This thread got me through a serious problem with my computer. I thank you, thank you, thank you.
Yer weccum, eb ... verra glad ta hear we helped ya. That's exactly the sorta thing that makes all this worthwhile.
Well, that, and the donuts, of course.
Have one filled with jelly from me.
Check out this article in today's Houston Chronicle:
They Came From Cyberspace
Bookmarking too. It's incredible the number of new threads I've seen on this subject lately, by people whose machines have been hijacked.
Now all I gotta do is print this all out! Thanks.
I'm getting pop-ups even while I'm on A2K which never happened with my old computer. I'll try to get a friend to follow your instructions Timber. Your instructions are very clear, but I'm a complete computer illiterate.
Thanks for your help.
HELP! Spyware, etc. Timberlandko's process helped
Hi There,
I did a new post (I think I did it right!) today with the same heading in the computer section. If you could check out all that I included in attempting to fix all this cr%$% in my system. It took me 5 minutes (I nearly blew up the computer!) just to be able to post this reply. Every time I go into post reply and click in the subject line, Lycos search jumps in and closes this page, I use back and try again. Finally after about 40 tries, I was able to type on the page I chose. What the heck is going on? PLEASE HELP. Thank you so much.
Yuckware removal did the job
Your directions for removal of yuckware, spyware, etc. worked great. It was most of a days work but it was well worth it. Thanks so, so, so much for your help!
I could not remove the twaintec.dll file either and received the message somebody posted earlier. I renamed the file and then deleted it. It worked. I do believe that twaintec was the main source of the problems I was having as it was created April 10 and that is the date my problems started.
Thanks again.
Yer weccum, spark, and thanks for the feedback ... it helps to know what works and what doesn't for different folks in different situations.
Is "Coolshader" spyware? I've seen several posts about it recently.
It certainly is, Wilso; its a CoolWebSearch variant, and a bit more tenacious than some of its siblings.
searchpage.cc
ok, i guess this post is for you timber since you seem to be the "guru" on this stuff from what i have read so far. i do a lot of work on computers on the side for people i know and from recommendations from friends and coworkers. i build computers and do alot of basic software troubleshooting and "housecleaning" so to speak on problematic systems. a friend that i work with has somehow gotten this searchpage.cc problem. i am usually pretty good at cleaning up a system and getting rid of any such problems but this has damn near got me beat. i hate to give up and format the hard drive, although from the time i have spent so far working on it it probably wouldve been much faster and easier, but i just dont like to give up on something untill i figure it out and solve it. anyway, i have tried almost everything imaginable to fix it but i cant seem to find a resolution. first i will explain what i have done so far and maybe there is something that i have overlooked that you can point me to to try to figure this thing out. i have ran hijack this, cwshredder, adaware, and spybot. all programs fully updated. i have put norton antivirus 2004 fully updated and ran numerous scans. i have used bazooka scanner from kephyr labs. i have read many posts concerning the dll files involved( mshelper, mshelper_beta, and mtwirl). so far i found and deleted the first two i listed, however the mtwirl file is not anywhere on the computer. i have view set to show hidden files and i have searched for it with explorer and found nothing. i have managed to get rid of the problem for about a day then it always returns. at first i had alot of the same problems as almost every other post i have read. when i first open IE it goes to searchpage. i have managed to get it so i can manually type in the address and i can go to any page i want, but i cannot fully get rid of the searchpage or the popups that come with it. i have manually deleted registry entries pertaining to searchpage(by searching through the registry and removing them all until i found no more entries). this worked for a while but it still came back. hijack this shows searhpage listed for my deafault start page and default searchpage etc. i fix that and all is well and rerunning hijack this shows everything ok. but then either that same night or the next day it returns again. none of the other programs i listed detects anything. i have tried the uninstaller given for download from the searchpage.cc website, all it does is tell me to reboot and rerun the program but when i do it just keeps telling me to reboot and does nothing. i am currently at my home computer right now so i do not have a hijack log to post but i can tell you i have thouroughly looked it over and everything there ( except for the searchpage entries pertaing to deafult start page etc.) is legit. mostly they are from symantec, shockwave, macromedia, adobe, and other such well known programs that i do have installed. i have no p2p programs running on this machine and my friend is not the type to search or browse porn sites, also i checked his history on the browser and nothing really out of the ordinary is there. so far i have done most everything l;isted on every forum i have visited to no avail. all registry entries have been removed, they keep coming back but i have removed them several times. all dll files i can find pertaining to this have been removed or are not there at all. i have checked the add/remove programs and nothing there could be the culprit. ran numerous spyware/adware scanners and all detect nothing, except for hijack this which just deltes the registry entries that keep getting rewritten. system resotre was disabled and safe mode used durning most if not all of the operations. the os, windows xp, is completely up to date accprding to the windows update website. i am about to ready to throw in the towel and reload the whole thing from scratch as much as i hate to do it. any help you could lend would be greatly appreciated. thank you.
That's a wierd one, allright. Lemme check some things out and I'll see if I can come up with something for you.
Just a quick, off-the-wall thought here ... mebbe nothing worthwhile, but how many user accounts are on your buddy's machine?
there is only one user account set up on his computer. aso i forgot to mention my original post for things i have already tried, i followed all the steps you listed at the beginning of this post as well as the things i mentioned. thank yuo for your quick response and your time.
Okay, I decided to try this too.
Well, everything was going pretty smoothly until I tried to download Coolwebsearch smartkiller. I got it downloaded but I can't use it.
When I try to run it a message pops up saying "CoolWWWSearch.Smartkiller (v1/v2) has not been found on your system.
Can somebody help me?
Timber I am using a new puter, not mine, that is totally hijacked. I am printing you directions and will be showing them to the owner. I hope he will try this as this thing is so corrupted you cannot even view the fire wall, yikes.
When he tried to connect to Norton to renew this weird page come up NKVD.US/1524/ is presents itself as a search page but is just crazy porn sites, gaming, and other junk. In addition there is a porn short cut on the desk top that cannot be deleted - what's up with that?
Its a common hijack, JD. Have your buddy download and run HiJackThis per instructions and post the log in a new topic.
