OT, Help, Browser take over attack Options

[DNHunt]

Every time I visit here I get a browser take over the next time I connect. It adds some pretty digusting stuff to our favorites list and I'm not sure what else it may be trying to do. Ad-Aware will remove it but, it comes back. Here's what Ad-Aware says about it.

Vendor:Possible Browser Hijack attempt
Category:Malware
Object Type:RegData
Size:-
Location:Software\Microsoft\Internet Explorer\Main "Start Page" ("res://mshp.dll/index.html#37049")
Last Activity:3-27-2004
Risk LevelMedium
Comment:Possible browser hijack attempt
Description:Possible attempt to control\redirect the browser. This object referrs to a "blacklisted" site.

Anybody else get this? Any suggestions?

Dave

[TravisNeff]

A file is downloaded into your temp directory, it places an .exe file probably in your windows or windows\system directory, it then places a call to start that .exe file in the "run" entry of the registry; thus every time you boot your computer and login - the file is launched. If you delete the entry, a few seconds later that file in your temp directory re-enters that run command. It's a pain, you can't delete the file in windows as it is running and in use most of the time. A trick that has worked for me a couple times is to put a bogus .exe filename in the registry in place of the one you want to delete, reboot then delete the registry entry, the file in the windows dir and also the one in your temp area.

They all operate a little differently - so you may have to dream up a few different ways to get around it.

What I meant by a google search was, take a look in the "run" area of your registry, write down each of the .exe files that are running, rule out the ones you know are supposed to be there (and if you don't this is where google will help). After you wrote down all those file names, hit google and search for each of those files. If you have a popup program running and you did a search on the .exe file, you most likely will get a ton of sites that tell you how to remove that program. make sense?