My computer has been hijacked!

[Durbob]

Junkman, your talking about removing a virus in the sound system of your computer. I've done that plenty of times where you had to turn off system restore to remove it. I know what is going on here. There is part of this worm that has disguised itself in a file on my computer and i'm not getting all of it removed. I'll figure it out sooner or later....i think.

 

[Glenn9643]

Do you have an "emergency disk" from an antivirus program available? Most AV programs that I have seen out of the box have a provision for you to prepare a bootable diskette with basic AV programs on it that allow you to remove a virus that may be residing in the computer's memory and reestablishing itself after normal AV scanning. Basically, you shut down your machine and reboot from the "A Drive" and the windows system isn't active. Then you can scan your "C Drive" for the bugs. Good luck.

 

[Durbob]

Well, i just spent $40.00 on the highest recommended software i could find for removing this virus/trojan whatever it is. And guess what , it still comes back after this program deletes it. I tried removing it in safe mode and also with the system restore turned off to no avail. I guess $40.00 buys me some support as i sent them the saved logs of what's going on. They tell me this is one of the most viscious and infecting files there is because it keeps changing itself. Hopefully none of you ever get this and when i get rid of it the IE won't be used by me anymore. I just want to make sure my registry is clean first which is what it keeps changing.

 

[mathey]

hmm...ok, here's some random thoughts...

</font><font color="blue" class="small">( The cw shredder and ad aware and all the others pick it up )</font> ...OK, what do they find? must have a name?

have you checked for the Peper trojan? My home system had it a month or so back and it was a real pain to get rid of...neither Ad-Aware or Spybot (at least at that time) could get rid of it...

here's a link that describes what to look for and where to see if it's resident PEPER LINK

here's another link that may be of help PEPER LINK 2

one other thing...this may be obvious...but after you've installed these programs (Ad-aware, Spybot, etc....) you've gone and gotten all the latest updates, correct?

 

[Durbob]

I have all the latest releases of the spyware programs downloaded. This this is called CWS which you can google coolwebsearch"hijacked" and see what i'm up against. It changes your registry and hides and even changes itself from what i'm told. I have Firefox, Opera, and Netscape browsers that aren't infected by it. So, i'll probably get rid of internet explorer when i finally get all this straightened out.

 

[Richard]

I just had a similar problem.

Go look in C/documents and settings/all users/start menu/programs/startup

I had a win??? file in there that didnt USE to be in there.

I tried to delete it to no availe. So, I had to go into safe mode ("F8" on startup) and then go into there to delete it.

Once I did that, I had my homepage back.

I've deleted the actual file, so I do not recall it's exact name.

I THINK it was something like winlogon but again, I do not recall. I was happy to get rid of it because I knew I keep NOTHING in my startup file.

Hope it helps

 

[JayC]

Could it have been winproc32? That was one of the nasty little buggers that got installed on my computer when I got hijacked. The other one was svchost. Being I use Windows ME, svchost isn't even on the system! I have seen it on WinXP, though, not sure what it does.

 

[Richard]

Winproc32, I THINK that rings a bell. If you go to Start/programs/startup you might see it in there and it will NOT be deletable. I had to go into safe mode and dig it out of the above (way above) file location & delete it. ONce deleted, all was (seemingly) back to normal.

Maybe we can have a tractor pulling contest with ANY sized tractor... and like Hercules, tie the people that make these obnoxious files in the middle of the tractors as the green flag drops... /forums/images/graemlins/crazy.gif

 

[Durbob]

Well, i'm cautiously saying this ( VERY Cautiously). But, i think i might have gotten it out. What a learning experience this has been. I took 3 or 4 spyware programs and got into the registry myself. Looking for things that didn't look right and what the spyware programs said to look for. I went into safe mode and deleted what i needed to and all that and so far my homepage is still back. I have just made a new restore point for future reference also. It seems like no one spyware program had the answer, but getting info from them all and then running them all seems to have done the trick.
I guess this computer may not wind up a boat anchor after all. /forums/images/graemlins/smile.gif Thanks for all your suggestions. It seems i needed them all to figure this out.

Durbob

 

[RSKY]

I had a similar problem and finally went to the add/remove program page in control panel. Found a program there named WinSearch. Removed that one and solved the problem. Took me more than a week to luck up on it though.