Again Url never goes away!! (W98)

[homeflash]

I thought I solved the problem.

Okay, this web site

http://www.chez.com/cybernard/

is a pron site, well, it first asks for age to get it. But I dont want it to show. If I clear auto complete for web address, it will not show, but as soon as i check it back, only this web site remains!!

like when I type www.c , and it will show the address, however, cnn.com and all others are gone since I clear history, delete temp files, and so on.

How do I get rid of it all together...

Please kindly advise!!!!

[report_2]

Have you already tried searching your registry for cybernard?

Also check at Start, Programs, Startup and look for anything that ends with either .reg or .hta and delete it.

[homeflash]

yeap,done that, nothing found..

that really puzzles me!

[Simon Clausen]

Download Ad-Aware from http://www.winguides.com/ (http://www.download.com/>Download.com</a>)

[TonyKlein]

I'm not so sure whether the Lavasoft folks have heard of this one.

Would you please go to <a target="_blank" href=http://www.spywareinfo.com/downloads.html>http://www.spywareinfo.com/downloads.html</a> , and download both 'Hijack This' (in the "Detection and Removal" section), and 'Startuplist' (in "Startup Program Management").

Run both, let them create log files, and post the results here.

[homeflash]

tried all of them,
hijack this, startuplist, adaware

still no good!

[TonyKlein]

You may have "tried" Hijack This and Startuplist, but have we been able to get a look at it here?

If so, please give us a link to that thread.

If not, please run them again, and post the logs.

Also, have a look at the default values of HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\URL

Do you see references to your rogue url anywhere?

[homeflash]

Here is the Hijack log file
Logfile of HijackThis v1.71.0
Scan saved at 5:19:13 PM, on 11/4/02
Platform: Windows 9x 4.10.2222

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://searchbar.linksummary.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://searchbar.linksummary.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://searchbar.linksummary.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://searchbar.linksummary.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://searchbar.linksummary.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://home.microsoft.com/access/allinone.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://www.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.yahoo.com/"); (C:\Program Files\Netscape\Users\shlpdsk\prefs.js)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O9 - Extra button: Related
O9 - Extra 'Tools' menuitem: Show &Related Links
O9 - Extra button: Real.com
O9 - Extra button: AIM
O12 - Plugin for .asp: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdspl ay.dll
O12 - Plugin for .bmp: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .wma: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdspl ay.dll
O12 - Plugin for .avi: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npavi3 2.dll
O12 - Plugin for .cfm: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\nppl32 60.dll
O12 - Plugin for .SWF: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npswf3 2.dll
O12 - Plugin for .au: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll


also, i looked at the regristry you gave me, nothing about chez.com, it seems normal to me

[TonyKlein]

Your browser seems to have been hijacked by Linksummary.com. It's a pretty familiar one.

Let Hijack This fix the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://searchbar.linksummary.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://searchbar.linksummary.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://searchbar.linksummary.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://searchbar.linksummary.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://searchbar.linksummary.com/

And if you could post your Startup log, that would be great.

[homeflash]

great!! it works, thanks so much... btw, what is that linksummary.com???

[TonyKlein]

It's just one of these sites that hijack your homepage.

Los of those around, I'm afraid.

Glad to hear you were able to get rid of it.

Cheers, Tony

[homeflash]

Geez, that is back again, this time I checked, the linksummary.com is not there



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://home.microsoft.com/access/allinone.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://www.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.yahoo.com/"); (C:\Program Files\Netscape\Users\shlpdsk\prefs.js)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O9 - Extra button: Related
O9 - Extra 'Tools' menuitem: Show &Related Links
O9 - Extra button: Real.com
O9 - Extra button: AIM
O12 - Plugin for .asp: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdspl ay.dll
O12 - Plugin for .bmp: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .wma: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdspl ay.dll
O12 - Plugin for .avi: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npavi3 2.dll
O12 - Plugin for .cfm: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\nppl32 60.dll
O12 - Plugin for .SWF: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npswf3 2.dll
O12 - Plugin for .au: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll



Also, how do I restrict certain site to be entered? I meant, if enter, it wont even be saved on the url address list???