KVR Audio

P.T. · Post by **P.T.** » Wed Sep 01, 2004 10:56 am

I seem to have picked up a virus/browser-highjacker.

Internet explorer is now set for makemesearch.com as it's homepage and if I reset it to my preffered homepage it just resets to makemesearch the next time I open IE.

It also has added a channel search bar that keeps returning if I remove it.

The channel search bar also shows on windows explorer and can not be removed.

I have found that entries have been made in 2 files. The entries are for makemesearch and the channel bar and a different default browser homepage, so if I enter default I get this other page.

These entries are in the user.dat file and the system.dat file, both of which are in the Windows folder on c drive.

I have tried deleting these files, but they keep mysteriously re-apearing. (they only seem to re-apear automatically in the user.dat file)
Then if I shut down the computer and try to start it again I get a registry error and tne computer loads a backup copy of the registry.

How can I get rid of this thing?

Has anyone had this problem?

These companies that screw with peoples computers shound roast in hell.

Thankfully this doesn't interfere with the actual operation of serious functions on the computer.

whyterabbyt · Post by **whyterabbyt** » Wed Sep 01, 2004 11:17 am

SpyBot Search and Destroy

P.T. · Post by **P.T.** » Wed Sep 01, 2004 11:21 am

I ran spybot and it found nothing.

whyterabbyt · Post by **whyterabbyt** » Wed Sep 01, 2004 11:23 am

Have you updated SpyBot?

uncadave · Post by **uncadave** » Wed Sep 01, 2004 11:26 am

my usual disclaimer that i'm not a 'real' geek...but i've had the similar problem. you need to go to your virus software's website and enter the name of your bug and get very detailed removal instructions. spybot first, tho, because that's easy to try and free, and adware also....you should have those two anyways and run them regularly. your removal instructions are going to include trips into your registry probably and also sweeping with your system restore shut off. i managed personnally to get my computer cleaned up by reformatting and reinstalling everything. pain in the ass. maybe somebody else will have more optimistic advice.

i've since been using mozzilla firefox for my browser, no activex controls, but then some site's content aren't available. but no bugs.

P.T. · Post by **P.T.** » Wed Sep 01, 2004 11:26 am

Not for a few weeks.

I'll do that next.

But, it won't remove entries from those files will it?

uncadave · Post by **uncadave** » Wed Sep 01, 2004 11:28 am

oh, you could also try hijack this..i forget where it's at....google....they have guys that will look at your report after you scan with their online scanner and then detail you what to do specifically, and i think it's all free.

spaceman · Post by **spaceman** » Wed Sep 01, 2004 11:29 am

it's a tough one because those buggers nest themselfs in memory. If you can, search for makemeserach in the registry and delete all keys you find. Try to find out where the files are it uses, go into DOS mode and delete them.

This might not be enough though.. it's possible it has patched IE itself, in that case you also need to reistall IE (roll back to previous version or update to new one if possible) or if you've got XP install SP2

plastique · Post by **plastique** » Wed Sep 01, 2004 11:31 am

HijackThis

blixa · Post by **blixa** » Wed Sep 01, 2004 11:40 am

hijackthis is the best for the type of malware you've encountered in this case.

anyway, here's some free help with analyzing the log file that hijackthis creates:

http://www.hijackthis.de/index.php?langselect=english

disclaimer: i haven't used the above automated service yet, but it might be useful.

donkey tugger · Post by **donkey tugger** » Wed Sep 01, 2004 12:06 pm

One of my friends had a similar thing happen on their PC some coolwebsearch toolbar kept popping up, I found that

http://www.webroot.com/wb/products/spysweeper/index.php

Got rid of the f**ker.

P.T. · Post by **P.T.** » Wed Sep 01, 2004 8:58 pm

Thanks guys. I'll start checking these things out.

Would a firewall or something like Zone Alarm protect me against things like this?

cptgone · Post by **cptgone** » Wed Sep 01, 2004 9:15 pm

plastique wrote:HijackThis

great link, thanks!

moody · Post by **moody** » Wed Sep 01, 2004 9:39 pm

try these....
http://www.javacoolsoftware.com/products.html
loadfs of usefull programs

http://lavasoft.element5.com/software/adaware/
ive found there forum very helpfull..plus adaware is a good bit o kit....

aMUSEd · Post by **aMUSEd** » Wed Sep 01, 2004 9:51 pm

There is a tool called CWshredder dedicated to removing the coolwebsearch virus and its variants:

http://www.softpedia.com/public/cat/10/ ... -150.shtml

Virus/Browser highjacker. Help needed removing.