Lois & Clark Forums Forums General Discussion Off Topic Spyware

I have this really annoying glitch on my computer lately (as in the last couple of months), and it had just occured to me that it could be a result of spyware.

Everytime I start my computer, my IE home page resets itself to a search engine (www.nkvd.us or smart-finder.biz - which are the same one), no matter what it was before I turned it off. Also everytime I type in an address without the http:// part, instead of adding it on automatically like it should and did before, it just goes back to that search engine.

Any suggestions? This thing is really annoying and frustrating.

Julie

This helped me. I think the website is www.spybot.com. It got rid of 193 spy ware programs I had on my computer. If this doesn't work.......anyone else have any suggestion? This sort of stuff sucks.

This is a techie problem. Maybe you'll get more of a response in the other folder. Who knows. Hmm...k maybe it won't. I'll be quiet now.

Even if it doesn't solve this particular problem, Julie, I'd second Roo's recommendation for Spybot. I use it to sweep my pc after every visit to the net. It's simple to use and gets rid of most spyware junk you pick up while surfing.

LabRat

Julie, do a Google search for Ad-Aware and download it. It's free, and it's great for finding and deleting spyware. Once you've installed it and run it once, you just need to remember to run it every once in a while to keep yourself protected against spyware.


Wendy

I also use Ad-aware and highly recommend it. The latest version of Norton Anti-Virus does have some spyware protection, but it's minimal.

Thanks, everyone!

I'll install one of those programs, now that I know my PC is not immune to them. Though I probably don't have to worry about this particular problem anymore because my dad just bought me a new hard disk (80 GB!!!!!) but I'm sure there will be others...

Julie

Actually, I'd recommend using both Ad-aware and Spybot. Usually either one is sufficient, but every so often something slips past one and is nabbed by the other. If you are going to go with just one, I would choose Spybot. Its interface is a bit easier, IMO. And be sure to use the Immunize function after you Search & Destroy!

I agree with Rivka. Sometimes spybot picks up things that adaware doesn't. My problem is that spybot always crashes and I can't even open it. It's really weird!

- Laura

the same thing happened to me with ad-aware. crashed every time i tried to scan. went to their tech support site, and it looked like a bunch of other people had had the same problem. no one knew why or how to fix it. someone did mention that if you have 2 spyware blockers on the same comp, they can cause conflicts with each other (happens with virus scanners, too). so that might be it in your case. or you might just have some setup or something that spybot is allergic to.

i guess the best thing to do is to just find one that works for you and stick with it. <shrug>

Paul

Interesting. I use Ad-Aware on my home PC and find it incredibly easy to use, both in terms of kicking off a scan and then dealing with the results. It was also very easy to set up. I just downloaded Spybot S&D on my work PC - found it complicated to set up, and the scan and results were much more time-consuming. Personally, I prefer Ad-Aware, though I'll keep SpyBot for the time being and see whether it grows on me.

But whichever program you prefer, I really do recommend that you do use spyware-checking tools regularly. I scanned my home computer twice recently, the occasions being a week apart: in that time, three more pieces of spyware had installed themselves on my PC.


Wendy

I had exactly the opposite experience. Downloaded Ad Aware, just used it for the first time, found it absolutely infuriating and frustrating <G> and promptly uninstalled it. It conflicted with Spybot and tried to remove important component files from that program, so I couldn't run both.

I guess horses for courses really. Use whatever you feel comfortable with and which suits you. As Wendy says, the important point is to at least have something working for you.

LabRat

Just saying - seeing as how even though I got a new disk, I still have to live with this one for a week, I ran Ad Aware. It found 642 spyware programs!



Julie

Arugh!

Arugh is right.

It didn't really solve my problem though, even after I deleted about 50 homepage hijacking programs.

Julie

Julie -

We have the exact same problem on our "upstairs" computer - same hyjacked page and everything. Sadly, we haven't yet figured out how to fix it, but the good thing is that it isn't our primary computer so it is easy to ignore. In fact, we are thinking to find a really cheap, refurbished computer to swap out that one since all we use it for is cruising the internet and word processing. Not that that is the way to get rid of this troublesome problem.

I think the makers of that site and whomever set up the hyjacking software should be shot in about 58 places. They are dispicable people.

If you figure it out, let me know and I'll do the same.

Lynn

Make sure you update the ad definitions for Ad-Aware (there's a nice little button on the main screen to do that), and then run the program again. When it finds the adware, remove EVERYTHING. There's nothing there that is needed by Windows. You can choose quarantine so it isn't exactly removed, just packaged up somewhere so it won't harm anything.

I use Ad Aware and it's pretty good, but I also have a little 2KB DOS program called Privacy Protector that I got from the same site as Ad Aware. It's a marvellous little program that cleans off just about everything in the way of spyware. It's no longer available on the site where I got it, but if anyone wants it, I can send them the installation program (which I fortuitously saved). It only takes a few minutes to work, and it's very thorough. Its only drawbacks are that it only works on the C drive, and will not run on Windows XP because they've eliminated whatever DOS file it is that the program needs to run.

Nan

I administer 40 computers at work and have seen similar to this a few times.


This is what I have found about your spyware:

Variant 29: CWS.Smartfinder
Approx date first sighted: January 11, 2004
Log reference: http://forums.spywareinfo.com/index.php?showtopic=27673&hl=nkvd\.us
Symptoms: IE hijacked to nkvd.us and smart-finder.biz, redirections to nkvd.us and smart-finder.biz when typing incomplete URLs into address bar.
Cleverness: 10/10
Manual removal difficulty: Involves some registry editing, and renaming the trojan file, restarting, and deleting it
Identifying lines in HijackThis log:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.nkvd.us/s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nkvd.us/s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nkvd.us/s.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nkvd.us/1507/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nkvd.us/s.htm
O13 - DefaultPrefix: http://www.nkvd.us/1507/
O13 - WWW Prefix: http://www.nkvd.us/1507/
O13 - Home Prefix: http://www.nkvd.us/1507/
O13 - Mosaic Prefix: http://www.nkvd.us/1507/

Additional line in StartupList log:

Enumerating ShellServiceObjectDelayLoad items:

DDE Control Module: C:\WINDOWS\SYSTEM\mtwirl32.dll


This variant was surprisingly smart: it used two startup methods (ShellServiceObjectDelayLoad and SharedTaskScheduler) that have to be the absolutely rarely used ones seen ever - and it used them differently on Windows 9x/ME and Windows NT/2k/XP. On top of that, both methods ensure that the file is loaded when Explorer is loaded, making it always in memory like CWS.Msconfd. Additionally, the actual responsible files are invisible in HijackThis, and only one shows in a StartupList logfile (ShellServiceObjectDelayLoad). The responsible file is mtwirl32.dll, and to delete it manually you need to rename it (deleting is impossible since it is in use), restart the system, and then delete the file and its Registry key.

Looks like a difficult remove if done manually.

There is a removal tool called CWShredder which will probably work if you can find it (but the site has been hijacked). The site is experiencing lots of trouble because the makers of the spyware are trying to close the removal tool site down and block the site if you are infected. There is also a program called Hijack This which may work. I used both tools on a few previous versions of this spyware.

AmyN

Amy, that's really useful! Just did a Google search and found this alternative site for downloading the removal tool:

http://www.majorgeeks.com/download4113.html

For anyone whose spyware won't let them load the site, here's a direct link to the tool:

http://www.majorgeeks.com/downloadg...amp;evp=eec9dd0faeb35f8e3a31cf62d8910a77


Hope this gets rid of it for you, Julie!


Wendy