Mines fucked up earlier. I turned on my home pc and the fucking browser was just going crazy! It was going through lots of error pages fast as fuck and wouldn't stop!
I had one a few weeks ago that Adaware and that Spybot thing would not get rid of. My home page was stuck on some really shitty search page. It was really pissing me off. I can't remember the domain that it was set to but anyway I did a search on google for removing what ever the domain was and found a download some dude made just to get rid of this specific problem and it worked like a champ. So maybe try doing a search like that.
If this is the script that also modifies your homepage to use global-finder.com all you can do is run your virus scan and manually remove all the values with the default page settings in your registry. I had this last week and had to modify every occurance of http: //%in my registry to get rid of it.
get a program called CWSHREDDER that should change the registry settings i think , if not just do a search on google for the registry keys needed to change the search page.
System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
Value Name: Search Bar
Data Type: REG_SZ (String Value)
Value Data: Search URL
System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
Value Name: Search Bar
Data Type: REG_SZ (String Value)
Value Data: Search URL
Yes i just checked its all in the same place still , and theres alot of other goodies in there to change as well , dont get to carried away unless you backup your registry first
Originally posted by Yo Adrian naw, that's setting your homepage..
this is my search page.. fx if I type in a url that doesn't exist..
what my pc has on it is bad though.. if I leave out the 'www.' it goes to this affiliate directory.. same if I leave off the 'http://'
You have one of the CWS trojans go download CWSHREDDER and get rid of it ..
BTW verisign has now taken all the unowned domains and forward them to their own search page . So when you type in www.thisdoesntexistverisignsucks.com it will display verisign's search engine
Investor with 5m - 15m USD to invest. Do you have a site or network of sites earning 50k - 200k a month income? Email your contact and preliminary data to: domain.cashventures (at) gmail.com....Please...no tire kickers...serious offers and inquiries only.
I wouldnt send out any emails for a while from what i read about what you have it looks like it attaches itself to your sig file in your emails even if you dont have a sig file. So make sure your clean before you send out any emails
Some one hacked your PC and modified your host file to point to their IP's to fix it go to c:\windows\system32\etc\host and delete all the IP's with web search domains after them.
Originally posted by SixNine Some one hacked your PC and modified your host file to point to their IP's to fix it go to c:\windows\system32\etc\host and delete all the IP's with web search domains after them.
You owe me a drink some day.
SixNine
Maybe if you were right but your ALL WRONG thats not whats happening here he posted the url its a TRICK url in his registry that is ACTUALLY going to ARHEO.com and that is going to gandi.net go look for yourself ... Go look at the url that he posted that he found in his registry , its a TRICK url put your mouse over it , it looks like msn search but look in the browser bar on the bottom , its ARHEO.COM !!!
Nobody hacked your pc , chances are its a simple js trick no worries just change the url in your registry like i said and get yourself clean..
Thanks for the info on the @ trick.. I notice that now
I went ahead and changed all instances of that to google, rebooted.. still getting redirectd to gandi.net
I searched the registry for arheo.com but it couldn't find it
It wont be under arheo.com it will be under
61%72%68%65%6f%2e%63%6f%6d < that basically means arheo.com.
or just search for msn maybe in your registry, OR you may have a hook that is rewriting your registry everytime , but usually when they do that you cant open your registry because they hide it on you.
Just make sure you change all the search things with @ symbols like that.
I looked around and couldnt find much more to help you so far , but ill keep looking and post anything i find in here ..
BTW its always good to look in your hosts file and make sure there isnt any redirecting going on at the same time , because sometimes you get hit with one thing you also get ht with something else..
Also do the obvious checks to make sure there isnt any Programs or processes that are running in the background
and do a free online scan at www.antivirus.com just to make sure . Dont askl me why but i have seen computers with FULL PAID NORTONS with FULL UPGRADED def files STILL miss lots of virii, not only that , but miss obvious old virii like pe spaces or klez
Originally posted by (¤¤)»»»»»»Þ I looked around and couldnt find much more to help you so far , but ill keep looking and post anything i find in here ..
BTW its always good to look in your hosts file and make sure there isnt any redirecting going on at the same time , because sometimes you get hit with one thing you also get ht with something else..
Also do the obvious checks to make sure there isnt any Programs or processes that are running in the background
and do a free online scan at www.antivirus.com just to make sure . Dont askl me why but i have seen computers with FULL PAID NORTONS with FULL UPGRADED def files STILL miss lots of virii, not only that , but miss obvious old virii like pe spaces or klez
IT WORKED!!!!
You're a genius bro, thanks!!
I searched for 61%72%68%65%6f%2e%63%6f%6d several times throughout my registry and changed every one to google except for one to www., which was my Default Prefix... it also had been altered to go to arheo..
Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.
I was hoping you were talking about the new "feature" on MSN.com that makes anything you type in the address bar, or in the Google toolbar jump to the assinine MSN "search the web" bar. Then it gives you some dumbass MSN search results page with pop-ups. You have to click 2-3 times in the box you want to use to keep your input from jumping. I emailed MSN and got an auto-reply thanking me for using MSN
Originally posted by AllisonWonderland I was hoping you were talking about the new "feature" on MSN.com that makes anything you type in the address bar, or in the Google toolbar jump to the assinine MSN "search the web" bar. Then it gives you some dumbass MSN search results page with pop-ups. You have to click 2-3 times in the box you want to use to keep your input from jumping. I emailed MSN and got an auto-reply thanking me for using MSN
That doesnt sound like msn to me that sounds like a TRICK msn maybe , you might have something in your HOSTS file, check windows | system32 | drivers | hosts file for anything strange ..
61%72%68%65%6f%2e%63%6f%6d < that basically means arheo.com.
or just search for msn maybe in your registry, OR you may have a hook that is rewriting your registry everytime , but usually when they do that you cant open your registry because they hide it on you.
Just make sure you change all the search things with @ symbols like that.
Ill look into finding a solution for you.
I hate when I'm cocky and wrong Maybe my post will help someone searching GFY some day since the scenario I described the fix for did happen to me.
I hate when I'm cocky and wrong Maybe my post will help someone searching GFY some day since the scenario I described the fix for did happen to me.
heh , yah dont worry the same thing you described has happened to me also ( the hosts file being changed ) and thats what i originally thought was the problem but then i noticed the trick url
Its a good thing he pasted the url from the registry or it would have been confusing figuring out the problem because he would have assumed his registry was fine and that it must be something else doing the switcheroo..
I battled the problem for almost 2 weeks: start up re-directed to global-finder or other search pages, and a pop-up on all pages with sextracker counter! AdAware and SpyBot removed it for a session, and then it was back - I finally found this little tool and everythings's clean: http://www.spywareinfo.com/~merijn/cwschronicles.html
(¤¤)»»»»»»Þ
That was a nice piece of work. Your a genius for sure and I hope you are making good money out of this game.This thread was more exciting than most of the spammers paysites thats for sure.
Comment