[RustyM]

Hi, at my friends pc, everytime she connects to the net by dial up, & she
launches IE manually, instead of the yahoo home page coming up, the can not
find server page comes up. The address in the address bar is NOT yahoo.com
but rather a serious of numbers after the HTTP;// thing. the numbers
resemble an IP address because it looks something like this. http;//
68.298.43589. (not exact numbers)
Anyways, I have to try several different web addresses just to get a
familiar web site just so that I can start surfing. Funny,, cause I check
under internet tools and yahoo is listed as the home page but does not come
up on its own. I suspect a browswer hacking. the programs she has are:
Hijack this, ad-aware latest version, cw shredder, spybot S& D, zonealarm,
spyware blaster. I see her 2 a month and do the scans for her. I always get
clickspring in ad-aware. Ive done in safe mode too. I go back, and its there
again.
DOnt know if both clickspring & the browser hijacking are related, but any
info would help.
windows XP on a 2 year old pc- sp1 with all those updates recently updated.


--
Thanks so very much for your help-! ! ! !

[Malke]

RustyM wrote:

> Hi, at my friends pc, everytime she connects to the net by dial up, &
> she launches IE manually, instead of the yahoo home page coming up,
> the can not find server page comes up. The address in the address bar
> is NOT yahoo.com
> but rather a serious of numbers after the HTTP;// thing. the numbers
> resemble an IP address because it looks something like this. http;//
> 68.298.43589. (not exact numbers)
> Anyways, I have to try several different web addresses just to get a
> familiar web site just so that I can start surfing. Funny,, cause I
> check under internet tools and yahoo is listed as the home page but
> does not come up on its own. I suspect a browswer hacking. the
> programs she has are: Hijack this, ad-aware latest version, cw
> shredder, spybot S& D, zonealarm, spyware blaster. I see her 2 a month
> and do the scans for her. I always get clickspring in ad-aware. Ive
> done in safe mode too. I go back, and its there again.
> DOnt know if both clickspring & the browser hijacking are related, but
> any info would help.
> windows XP on a 2 year old pc- sp1 with all those updates recently
> updated.
>
>
Your friend's computer is definitely hijacked and full of malware. You
aren't getting it clean. Clickspring is malware. You have the tools you
need, but all scans must be done in Safe Mode. Make sure your friend
also has a current version antivirus (not earlier than 2004) with
updated virus definitions.

Probably you should run HijackThis and post your log in one of the
forums below (not here, please):

http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42 -
another tutorial
http://aumha.net - forums
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/
http://www.spywareinfo.com/forums/

I particularly recommend the AumHa forum, but all of the above are good.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User