Allaboutsearching

Dunsby

<a href='http://allaboutsearching.com/passthrough/index.html' target='_blank'>http://allaboutsearching.com/passthrough/index.html</a>


I keep getting this set as my homepage or

<a href='http://allaboutsearching.com/passthrough/index.html/passthrough;http://google.com' target='_blank'>http://allaboutsearching.com/passthrough/i...tp://google.com</a>


Ive run my adware scanner, ive deleted my cookies etc... But now a icon on desktop keeps popping up, and inside it says:

< H „ o ó ó
% = b | è? ]X¢@ ]X¢@ `ê €î6 \& ERPR ð?UUUUUU¥?s and S[AA[W}]UfO[?V'FQx:V}I k ! V]fU]?n:W!U[:V}I ky J FIH?}BOBO?~m'O?O:VfWA:QOU ! J fU[?fE~[Qn']UV'I}BFO:m[?QO?W?}f:V}I 9k y mmm:W!U[:V}:]E JG y mmm:V[IH[FxQ^H[FQUW[AA:V}I y`y y mmm:aA[f'HA[~O?:V}I yG y mmm:x}}xAO:V}I yG J mmm:EOQW?[f'O[?:V}I y y mmm:Q[U]?[A^fOAOVUF}Q:}?x 9G y mmm:QOUm}?E`k:V}I JGJ J mmm:f]WfO?BF[QUV'FVEOQ:V}I 9J9 y mmm:YO?}Q:}?x 9yJ k mmmJ:W!U[:V}I h y $1$$3dw4zxjXbEBU8TVff/rqV1]X¢@ ]X¢@ 'UUH"88[nf:f}aUm[?O}]UaFU:V}I8nVyNG:H'H.EO~m}?n;BUnA /cl y G {
CAMPAIGN "WAV" {
URLS {
"http://ads.softwareoutfit.com/dc180.php?keyword=vtdl"
}
RULES {
(OR (ANTI "*"))
}
}

}



Even after i delete it it comes back.

Wth?

RuBy

are you using internet explorer?

NScombat

Sounds like you have gotten hijacked. Have you tried running spybot?

Dunsby

Linkage?

GWAR

Spyware/Adware/Bundleware. my aunt was infested with the exact same "allaboutsearching" thing. It has a registry entry, a running process in the backround and a malicious browser extension.

I removed it via remote desktop for her, I dont think any current adware scanners detect it.

Take a look for strange processes running, google them to find what they are then remove if they are harmful.

After that go to <a href='http://www.computercops.biz/' target='_blank'>http://www.computercops.biz/</a> grab HiJackThis and post your log for a experienced person to look at.

Thansal

well, the traditional response is:

<a href='http://www.lavasoftusa.com/software/adaware/' target='_blank'>http://www.lavasoftusa.com/software/adaware/</a> (removes alot of spyware)

<a href='http://www.safer-networking.org/index.php?page=download' target='_blank'>http://www.safer-networking.org/index.php?page=download</a> (removes/protects against some more spyware)

<a href='http://www.grisoft.com/us/us_dwnl_free.php' target='_blank'>http://www.grisoft.com/us/us_dwnl_free.php</a> (virus scanner)


Oh, and STOP DOWNLOADING PORN! (this goes for your GWAR's autn also!)

Dunsby

<!--QuoteBegin-Thansal+May 12 2004, 06:11 PM--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td><b>QUOTE</b> (Thansal @ May 12 2004, 06:11 PM)</td></tr><tr><td id='QUOTE'><!--QuoteEBegin--> well, the traditional response is:

<a href='http://www.lavasoftusa.com/software/adaware/' target='_blank'>http://www.lavasoftusa.com/software/adaware/</a> (removes alot of spyware)

<a href='http://www.safer-networking.org/index.php?page=download' target='_blank'>http://www.safer-networking.org/index.php?page=download</a> (removes/protects against some more spyware)

<a href='http://www.grisoft.com/us/us_dwnl_free.php' target='_blank'>http://www.grisoft.com/us/us_dwnl_free.php</a> (virus scanner)


Oh, and STOP DOWNLOADING PORN! (this goes for your GWAR's autn also!) <!--QuoteEnd--></td></tr></table><div class='postcolor'><!--QuoteEEnd-->
"It wasn't me"

Cyndane

Why do I not believe that.. <!--emo&:p--><img src='http://www.unknownworlds.com/forums/html//emoticons/tounge.gif' border='0' style='vertical-align:middle' alt='tounge.gif' /><!--endemo-->

Pfft.. men...