#1
CaptainJSparrow You can now put whatever you want in this space :) Join Date: Sep 2003 Location: Louisiana Posts: 511	Help with some dirty fucking spyware Before you read below...do not click on the link that I put in because I think it could do the same to your PC that it did to mine. LL owners, be careful of the sites that you open when you validate sites...I am pretty sure that this is how my PC got infected. Somehow, I think it happened while validating sites submitted to my LL, some shitbag reset my default homepage in Internet Explorer to this: res://mshp.dll/index.html#37049 ...and I can't change it. I go into ie, tools, Internet Options, programs, and hit "Reset Web Settings" and it will do it temporarily. When I restart my computer that res://mshp.dll/index.html#37049 is back as my default. I've run the latest Spybot Search and Destroy to no avail. Does anyone know how to reset my default home page so this spyware goes away. Is there anything else that I need to look at on my PC? Thanks! Last edited by CaptainJSparrow; 2004-03-14 at 01:00 PM..

2004-03-14, 02:27 PM	#5
Surfn If you don’t take a chance the Angels won’t dance Join Date: Aug 2003 Location: Earth on occasion Posts: 8,812	I only had some a bad shit once. Fortunately I'm completly comfortable tweaking the windows registry and went in and deleted all the crap. I do use Adaware from time to time to check, and if it finds something rather than having it delete it or quarantine it, I go to the registry myself and remove it. __________________ Surfn's Links Are you a partner?

2004-03-15, 08:37 AM	#6
Linkster NO! Im not a female - but being a dragon, I do eat them. Join Date: Mar 2003 Location: Sex Delta Posts: 5,084	Captn if you need more stuff to check the PC - this is the authors download page - he also has a program called hijackthis hat goes along with cwshredder to totally disinfect from spyware - I dont even run much except adaware from lavasoft and these programs when I get infected reviewing sites and it has always taken care of the problems http://www.spywareinfo.com/~merijn/downloads.html note that these programs get updated pretty frequently so its best to D/L the most recent one from the authors site each time you want to run it - it's almost a daily battle to keep up with the spyware kiddies __________________ Pussy Chompers Porn Links NSCash

2004-03-15, 10:58 AM	#8
Linkster NO! Im not a female - but being a dragon, I do eat them. Join Date: Mar 2003 Location: Sex Delta Posts: 5,084	Are you still having any problems after running the cwshredder? __________________ Pussy Chompers Porn Links NSCash

2004-03-15, 12:46 PM	#9
stev0 You tried your best and you failed miserably. The lesson is 'never try' Join Date: Mar 2004 Location: Calgary Posts: 165	Spyware is such a pain in the ass... might want to look into running Adaware. It's pretty good at catching most if not all of it... and it's got a monitoring utility (in the paid version, the free one just scans and removes). __________________ PornDVDDollars - Awesome conversions

2004-03-14, 12:47 PM	#2
Jim Banned Join Date: Aug 2003 Location: Mohawk, New York Posts: 19,477	Take a look here http://forums.techguy.org/t203900/se...1ebe49a02.html

2004-03-14, 01:00 PM	#3
CaptainJSparrow You can now put whatever you want in this space :) Join Date: Sep 2003 Location: Louisiana Posts: 511	Thanks Jim! I'm reading it now and will let everyone know if this works.

2004-03-14, 02:05 PM	#4
CaptainJSparrow You can now put whatever you want in this space :) Join Date: Sep 2003 Location: Louisiana Posts: 511	Ok, I think it is now fixed. Jim the place that you recommended had good advice, the only thing was the link that they said to click on for "CWShredder" didn't work. I went to google and found this: http://www.sherrylynn.us/CWShredder.exe I loaded it and it seemed to work. Thanks for the help Jim and I hope this helps anyone else that has this problem.

2004-03-15, 09:41 AM	#7
CaptainJSparrow You can now put whatever you want in this space :) Join Date: Sep 2003 Location: Louisiana Posts: 511	Thanks Linkster! I downloaded it and ran it. My logs look Ok, is there anything in particular that anyone can recommend that I look for?

2004-03-15, 12:49 PM	#10
Jim Banned Join Date: Aug 2003 Location: Mohawk, New York Posts: 19,477	One thing I do when I get something nasty like that is also recommended on that site. I just take the URL that I am sent to and search it on any search engine. That is how I found that place. It will usually point you in the right direction to get rid of it.

2004-03-15, 12:52 PM	#11
Jim Banned Join Date: Aug 2003 Location: Mohawk, New York Posts: 19,477	And I have Norton's Internet Suite and 3 spyware programs but things still get through. I hate that crap... The funny thing is...right after I posted that the other day, I all of a sudden had a new Start page, my google bar went away and I had popups I searched the URL of the new Start Page and sure enough, I found directions on how to get rid of it.