Got Juicy Brain?

Meat Juice · Posted: Tue Nov 11, 2003 5:19 am Post subject: Got Juicy Brain?

I picked up a bug while web browsing. When I click the Search button on Internet Explorer 6, the default search engine (MS) has been replaced by:

http://www.payfortraffic.net/search.htm

This is a malicious site which has made it challenging for me to remove. Attempts to reasign a search engine using the Customize button only makes the same website appear. I've tried blocking the website, ran updated anti virus definitions, ran Lavasoft AdAware with maximum detection settings, deleted my Temp files, history, disc cache and cookies. Finally I changed the default registry setting to:

http://home.microsoft.com/access/autosearch.asp?p=%s

Do you have an fresh ideas for a fix that might solve this problem? It's 4:30AM PST and I'm burned out and fresh out of ideas. Your time and effort would be appreciated.

MJ

Bright Red Nipples · Posted: Tue Nov 11, 2003 6:42 am Post subject:

Open up internet explorer. In the top left corner click tools. Choose internet options. Then choose the tab "programs". Towards the bottom you will see a tab "Reser Web Settings". Clink that and see what happens

.

That should change everything back to default including your homepage. Make sure you delete all your cookies again just in case. Beter yet just clear everyting, history, cookies, temp files.... This should start you from scratch.
_________________

God Bless You Blue Ruler

Potato-VS- · Posted: Tue Nov 11, 2003 6:49 am Post subject:

Yea what BRN said should do that. This happened to potato before too MJ - except it was more of an adult website and potato's mom saw it and blamed potato - potato being the only guy in the house

. Hope you get it fixed MJ!

<TVB>Potato

Kjeldorian Royal Guard 42 · Posted: Tue Nov 11, 2003 9:41 am Post subject:

Odd.

I now have the same problem. I swear I got this from my Steam d-load. I never saw this until right after I installed Steam.

I tried setting my default homepage back to TheVille and it keeps changing back to some bizarre search engine. On top of that, every time I boot up, it mysteriously adds 2 or 3 pRon sites to my favorites.

I ran Adaware and it still didn't locate the source of the problem. Found aboot 30 data miners but I still get the boot up page and pRon links.

The only pRon I look at is the occasional "rubbing" between JCOM and Nanite in the admin forum.

I'll try your solution BRN. Hopefully that clears it up.
_________________
Recipient of POTM award
Creator of Warz/Ville Golf Classic
<TVB> Member/Event Coordinator/Council - Retired
=US-V= Member/Event Coordinator - Retired
<eVa> Founding Father/Leadership/Webmaster - Retired
Ville Admin - Retired

shovelnose · Posted: Tue Nov 11, 2003 9:54 am Post subject:

John Doe · Posted: Tue Nov 11, 2003 9:57 am Post subject:

Download Spybot or Adaware 6 (or both) and run them on your PC to find all the spyware and other carp that needs to be deleted.

JD
_________________

Stevo · Posted: Tue Nov 11, 2003 10:47 am Post subject:

Bright Red Nipples · Posted: Tue Nov 11, 2003 11:14 am Post subject:

sgt stutter · Posted: Tue Nov 11, 2003 11:57 am Post subject:

Meat, hope this helps:

If your getting a lot of redirects this may help-->http://www.spychecker.com/program/cwshredder.html

Here is some info on how to get rid of some redirects-->http://www.spywareinfo.com/~merijn/cwschronicles.html

Maybe you can find some info in there fourms-->www.spywareinfo.com
_________________

click--><eVa>SuperGreg

R.I.P Trigger Happy

Kjeldorian Royal Guard 42 · Posted: Tue Nov 11, 2003 12:39 pm Post subject:

I run Adaware6 and it found nothing related to the issue.

Spybot I don't have but I'll probably d-load it for the extra protection.
_________________
Recipient of POTM award
Creator of Warz/Ville Golf Classic
<TVB> Member/Event Coordinator/Council - Retired
=US-V= Member/Event Coordinator - Retired
<eVa> Founding Father/Leadership/Webmaster - Retired
Ville Admin - Retired

Simpleman · Posted: Tue Nov 11, 2003 1:00 pm Post subject:

I would check in your startup it might of put something in your registry I had that be for.

Meat Juice · Posted: Tue Nov 11, 2003 1:41 pm Post subject:

Thank you all for your time in replying. At one point or another each was a step I had tried although no one mentioned swearing at it. As it turns out the links and articles that Sgt provided proved to be bang on. The links provide an explanation as well as several fixes depending on how much time you have. The quick fix seems to be this simple utility:

http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Here's what the guy who wrote the utility had to say about it:

After reading all of this, you must be under the impression that a CoolWebSearch hijack is near impossible to fix since there are so many variants. Though it is true that the conventional tools like Ad-Aware, Spybot S&D and HijackThis won't fix all of the variants, there is one tool that will.

After about the 3rd CWS variant, I realized this particular spyware company moved faster than any other I'd seen before, and that the anti-spyware programs wouldn't be able to keep up with it. So I decided to write a separate program dedicated to removing CoolWebSearch.

There are also several perma fixes for variations that I've bookmarked for a later date as they will take several minutes to accomplish. May I say that it absolutley kicks ass that I can post on our friendly neighbourhood forum and in turn receive such a happy conclusion to such a pain in the ass bug. Again, thank you.

MJ

[HALO]cpt._Keyes · Posted: Tue Nov 11, 2003 2:44 pm Post subject:

Potato-VS- · Posted: Tue Nov 11, 2003 3:37 pm Post subject:

Kjeldorian Royal Guard 42 · Posted: Tue Nov 11, 2003 4:08 pm Post subject:

I have Kazaa on Windows XP but I don't have this issue on XP. My hard drive is partitioned and I'm getting it on '98.

I'll run through some of the links provided above and hopefully have as much luck as the Juiceman did.
_________________
Recipient of POTM award
Creator of Warz/Ville Golf Classic
<TVB> Member/Event Coordinator/Council - Retired
=US-V= Member/Event Coordinator - Retired
<eVa> Founding Father/Leadership/Webmaster - Retired
Ville Admin - Retired