Hijacker

[Diekan]

Ok - this is annoying.... I can't seem to fix my little problem here.

Some how I've got a hijacker program installed on this machine. It autosets my browser to 'about:blank' and there's nothing that I've tried that seems to get rid of it.

I've run Adware, which finds it and deletes it... but that doesn't work.

I've gone into the regedit utility and manually deleted it, but that doesn't work. Apparently, it's hidden somewhere else.

My virus scanner (norton) isn't picking it up either.

Anyone have an idea?

It's in the HKEY_LOCAL_MACHINE:Software.Microsoft.InternetExplorer.Main

Called "HOMEOLDsp."

I've searched my Windows directory sys and sys32 for anything that remotely resembles it, but to no avail. There's nothing in the add remove programs about it either... nor are their any out-of-place folders I can see.

People who write this malicious shit need to be publicly executed... literally.

[Scoota McGee]

Spy-ware crappola often hides here:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Everything here runs whenever you start the machine. Make sure you recognize or can figure out what programs run on start. Delete the rest.

[Martrae]

http://www.safer-networking.org/
spybot is better than ad-aware....hearing rumors that ad-aware is using spyware itself now.

also get AVG, Norton has really gone into the toilet.

[Scoota McGee]

Found something. Sounds like you have Raxums.

SARC has a complete write up on it:
http://sarc.com/avcenter/venc/data/adware.raxums.html

[Diekan]

I followed the instructions to a T, didn't work... even re-updated my Norton 2003 Pro and ran a full scan... this time it found it, but was not successul in removing it.

I hope they catch this fucker and split him from gullet to groin while still alive... and then let a few starving rats feed on his entrails as he watchs...

I seriously think they should institute the death penalty for people like this. You kill a few of them and they'll get the idea.

[Harrison]

I fully agree. Same with people who corrupt MP3's on p2p programs. And then share them en-masse.

[Diekan]

http://www.spywareinfo.com/~merijn/files/CWShredder.exe


This program removes the malicious application and provides you with details about how it works, what it is, so on.

One of my old guildmates provided me with the link -

Thanks Gunjin.

p.s. apparently this particular torjan is become more and more popular with abult / warez site pop ups. They don't know which just that it's spreding rapidly.