OT, Help, Browser take over attack Options

[DNHunt]

Every time I visit here I get a browser take over the next time I connect. It adds some pretty digusting stuff to our favorites list and I'm not sure what else it may be trying to do. Ad-Aware will remove it but, it comes back. Here's what Ad-Aware says about it.

Vendor:Possible Browser Hijack attempt
Category:Malware
Object Type:RegData
Size:-
Location:Software\Microsoft\Internet Explorer\Main "Start Page" ("res://mshp.dll/index.html#37049")
Last Activity:3-27-2004
Risk LevelMedium
Comment:Possible browser hijack attempt
Description:Possible attempt to control\redirect the browser. This object referrs to a "blacklisted" site.

Anybody else get this? Any suggestions?

Dave

[skline]

I do this everyday for clients, the ones you delete in the registry that keep coming back are sevices that are running at that time. To delete them, you need to boot the computer into safe mode. Then delete the registry entries. Then go into the windows explorer and manually go through all executables in your windows and system and system32 folders and delete the ones that dont belong there. Its easy to tell, if you hold the curser over the file name, it will tell you who wrote it, if it doesnt say anything but the file name and date, its probably not supposed to be there. Group all files by name, it makes it easier. Also, look at the date of the file as well. Check your startup folder also, remove anything you dont want in there. Any DO use Mozilla instead of Internet Exploder.

Also, you need to check all of the keys in the registry, not just local machine. And Microsoft does not sugguest that you edit your own registry, they will not support you if you do it without guided help. Their exact words when I was taking their classes were, "If you dont know what you are doing, Dont edit the registry, changes are immediate and not reversable."