Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

MSN Spyware?
Self ^ | Feb 27, 2004 | self

Posted on 02/27/2004 9:47:06 AM PST by OldCorps

My daughter used AOL IM and MSN hotmail last night. Probably some other stuff too. OS is Windows ME. This morning after booting up i clicked on IExplorer. The computer went to this webpage, showing the usual MSN webpage:

http://www.browser-page.com/home.html

the computer then opened another page:

http://www.adwarehunter.com/creatives/alert1.gif

The crazy thing is, I went back to tools, internet options, and reset my homepage back to the Washington Times, and saved changes. I closed down all other operations and reopened IE. Browser again went back to the MSN homepage. What gives?

Now i'm really mad, so I ran both spybot and lavasoft adaware (not simutaneously) , and neither one picked up anything. Then went to settings...add/install programs...and deleted anything unfamiliar.

This junk still runs when i click IE.


TOPICS: Business/Economy; Miscellaneous; Technical; Unclassified; Your Opinion/Questions
KEYWORDS: lowqualitycrap; microsoft; msn; msnnetwork; spybots; spyware; windows
Navigation: use the links below to view more comments.
first 1-5051-63 next last
Anyone seen this or have the same problems? Any suggestions?

thanks

1 posted on 02/27/2004 9:47:06 AM PST by OldCorps
[ Post Reply | Private Reply | View Replies]

To: OldCorps
Go get ad-aware and/or spybot (preferably both)...install them and make sure you have the latest updates.

I've had great success with both programs cleaning up typical "spyware" issues after the kids get on the computer.

There are free versions of both.

Just google search the program names to find the websites and download.

Hope this helps!
2 posted on 02/27/2004 9:51:39 AM PST by Ethrane ("semper consolar")
[ Post Reply | Private Reply | To 1 | View Replies]

To: OldCorps
You need to download and run a program like Ad-Aware, which finds and removes spyware/adware from your computer. Many programs that you download from the net secretly place these into your system and in such a way that you cannot easily remove them without a program specifically designed to seek and destroy. Do a Google search on Ad-Aware and you should be able to find the free version. There are other programs that do the same thing also. Good luck!
3 posted on 02/27/2004 9:51:56 AM PST by Gordian Blade
[ Post Reply | Private Reply | To 1 | View Replies]

To: OldCorps
Check your hosts file to see if entries have been made recently that would map your home page address to the adware address.
4 posted on 02/27/2004 9:53:00 AM PST by Agnes Heep
[ Post Reply | Private Reply | To 1 | View Replies]

To: OldCorps
That's a browser hijacking, caused by spyware. There are a number of free programs that will remove it. Here's a good one http://www.safer-networking.org/
5 posted on 02/27/2004 9:54:56 AM PST by jktulsaok
[ Post Reply | Private Reply | To 1 | View Replies]

To: OldCorps
I don't use MSN, so I haven't seen this. Microsoft used to do this in the past when you installed a new version of Internet Explorer, but if you changed the home page back in settings, it would only do it once. But I don't see why MSN would be doing this.

It's very doubtful that AOL is involved in this particular problem, since AOL and MSN are competitors.

Maybe someone will have a specific answer, but meantime I would suggest using AdAware and Spybot Search&Destroy to look for adware and remove it. Adawarehunter may be a site that looks for and interferes with AdAware. There is another little program at Lavasoft, recently released, called Ad-aware Cloak 1.0 that can be installed if some program on the web is shutting down AdAware. That could also be what is happening. You can see the details on that at BetaNews:

http://fileforum.betanews.com/detail.php3?fid=1075830644
6 posted on 02/27/2004 9:54:57 AM PST by Cicero (Marcus Tullius)
[ Post Reply | Private Reply | To 1 | View Replies]

To: OldCorps
THat is one VERY nasty virus/scumware/spyware you have on your computer.

It took me 3 hours to remove it from a friend's computer (thanx to Win-Me).

#1 TURN OFF System Restore!
#2 Download, Install & Run AdAware & Spybot at least twice each
#3 On-Line go to http://housecall.antivirus.com/housecall/start_corp.asp (set this scan for Auto Clean - you'll see where)

#4 rerun adaware & spybot until you see ZERO problems

#5 Hopefully your computer still functions after all this

#6 http://v4.windowsupdate.microsoft.com/en/default.asp and get the CRITICAL updates

Do all this, there are a couple more programs that may be necessary - I'll check back here and see if you need them.
7 posted on 02/27/2004 9:55:26 AM PST by steplock
[ Post Reply | Private Reply | To 1 | View Replies]

To: OldCorps
I'll watch for informed replies because I just encountered the same problem... like my browser's been hijacked by adsearch and other basturds.
8 posted on 02/27/2004 9:56:57 AM PST by Lexington Green (Benedict Arnold - Jane Fonda - John Kerry)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Cicero
wow, kinda like runing counter-counter measures. this battle with spam and spyware is getting out of control.

To all:

thanks for the tips.
9 posted on 02/27/2004 9:56:57 AM PST by OldCorps
[ Post Reply | Private Reply | To 6 | View Replies]

To: steplock
I said to turn off the System Restore because that is where this POS is residing - no matter where you find and delete it, if restore is operating, it will simply restore itself.

It is nasty.
10 posted on 02/27/2004 9:57:11 AM PST by steplock
[ Post Reply | Private Reply | To 7 | View Replies]

To: OldCorps
Sound like it could be a "Browser Helper". These basically don't help you, but help the company get more hits on it's homepage. They are not always flagged as spyware or adware, since they don't techincally spy or send any information to anyone ... they just change settings of certain programs.

There is a tool to remove this. Do a search for "BHO Cop". It is similar to adaware, except that this one searches and removes BHO's.

It's worth a shot.

One more piece of advice. Don't use AOL or MSN unless you absolutely have to. I know that subject has been beaten to death ... but it's good advice.

11 posted on 02/27/2004 9:57:38 AM PST by Stu Cohen
[ Post Reply | Private Reply | To 1 | View Replies]

To: steplock
bump 4 tonite
12 posted on 02/27/2004 9:58:21 AM PST by freedomlover
[ Post Reply | Private Reply | To 7 | View Replies]

To: Stu Cohen
Oh.

BHO = Browser Helper Object

13 posted on 02/27/2004 9:58:39 AM PST by Stu Cohen
[ Post Reply | Private Reply | To 11 | View Replies]

To: OldCorps
Do a search for the file "hosts"; there is NOT a suffix to this. You may open it with notepad, or wordpad. This is a simple text file that tells your PC whom to use for the nameserver, and what websites (if any) to immediately disconnect from. It can also over-ride some of your settings, thus forcing you where you may not want to go.

So, open it with Wordpad or Notepad. You may find that there are some weird entries, if so you may delete them and save the file. Wordpad or Notepad will save the file, but will call it hosts.txt. That's OK.... just go back in with explorer and remove the .txt part.

Then there's always the easy way.... if you open 'Internet Settings', did one of those sites just reset your home page? If so, you can set it back to what you had it, and apply it as your home page again.
14 posted on 02/27/2004 9:58:55 AM PST by Hodar (With Rights, comes Responsibilities. Don't assume one, without assuming the other.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: OldCorps
Here are a couple more (in my opinion necessary)...

spywareblaster Prevents most spywarez from being installed - Keeps out 90%+
http://webzoom.freewebs.com/bluzman32/spywareblastersetup.exe

http://www.snapfiles.com/get/systemwiper.html this utility will erase ALL temporary files/cookies/etc (programmable)

As with ALL security systems - UPDATE UPDATE UPDATE UPDATE !!!!
15 posted on 02/27/2004 10:07:16 AM PST by steplock
[ Post Reply | Private Reply | To 1 | View Replies]

To: OldCorps
You need to stop using IE.

Get Mozilla Firefox.

http://www.mozilla.org/
16 posted on 02/27/2004 10:08:44 AM PST by rogueleader
[ Post Reply | Private Reply | To 1 | View Replies]

To: OldCorps
In addition to being a security risk, Windows' "Messenger Service" is being used to "Spam" Windows users across the Internet.

This 22 kbyte "Shoot The Messenger" utility gives users immediate control over the Windows Messenger service.

http://grc.com/stm/shootthemessenger.htm

.
17 posted on 02/27/2004 10:09:44 AM PST by steplock
[ Post Reply | Private Reply | To 1 | View Replies]

`
18 posted on 02/27/2004 10:13:39 AM PST by Future Useless Eater (Freedom_Loving_Engineer)
[ Post Reply | Private Reply | To 7 | View Replies]

To: OldCorps
Buy a Mac, it will solve all your computing problems.

Don't listen to the M$ drones that will blast me with follow ups, they still have their heads buried in the sand - this ain't your '95 Mac anymore =)

19 posted on 02/27/2004 10:16:50 AM PST by SengirV
[ Post Reply | Private Reply | To 1 | View Replies]

To: Cicero
What OS are you running...if it's XP Home or Pro then MSMSG.EXE (messenger) loads up if you check your email anyway, and it runs in the background forever until you kill it with the task manager...

Later

MD
20 posted on 02/27/2004 10:21:03 AM PST by MD_Willington_1976
[ Post Reply | Private Reply | To 6 | View Replies]

To: Lexington Green
like my browser's been hijacked by adsearch and other basturds

Mine, too. It's driving me nuts. Anybody else have the executable lefeatures causing trouble?

21 posted on 02/27/2004 10:21:18 AM PST by txhurl
[ Post Reply | Private Reply | To 8 | View Replies]

To: steplock
You are probably right. Norton advises that you have to turn of System Restore when you remove many recent email viruses, because otherwise the bad files will be restored.

This is dangerous, because when you turn it off, it gets rid of the restore points, which means you have no way to restore the system at that point if something further goes wrong. But it seems as if you have little or no choice.
22 posted on 02/27/2004 10:21:58 AM PST by Cicero (Marcus Tullius)
[ Post Reply | Private Reply | To 10 | View Replies]

To: SengirV
I would but I could buy a nice used car for the same price as a new mac...
23 posted on 02/27/2004 10:22:22 AM PST by MD_Willington_1976
[ Post Reply | Private Reply | To 19 | View Replies]

To: MD_Willington_1976
http://store.apple.com/1-800-MY-APPLE/WebObjects/AppleStore.woa/70702/wo/So60tlmoNJi22lG1jDU1jiAun7u/2.0.7.1.0.5.3

$6,678.90...
24 posted on 02/27/2004 10:25:40 AM PST by MD_Willington_1976
[ Post Reply | Private Reply | To 23 | View Replies]

To: txflake
i started having this problem ( and a LOT of others ) when I installed the MSN 9 upgrade....never had a problem before this.....
25 posted on 02/27/2004 10:26:06 AM PST by bioprof
[ Post Reply | Private Reply | To 21 | View Replies]

To: MD_Willington_1976
Ain't that the truth.
26 posted on 02/27/2004 10:26:52 AM PST by dts32041 ( "Repeal the 16th and 17th amendments.")
[ Post Reply | Private Reply | To 23 | View Replies]

To: MD_Willington_1976
I run XP Pro. But I've used Gibson Research's Shoot the Messenger to turn of MS Messenger. Also his other little progams.
27 posted on 02/27/2004 10:26:54 AM PST by Cicero (Marcus Tullius)
[ Post Reply | Private Reply | To 20 | View Replies]

To: bioprof
Then MSN wiped out all my mail. All of it.
28 posted on 02/27/2004 10:29:05 AM PST by txhurl
[ Post Reply | Private Reply | To 25 | View Replies]

To: steplock
BUMP
29 posted on 02/27/2004 10:33:00 AM PST by chiller (JUDGES is JOB #1)
[ Post Reply | Private Reply | To 17 | View Replies]

To: OldCorps
I had a similar problem. Spybot didn't fix it. Neither did "Hijack This". "CW Shredder" did!!

Good luck!
30 posted on 02/27/2004 10:39:51 AM PST by Bon mots
[ Post Reply | Private Reply | To 1 | View Replies]

To: OldCorps
I had a similar problem when my IE browser was hijacked by Shopnav. I followed the steps at www.pestpatrol.com, which involved deleting the registry keys. It took several tries (I'm not sure I was following the directions correctly), but it was finally back to normal. PestPatrol also has a program you can buy that will remove it for you.

Good luck.

31 posted on 02/27/2004 10:39:51 AM PST by agsloss
[ Post Reply | Private Reply | To 1 | View Replies]

To: agsloss
thanks
32 posted on 02/27/2004 10:46:06 AM PST by Kiss Me Hardy
[ Post Reply | Private Reply | To 31 | View Replies]

To: agsloss


I think this shredder is specialized for the "Cool Web Search" Hijacker... you can also try "Hijack This"

As a prophylactic against future hijackings... first of all, run your updates (virus and MS), but you can also install an anti-hijack program like this:


Browser Hijack Blaster!
33 posted on 02/27/2004 10:46:54 AM PST by Bon mots
[ Post Reply | Private Reply | To 31 | View Replies]

To: OldCorps
you've been had by spyware. In addition to the other fixes you get, try this five star fix.

http://www.javacoolsoftware.com/spywareblaster.html

You do not necessarily need to choose between different spyware removers. They all have their strengths. Most do not run continuously. The remove or disable spyware and shut down.

You need to get the latest updates for any of these tools on a regular basis and run the latest version. Spyware Blaster is particularly cool, because in most cases it will prevent the installation of spyware, not just remove it. Some of these suckers imbed themselves like the Alien into your system. I have seen systems where you had to uninstall Windows networking and reinstall it from scratch.

34 posted on 02/27/2004 10:48:26 AM PST by js1138
[ Post Reply | Private Reply | To 1 | View Replies]

To: agsloss
Another good thing is to get a startup manager program. (Examples, anyone? I'm away from home.) Most of them let you "untick" stuff you didn't even know was executing every time you boot up. This often will prevent background hijacks from activating on boot up, and let your spyware hunters work more efficiently.

I lowered my IE zone control at work to visit legitimate websites for my job, and like the insectoids on Enterprise last week, the little vermin skittered right in and set up shop. What a bear!

35 posted on 02/27/2004 10:50:12 AM PST by 50sDad (OK, I give in. Visit my website! http://my.oh.voyager.net/~abartmes)
[ Post Reply | Private Reply | To 31 | View Replies]

To: Dark Wing
ping
36 posted on 02/27/2004 10:52:30 AM PST by Thud
[ Post Reply | Private Reply | To 1 | View Replies]

"Hijack This!"



Do not run Hijack This from Winzip. Unpack it into its own folder!!

If you need some other free tools like this, have a look at this page:
http://www.lurkhere.com/~nicefiles/
37 posted on 02/27/2004 10:55:24 AM PST by Bon mots
[ Post Reply | Private Reply | To 33 | View Replies]

To: steplock
I had four Icons suddenly appear on my desktop,and and the Internt Exployer Icon wouldn't work.Through Tech Assistance with Road Runner we determined the Browser wasn't working.I got on line through My Computer.I was able to uninstall two of the Icons.At time the machine takes a long time to load a page.Getting on to Free Republic doesn't seem to be a problem.

Skinny Old Man
38 posted on 02/27/2004 10:55:35 AM PST by skinny old man
[ Post Reply | Private Reply | To 7 | View Replies]

To: OldCorps
It happens to me all the time. I finally figured out how to go back and use the "restore" feature and reset everything back a few says. I'm a computor idiot and this took me forever. Prior to figuring that out I was reloading all of my software.
39 posted on 02/27/2004 11:01:31 AM PST by Terry Mross
[ Post Reply | Private Reply | To 1 | View Replies]

To: OldCorps
Anyone seen this or have the same problems? Any suggestions?

I'm not wearing my T.F.H. but yestersday at work we had a problem with Internet Exploder, if your home page was set to MSN it would dump the system.

40 posted on 02/27/2004 11:02:56 AM PST by NativeSon
[ Post Reply | Private Reply | To 1 | View Replies]

To: Terry Mross
Restore is not a good solution to a spyware infection.
41 posted on 02/27/2004 11:07:34 AM PST by js1138
[ Post Reply | Private Reply | To 39 | View Replies]

To: OldCorps; whatevergurl
bump
42 posted on 02/27/2004 11:20:50 AM PST by OldCorps
[ Post Reply | Private Reply | To 1 | View Replies]

Bookmarking for later. Good info here.
43 posted on 02/27/2004 11:24:34 AM PST by .38sw
[ Post Reply | Private Reply | To 1 | View Replies]

To: MD_Willington_1976
or perhaps... something else.
44 posted on 02/27/2004 11:34:03 AM PST by frankenMonkey
[ Post Reply | Private Reply | To 24 | View Replies]

To: OldCorps
You might give Spyhunter from http://www.enigmasoftwaregroup.com/ a try. It has found stuff on my system that adaware and spybot overlooked, even though the defs were up to date. The Spyhunter scan is free. You have to buy (29.99, I think) the removal tool. But the scanner will tell you the names of the files it found. So just deleting those files may solve your problem.
45 posted on 02/27/2004 11:57:43 AM PST by upchuck (Ta-ray-za now gets to execute her "maiming of choice." I'm hoping for eye gouging, how 'bout you?)
[ Post Reply | Private Reply | To 1 | View Replies]

To: upchuck
You might give Spyhunter from http://www.enigmasoftwaregroup.com/ a try.

Hey, upchuck! Haven't talked to you in a while. Just wanted to let you know that I use Spyhunter here on my job, and it is great. Spent a significant amount of time at work today installing it on a number of machines.

46 posted on 02/27/2004 12:08:18 PM PST by RonPaulLives
[ Post Reply | Private Reply | To 45 | View Replies]

To: RonPaulLives
ping for later
47 posted on 02/27/2004 12:24:21 PM PST by Tailback
[ Post Reply | Private Reply | To 46 | View Replies]

To: frankenMonkey
My 18 month old son would have that toy ripped apart in no time flat...
48 posted on 02/27/2004 12:24:52 PM PST by MD_Willington_1976
[ Post Reply | Private Reply | To 44 | View Replies]

To: steplock
thanks steplock for your advice. everything running fine. we'll see if the stuff pops up again.

funny thing is, i've run windows update many times in the past. It would always tell me that i need to install 2 critical updates, (something to IE, i think). every time i downloaded them, i'd go back and see if they took. they didn't.

however, this time i turned off system restore as you suggested, and the update went through. Many thanks, amigo.

regards,
49 posted on 02/27/2004 12:59:15 PM PST by OldCorps
[ Post Reply | Private Reply | To 7 | View Replies]

To: steplock
btw, you said the program resided in system restore? when i reran adaware, it only found bots in cookies, nothing in restore.

should i go turn on restore now?

thanks again,
50 posted on 02/27/2004 1:00:42 PM PST by OldCorps
[ Post Reply | Private Reply | To 10 | View Replies]


Navigation: use the links below to view more comments.
first 1-5051-63 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson