My IE Homepage keeps Changing

[TheJackal]

Ok, here's my problem, no matter what I have set my IE homepage to, it always changes back to either "luckysearch.net" or "fastsearch.net". In the tools:Blank" yet still links me to luckysearch.net

Here is a list of the things that I have done to try and stop this, yet none of them work:

1. Did multiple AdAware 6.0 scans. All of them removed some spyware from my machine, but nothing major, mostly bonzai buddy stuff.

2. I do a SpyBot advanced scan twice a day, evertime it removes at least 20 items from my machine, including three changes to the registry. Those changes are the only thing that constantly come back every day.

3. I had spybot lock the start page to PCMECH, however it still sends me to luckysearch.net, and shows up as About:Blank in the IE tools menu.

4. I have done Norton Antivirus scans, all of which turn up no viruses.

5. ZoneAlarm is running and is stopping thousands of access attempts daily.

6. As far as I know, NO file sharing software is running on my machine.

Anyone have any ideas on how to rid myself of the luckysearch.net?

[newme]

thats strange usually ad-aware takes care of that,did you update your ad- aware,my sister had the same thing ran her ad- aware it didnt find anything updated ad- aware and it fixed it.found hijackers

[TheJackal]

Thanks... Updated Ad-Aware, scanned again and it fixed it.

[SARGE]

Try this freebie; I've used it for the longest:

http://www.spywareinfo.com/downloads/spg/

[TheJackal]

Ok, somethings still not right, the update to Adaware helps, and it deletes the 16 registry values that cause the problem, however it keeps coming back.

I downloaded the program Sarge linked me to, installed it, and yet it still doesn't stop it.

Anyone got any other ideas?

[pam123]

You've been hijacked.
This is info you need : http://www.wilderssecurity.com/bhblaster.html
but, I've found it doesn't always solve the problem.
You may need to copy the files you want and reformat.
Next time keep the immunizations up to date.
But, first, try HijackBlaster.

[TheJackal]

The immunizations for what?

ZoneAlarm periodically gives me an update and Norton Antivirus just injects my computer with whatever updates it has, What else is there to update?

[TheJackal]

By the way, that download link doesn't work.

[pam123]

GaaHH!!!
Going for the correction nowl

[pam123]

Now for the second part.
Both Adaware and spybot have immunization downloads ( if you don't have the paid version of Adaware then use spybot, both work well ).
After that do the definition updates for both, I think spybot is the most recent.
You need to keep track of all updates, just get in the habit of clicking on "update".

[JimmyDee]

Its been a few months but I had something similar. Went to the cookie file and Internet temp file and deleted all the files in them. Took care of the problem. Doing the process of cleaning from the tool bar in IE left some the the bad files in and didn't work.
Try a complete cleaning and see if that works.
Jim

[TheJackal]

I will try both of your ideas and post back. Something interesting though is that I updated my AdAware, and deleted stuff, and all was good, for about three days. And then it came back. Could it be a website that I'm visiting?

[JimmyDee]

Originally posted by TheJackal I will try both of your ideas and post back. Something interesting though is that I updated my AdAware, and deleted stuff, and all was good, for about three days. And then it came back. Could it be a website that I'm visiting?

If it is, I'd sure let them know my feelings although anyone that would do that to a visitor, would probably care less.
Jim

[systempat]

Nasty things can be delivered to your PC thru ActiveX objects, especially using IE. That's how I got all the junk for "xupiter" and "xupiter.com". Very similar to what you're having. It finallly taught me the habit to keep the anti-virus software running and definitions up-to-date.
You can turn on an option in IE to be prompted if you want an ActiveX control to run but it is real obnoxious, because on a lot of commercial sites like Yahoo and CNN there's Activex on every page. (PC-MECH too, the animated ads).
Another option is to use another browser like Mozilla. It does not respond to the various commands the same as the M$oft products, and it also blocks pop-ups if you want it. It can be downloaded and used for free too.

[TheJackal]

Well, I updated, AdAware and Spybot, Norton automatically updates itself, and it hasn't worked. I will try deleting all of the temp files and cookies, and disabling ActiveX controls, and post back.

Id rather not switch browsers, as I rather like IE.

[[Mystic]]

Ok..

Run MSCONFIG. Check your start up for something running a .reg file. Check for anything unusal. Check c:\windows\downloaded programfiles\ and delete anything from there that is unusal.

[TheJackal]

Lots of registry stuff is loaded at startup, but nothing unusual.

I cleared the downloaded program files. It seems the only thing that fixes it is an Adaware scan. This removes the 16 registry entries that make it work.

However this seems to be only a temporary fix, as it always just comes right back.

[pam123]

I have reservations about this program but your problem warrants giving it a try : http://www.wilderssecurity.com/bhblaster.html

[TheJackal]

pam123, I still cant get the download link on that page to work.

[pam123]

I'm using the usual IE6 on both home comps and having no trouble.

Calling all posters, is this just me or is there some glitch from Canada? [ It's certainly possible so we'll track this down ]


edit : okay, I posted the query on their forum and I'm awating the reply.

[LowWaterMark]

pam123, thanks for the notice regarding this problem.

The problem is not that the link to the main description page is not working, it appears to be. It's the actual "download link" for the BHBlaster install kit that is bad. BHBlaster is not available at this time because of a migration we are performing on one of our download servers.

Also, it has actually been superceded by another Javacool application (SpywareGuard) in any case, which contains the same functionality.

http://www.wilderssecurity.net/spywareguard.html

Sorry for the inconvenience. Let us know if there are any other questions.

[pam123]

Thanks for the reply!
We'll wait till everything is back to normal and thanks for the alternate link.

[TheJackal]

Thanks pam123 & LowWaterMark, I will definately download and try it out.

[[Mystic]]

Its always caused by spyware... Spybot will removed pretty much everything, spyware > adaware, all other programs usally use the spybot database.

[TheJackal]

Spybot has failed to remove it everytime that I have scanned. AdAware removes it temporarily, but is the best of the lot.

We will see how this new program works, and I will post back.

[Redo40]

Download and run CWShredder, the latest version should take care of it...

[TheJackal]

Spyware Guard does the trick, it switches everything back at startup, though I might download that CWShredder, just to check out what its capable of.

[pam123]

I'd try both just for the hell of it but I'm glad to hear you're no longer being hijacked.
Spywareguard does a good job.
Way to go and merry Xmas !