|
|
 |
|
|
Pages: 1
IE 6 redirects to ssearch.biz
(Click here to view the original thread with full colors/images)
Posted by: jungles_mcbeef
G'day,
Been a while since I've come here, but here's a question for the internet junkies. Has anyone heard of ssearch.biz? A trojan (which may have been in connection with CoolWebSearch) has allowed the home page of IE to be redirected everytime it is opened to ssearch.biz, even though the home page is set to google. I have run antivirus, adaware, and malware removal tools and done all critical and service pack updates for (Win 2k Pro), it took quite a while to fix it was only updated to sp2 until i did the upgrades yesterday so security was practically non existent. There are no trojans or viruses remaining on the computer, I did a trendmicro housecall to be extra sure. But now I am left with that one remaining problem, the redirection of the home page of IE6. If anyone has any info/experience with this, I would appreciate some guidance.
Thanks.
Posted by: DemonBob
Run these scans, then do a online search!!
-- Trojan Scan --
CFI Trojan Scan
-- Spyware Links --
Ad-Aware
Spybot S&D
Clean everything off that was indicated.
Run this.
http://www.spychecker.com/program/hijackthis.html
Save, copy and post the log here.
Posted by: jungles_mcbeef
Ok, I will try those sites, thanks, but maybe you didn't read my post correctly. I have cleaned out any viruses and malware/spyware that was installed or residing on the comp, usually a TrendMicro Housecall is reliable (it is the only AV I know that completely cleans your comp, I have tried quite a few including AVG and Norton), as for Malware/Spyware I have already run Adaware (automatic detector/remover) and Bazooka Spyware Scanner (automatic detection, manual removal) . So, what I need to know is every possible way to change the redirection of your IE browser home page on opening it. I don't want anymore Antivirus or Malware/Spyware detection and removal programs.....they aren't reliable enough. In the mean time, I will use the sites you have listed for me in case there is something the other programs have missed. Oh yeah, by the way DemonBob, the Crow is the best film of the 90s in my books, atmospheric brilliancy. 
Posted by: VGE-Jeff
Jungles, I recently ran into the same problem with a computer i was working on. I have yet to find a solution to the problem, but i've bookmarked this thread, and if I can figure it out, i'll definately post it here for ya. This one is a real SOB.
Posted by: VGE-Jeff
Okedoke, searching through google, I found a possible solution, and created a webpage for it. You may try giving this a shot.
SSearch Removal
Just a little heads up, I'm not trying to insult anyone's intelligence with the step-by-step with pictures, but the person I wrote this for knows nothing about computers, and needs this kind of help.
Jeff Young
VGE
Posted by: padhu075
now the new pain is adware , spyware apart from virusus,trojans and BSOD .
i even found this problem, it was unusual problem i have taken a temporary measure blocking the website from my proxy server. the pages keeps loading until u kill explorer.exe from task manager but the problem will repear once u have restarted the system. i also found on restart i creates a file called qcache.exe, if you delete it it will recreate the file and open up junks i have overcome this by creating a non executable qcache.exe.
i'm trying to fix this problem any helpwould be gretly appreciated.
 Quote:
|
Originally Posted by VGE-Jeff
Okedoke, searching through google, I found a possible solution, and created a webpage for it. You may try giving this a shot.
SSearch Removal
Just a little heads up, I'm not trying to insult anyone's intelligence with the step-by-step with pictures, but the person I wrote this for knows nothing about computers, and needs this kind of help.
Jeff Young
VGE |
Posted by: ZLRAC
Question. Before it goes to search.biz or what ever it ends up on; does it first go to or end up on an address of 'about:blank?' This is just an initial question, in my next post I will have the time to type out your probable solution. (Just solved a very similar problem for a buddy of mine)
Posted by: C-Money
Disable system restore.
Post your Hijack This! log file so we can determine any further problems.
Posted by: ZLRAC
Me personally this is what I would do... Make sure you have the latest version of Spybot 1.3 w/ TeaTimer (TeaTimer will come with Spybot and protects against registry and start page changes) Go to Interent Explorer/Tools/Internet Options/General. Change the homepage to whatever you want then click 'ok.' Now go to Start/Run/regedit then click on My Computer. Now do 'Control-F' to do a search for instances of search.biz. If you come across an entry for it right-click on it then choose modify, then put in the website for your choice of a homepage. (It's not recommended but you could probably get away with just right-click then deleting the entry. Registry changes should always be preceded by first doing a back-up of your registry) Now keep pressing the F3 key and you'll discover other instances of seach.biz. Repeat the above steps with these too. Now close and reopen internet explorer. Now reboot. Click on Interenet Explorer. If you tracking with me and following the above steps in order, at some point either Spybot or Teatimer will pop-up and warn you about either registry changes or homepage changes. Allow the registry changes, deny the homepage changes. That should do it. You didn't answer the question in my earlier post. If it would have been yes, then follow my instructions above except use about:blank instead of search.biz.
Some other considerations... I have heard that CWS Shredder can be helpful with Homepage/Hijack issues. Get it here...
http://www.download.com/CWShredder/...4-10301586.html
Also, I highly recommend Spyware Blaster. It protects you from spy/malware by blocking them from ever getting on your computer in the first place. It even has a system snapshot feature that recovers previous browser settings. Get it here...
http://www.javacoolsoftware.com/spywareblaster.html
Quote:
|
Originally Posted by my post form another thread
Go to Start/Settings/Control Panel/Add-Remove Programs. Then go like your going to remove Internet Explorer. It will ask you if you want to revert back to the previous version. Choose yes. Go to the Microsoft updates page. Download critical and suggested updates.
|
Lastly this is advice I got from another forum. Me personally I would only use it as a last resort... 'Fire up Task Manager (press CTRL+ALT+DEL), "Processes" tab, and END qcache.exe
Next, locate and delete the file :
C:\Documents and Settings\Dad\qcache.exe <<< this one
See the entire thread at...
http://www.newbie.org/help/messages/36105.html
...it also has "Hijack-this" suggestions
http://ymail.flamingtext.com/ymail/...97986_32558.gif
Posted by: jungles_mcbeef
Hey guys, sorry i've been quiet on this thread, but I ended up becoming overwhelmed by frustration from the infected machine not cleaning so I just did the old format and start again. It hadn't The most helpful thing on here was definitely posted by Jeff, thanks Jeff, and Carl im sure if I had've still had the problem you probably had the best information for me to try and manually clean my comp, which I'm spewing I didn't get to utilise. Thanks all for your help
Posted by: grendle
Must say I've had the "SSEARCH.BIZ" and still dealing with QCACHE.EXE. Talked to different people and different forums finally I started downloading the "shareware" that I could find and went through the registry and c:. It worked to get rid of ssearch.biz but I don't know if I lost anything else in the process (You'll have to forgive me, I'm not exactly a technician, so use at your own risk) I used the following to locate all the different files and keys since not one of the programs found everything: Norton Anti-virus, Ad-aware 6.0, and spyhunter which I found at www.download.com. They worked for me, try it and good luck.
|
|
|
|
|
