MSN Spyware?

Self ^ | Feb 27, 2004 | self

[OldCorps]

My daughter used AOL IM and MSN hotmail last night. Probably some other stuff too. OS is Windows ME. This morning after booting up i clicked on IExplorer. The computer went to this webpage, showing the usual MSN webpage:

http://www.browser-page.com/home.html

the computer then opened another page:

http://www.adwarehunter.com/creatives/alert1.gif

The crazy thing is, I went back to tools, internet options, and reset my homepage back to the Washington Times, and saved changes. I closed down all other operations and reopened IE. Browser again went back to the MSN homepage. What gives?

Now i'm really mad, so I ran both spybot and lavasoft adaware (not simutaneously) , and neither one picked up anything. Then went to settings...add/install programs...and deleted anything unfamiliar.

This junk still runs when i click IE.

[OldCorps]

Anyone seen this or have the same problems? Any suggestions?

thanks

[Ethrane]

Go get ad-aware and/or spybot (preferably both)...install them and make sure you have the latest updates.

I've had great success with both programs cleaning up typical "spyware" issues after the kids get on the computer.

There are free versions of both.

Just google search the program names to find the websites and download.

Hope this helps!

[Gordian Blade]

You need to download and run a program like Ad-Aware, which finds and removes spyware/adware from your computer. Many programs that you download from the net secretly place these into your system and in such a way that you cannot easily remove them without a program specifically designed to seek and destroy. Do a Google search on Ad-Aware and you should be able to find the free version. There are other programs that do the same thing also. Good luck!

[Agnes Heep]

Check your hosts file to see if entries have been made recently that would map your home page address to the adware address.

[jktulsaok]

That's a browser hijacking, caused by spyware. There are a number of free programs that will remove it. Here's a good one http://www.safer-networking.org/

[Cicero]

I don't use MSN, so I haven't seen this. Microsoft used to do this in the past when you installed a new version of Internet Explorer, but if you changed the home page back in settings, it would only do it once. But I don't see why MSN would be doing this.

It's very doubtful that AOL is involved in this particular problem, since AOL and MSN are competitors.

Maybe someone will have a specific answer, but meantime I would suggest using AdAware and Spybot Search&Destroy to look for adware and remove it. Adawarehunter may be a site that looks for and interferes with AdAware. There is another little program at Lavasoft, recently released, called Ad-aware Cloak 1.0 that can be installed if some program on the web is shutting down AdAware. That could also be what is happening. You can see the details on that at BetaNews:

http://fileforum.betanews.com/detail.php3?fid=1075830644

[steplock]

THat is one VERY nasty virus/scumware/spyware you have on your computer.

It took me 3 hours to remove it from a friend's computer (thanx to Win-Me).

#1 TURN OFF System Restore!
#2 Download, Install & Run AdAware & Spybot at least twice each
#3 On-Line go to http://housecall.antivirus.com/housecall/start_corp.asp (set this scan for Auto Clean - you'll see where)

#4 rerun adaware & spybot until you see ZERO problems

#5 Hopefully your computer still functions after all this

#6 http://v4.windowsupdate.microsoft.com/en/default.asp and get the CRITICAL updates

Do all this, there are a couple more programs that may be necessary - I'll check back here and see if you need them.

[Lexington Green]

I'll watch for informed replies because I just encountered the same problem... like my browser's been hijacked by adsearch and other basturds.

[OldCorps]

wow, kinda like runing counter-counter measures. this battle with spam and spyware is getting out of control.

To all:

thanks for the tips.

[steplock]

I said to turn off the System Restore because that is where this POS is residing - no matter where you find and delete it, if restore is operating, it will simply restore itself.

It is nasty.

[Stu Cohen]

Sound like it could be a "Browser Helper". These basically don't help you, but help the company get more hits on it's homepage. They are not always flagged as spyware or adware, since they don't techincally spy or send any information to anyone ... they just change settings of certain programs.

There is a tool to remove this. Do a search for "BHO Cop". It is similar to adaware, except that this one searches and removes BHO's.

It's worth a shot.

One more piece of advice. Don't use AOL or MSN unless you absolutely have to. I know that subject has been beaten to death ... but it's good advice.

[freedomlover]

bump 4 tonite

[Stu Cohen]

Oh.

BHO = Browser Helper Object

[Hodar]

Do a search for the file "hosts"; there is NOT a suffix to this. You may open it with notepad, or wordpad. This is a simple text file that tells your PC whom to use for the nameserver, and what websites (if any) to immediately disconnect from. It can also over-ride some of your settings, thus forcing you where you may not want to go.

So, open it with Wordpad or Notepad. You may find that there are some weird entries, if so you may delete them and save the file. Wordpad or Notepad will save the file, but will call it hosts.txt. That's OK.... just go back in with explorer and remove the .txt part.

Then there's always the easy way.... if you open 'Internet Settings', did one of those sites just reset your home page? If so, you can set it back to what you had it, and apply it as your home page again.

[steplock]

Here are a couple more (in my opinion necessary)...

spywareblaster Prevents most spywarez from being installed - Keeps out 90%+
http://webzoom.freewebs.com/bluzman32/spywareblastersetup.exe

http://www.snapfiles.com/get/systemwiper.html this utility will erase ALL temporary files/cookies/etc (programmable)

As with ALL security systems - UPDATE UPDATE UPDATE UPDATE !!!!

[rogueleader]

You need to stop using IE.

Get Mozilla Firefox.

http://www.mozilla.org/

[steplock]

In addition to being a security risk, Windows' "Messenger Service" is being used to "Spam" Windows users across the Internet.

This 22 kbyte "Shoot The Messenger" utility gives users immediate control over the Windows Messenger service.

http://grc.com/stm/shootthemessenger.htm

.

[Future Useless Eater]

`

[SengirV]

Buy a Mac, it will solve all your computing problems.

Don't listen to the M$ drones that will blast me with follow ups, they still have their heads buried in the sand - this ain't your '95 Mac anymore =)

[MD_Willington_1976]

What OS are you running...if it's XP Home or Pro then MSMSG.EXE (messenger) loads up if you check your email anyway, and it runs in the background forever until you kill it with the task manager...

Later

MD