ARGH!! Clearsearch and Global-Finder Hijackware

[Itek]

HELP!!!

I give up. I surrender. I can't take it no more.

I have deleted this junk a half-dozen times.

I have reset my homepage (Global-Finder.com keeps stealing it every fricking time I reboot my computer, but NOT more than once a day) a dozen times.

I have run regedit a full half dozen times.

I have searched and finally found an "ownership" site for Clearsearch.net at clearsearchinc.com which, in theory, allows an uninstall.

I have found a "software package" similar to anti-virus software that offers to remove these "hijackware" programs and prevent future infestations for the low low price of 40 bucks.

Anyone out there got a cheaper way to do it? (Like a manual way? I can deal with everything short of a total and complete reinstall of the Operating System. Restoring all my data and programs on my hard drive would require far too much time. But if I need to uninstall IE6.0 and reinstall I will.)

I'm at my wits end. For the sake of what sanity I have remaining I hope someone here can help.

[Lothay]

I doubt that reinstalling I.E. 6 will help.

I've had this happen to me once, but I was fortunate in that Norton Utilities CleanSweep was able to completely remove the thing.

If it is resetting things at reboot something is around to execute so there are a few places to check:

autoexec.bat
config.sys
win.ini

Of course the windows registry.

Clear all of your "Temporary Internet Files" but also scan the names of the items in there and see if one is duplicated elsewhere (Windows or WinNT or Root directories and sub-directories especially).

Sorry I can't be much more help than this, and you've likely already tried these.

[Verdandi]

Have you tried Ad-Aware? There is a free version that is just as effective as the paid version at removing scumware. I've never had the problems you mention but it has always successfully removed pop-up generators and the like. If you are using any free software that may have been the origin of the pest, using Ad-Aware may disable it. But it sounds like that's a price you're willing to pay, at this point hehe. It's easy enough to use, and might be worth a try.

The paid version gives you additional features like running regularly scheduled checks and automatically skipping things that you know you want to keep, etc. But the free version will still give you the chance to look at what it found and select only what you want removed.

[GraemeFaelban]

I used to us Ad-Aware, but it was not keeping up to date with the newer stuff coming out, I switched to a different free product, will have to check when I get home what it is. It's been working great for me at home.

[Serenya]

I use SpyBot, same concept as Ad-Aware.

[Dryanna]

Spy-Bot Search and Destroy is a wonderful program. It keeps up to date, it's free (though there is an area to donate if you like so that the guy has incentive to keep his kick-butt program going) and it's very user friendly.

It also has a set up so that if there is a program that kind of wraps its tentacles in and makes it dangerous to remove, it simply replaces its startup file pathway to a dummy file - so if the program has a command like "reset home page on startup", it won't actually do it anymore. It will attempt to execute the command but be directed to a harmless dummy file. Quite a nice feature

Good Luck!

[Inyidd]

Just so you know, AdAware has an update function that will download the latest signatures (much like Anti-Virus programs get new virus definitions).

[Dryanna]

That Igetnet thing is on their list of stuff they get out also

[Itek]

Hmm,

Thanks for the links.

Spy-bot search and destroy and Ad-Aware 6.0 personal have helped.

Now at least it SEEMS to be doing something.

And I'm down to an hour a day rooting this junk off my hard drive.

Today a DIFFERENT site hijacked my homepage AND my desktop crashed. Not the computer, the "active desktop" ...

Which I found FREAKY because...

I do not USE an "active desktop" ...

*grumble*

[Kupek]

Just a bit of personal AdAware experience to share, for those who may feel it's falling behind on the latest spyware. It might actually be trying to upgrade to handle the newest stuff, but not succeeding!

I had a browser hijacker that would pop up a mail-order bride site every time I opened IE (usually use Opera, so not terribly annoying, but it's the principle of the thing) I was rather aggravated that AdAware 6 couldn't seem to find it, and the 'update' button wasn't pulling down any new reffiles. Then I noticed that, though it was popping up a dialog saying, "No updates available!", there was a separate message in the app itself saying that there was a new version of AdAware available, and that any new reffiles would require that version. I upgraded, got a new reffile, and haven't seen a mail-order bride since.

[KyrosKrane]

Just so you're aware, there are a few programs and "nasty-ware" applications out there that will actually interfere with Ad-Aware and similar programs or even try to remove them. The makers of these programs claim that since Ad-Aware is "unfairly" targetting their program for removal, it's within their rights to strike back and disable Ad-Aware when their program is installed.

The strength of that argument aside, be sure that Ad-Aware is actually working the way it should. Reinstall it if you feel there's a problem. You can usually start Windows in safe mode to prevent the nasty-ware from loading, then download, install, update, and run Ad-Aware to clean it off.

[Britneyy]

Look in your program files. Most type of applications like that will hide themselves in there running there vb scripts each time ie6 opens up, usally you can tell whats supposed to be there and whats not.

[sikle]

Download and install the new google toolbar. Has a built in pop up stopper, and one of the options of the toolbar is to "lock" your homepage so that it can't be changed by the websites and programs that like to change it.

[Itek]

Spybot Search and Destroy "locks" the homepage as an option.

Didn't work. (was one of the first things I tried)

Found the hijack finally. Registry key in "CurrentVersion/Run" that ran an exe file. Changed the key to point to opening Minesweeper.

And I found, thru a Google search, a nifty program called CWShredder.

So a combination of Spybot Search and Destroy, Ad-Award 6.0, CWShredder, registry hacks, virus scans, liberal deletion of any programs in \Windows or \Windows\System that I didn't recognize (MCSE and AAS degree in computer support and networking), and slap-happy assignment of domains to "restricted" security settings in IE6.0 has finally allowed me to keep my homepage for almost 2 solid days straight.

If I ever meet the son of 2 brothers responsible for stealing nearly 30 hours of my life... he'll walk funny for a long time. (kidding, violence is never the answer... unless you need a bit of exp)