My computer was taken over!

Discussion in 'System Security & Infection Support' started by Ken R., Jan 17, 2004.

  1. Ken R.

    Ken R. VIP Member

    Joined:
    Jan 10, 2004
    Messages:
    104
    Likes Received:
    0
    Location:
    Florida
    After a visit to a web site, either a virus or spyware has taken over my computer.

    My home page, which I had set to Google, has been replaced by some ******* search page. I change it back to Google, but it just changes back to this same page.

    When I try to run Ad Aware 6, the program closes by itself as soon as it opens. Same thing if I try to go to a web site that has spyware killing programs on it, it just closes the browser down.

    Virus? Spyware? HELP!
     
    Ken R., Jan 17, 2004
    #1
    1. Advertisements

  2. Ken R.

    James Photojournalist

    Joined:
    Dec 24, 2002
    Messages:
    6,662
    Likes Received:
    35
    Strange. What happens if you do this in Safe Mode?
     
    James, Jan 17, 2004
    #2
    1. Advertisements

  3. Ken R.

    Ken R. VIP Member

    Joined:
    Jan 10, 2004
    Messages:
    104
    Likes Received:
    0
    Location:
    Florida
    Haven't tried, but I will. I have heard of viruses or spyware that changes people's home pages to something else, so I figure this is a virus, or spyware.
     
    Ken R., Jan 17, 2004
    #3
  4. Ken R.

    Ken R. VIP Member

    Joined:
    Jan 10, 2004
    Messages:
    104
    Likes Received:
    0
    Location:
    Florida
    Update:

    My system had a virus called "download.trojan". I got it off my system, but it did some unwanted things. My default home web page in Internet Explorer has been changed to smartsearch.ws.

    If I type google.com in the address bar, it goes to smartsearch.ws instead. A check of the registry shows numerous instances of smartsearch.ws mentioned, including this listed as my default search engine, among other entries. Also, if I try to launch Ad Aware, it closes by itself before I have a chance to run it. How can I fix these things?
     
    Ken R., Jan 17, 2004
    #4
  5. Ken R.

    S Walch MAME 0.64 :) VIP Member

    Joined:
    Jun 2, 2003
    Messages:
    1,026
    Likes Received:
    14
    Location:
    Manchester
    For your homepage: It has been locked by some spyware you got or the virus itself.

    You pretty much just need the below registry unlock key in order for you to be able to change your homepage:

    http://brianwall.co.uk/homepageunlock.reg

    As for ad-aware always closing, try uninstalling and reinstalling it.
     
    S Walch, Jan 17, 2004
    #5
  6. Ken R.

    Ken R. VIP Member

    Joined:
    Jan 10, 2004
    Messages:
    104
    Likes Received:
    0
    Location:
    Florida
    I downloaded the above file, but what do I do with it?
     
    Ken R., Jan 17, 2004
    #6
  7. Ken R.

    S Walch MAME 0.64 :) VIP Member

    Joined:
    Jun 2, 2003
    Messages:
    1,026
    Likes Received:
    14
    Location:
    Manchester
    ..click it lol

    then click yes when it asks you if you want to add it to the registy.
     
    S Walch, Jan 17, 2004
    #7
  8. Ken R.

    Ken R. VIP Member

    Joined:
    Jan 10, 2004
    Messages:
    104
    Likes Received:
    0
    Location:
    Florida
    I did that. It says "The specified file is not a registry script. You can only import registry files".
     
    Ken R., Jan 17, 2004
    #8
  9. Ken R.

    S Walch MAME 0.64 :) VIP Member

    Joined:
    Jun 2, 2003
    Messages:
    1,026
    Likes Received:
    14
    Location:
    Manchester
    ...you admin or limited user?

    Because it worked fine on mine.
     
    S Walch, Jan 17, 2004
    #9
  10. Ken R.

    Ken R. VIP Member

    Joined:
    Jan 10, 2004
    Messages:
    104
    Likes Received:
    0
    Location:
    Florida
    No. This is for Win 98SE, does that matter?
     
    Ken R., Jan 17, 2004
    #10
  11. Ken R.

    S Walch MAME 0.64 :) VIP Member

    Joined:
    Jun 2, 2003
    Messages:
    1,026
    Likes Received:
    14
    Location:
    Manchester
    Last edited: Jan 17, 2004
    S Walch, Jan 17, 2004
    #11
  12. Ken R.

    Ken R. VIP Member

    Joined:
    Jan 10, 2004
    Messages:
    104
    Likes Received:
    0
    Location:
    Florida
    Well, I can go into "tools" and make the homepage anything I want, but as soon as I exit IE and open it again, it goes back to "smartsearch.ws" as the home page. I did find a couple of other registry repair files, but so far, nothing has fixed the problem.
     
    Ken R., Jan 17, 2004
    #12
  13. Ken R.

    Ken R. VIP Member

    Joined:
    Jan 10, 2004
    Messages:
    104
    Likes Received:
    0
    Location:
    Florida
    I went into the registry, and deleted every instance of "smartsearch.ws" that I could find, per instructions in the Microsoft Knowledge Base. As soon as I rebooted the computer, they were all back. I didn't think this was possible!!!
     
    Ken R., Jan 17, 2004
    #13
  14. Ken R.

    James Photojournalist

    Joined:
    Dec 24, 2002
    Messages:
    6,662
    Likes Received:
    35
    Run HijackThis and post the log here.
     
    James, Jan 18, 2004
    #14
  15. Ken R.

    Ken R. VIP Member

    Joined:
    Jan 10, 2004
    Messages:
    104
    Likes Received:
    0
    Location:
    Florida
    Okay, I finally got rid of it (I think!)

    It took both CW shredder and Hijack this to get rid of this thing. I was deleting all instances of smartsearch.ws in the registry, but there was a hidden .exe file that put them right back again. Hijack this found all the registry entries, and cwshredder found and deleted the .exe file.

    To make things worse, programs like Ad Aware, Spybot search and destroy, and hijack this wouldn't run while this thing was on my system, I had to boot into safe mode to get them to work. I couldn't even visit the web sites of these programs!

    This program got onto my system in a virus (?)called "download.trojan". I hope this information will be helpful to anyone else who has the misfortune to experience this.
     
    Ken R., Jan 18, 2004
    #15
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.