hijacked by nowfind

[ad5mb]

Some POS installed a monstrosity called nowfind as my default page.

When I use regedit to cut the entries pointing to nowfind, they come back within 30 seconds. I'm guesing there is a program running that overwrites the registry over and over.

Anybody know what that program might be?

[GroundZero3]

have you run the usual spybot and adaware programs to see if it catches it?

[pphalan]

http://www.allaboutviruses.com/24292...-hijacker.html
Re: nowfind.net hijacker

[Bill in SD, CA]

Download and run HijackThis .

HijackThis Quick Start

SpywareData

HijackThis log file analysis


Bill

[ad5mb]

Ran the usual suspects, Ad-Aware, Spybot Search & Destroy, the MS Antispyware beta. I haven't been to the site listed by pphalan, that's next.

Antispyware keeps popping up messages asking:

Can 4.exe access the ninnynet?
click3.exe ditto

And it asks if a.bat can run

After far too much grief and aggravation, I found a hidden folder in a hidden system folder.

C:\Documents and Settings\AD5MB\Local Settings\Temp

In your computer, of course, AD5MB would be your login name. Local Settings is a hidden system file that belongs there. \Temp, installed last night, does not. It contained all these executables and 3 .tmp files.

I keep deleting it. It keeps coming back. The .tmp files reappear, indicating that something else is putting it back on.

I have to wonder if the self propelled snotrag who put so much effort into making this arrogant, conceited program ever considered the possibility of encountering a vast, nasty tempered, Wheaties-eating joker like me in an alley.

[Bill in SD, CA]

Ahhh, did you ....... ahhh never mind.

Bill