still got spywear prob!! help needed pls..

have had some help from mickey dee and kenshiro (thankyou very much lads for your time) :
but i have still got a prob with spywear of some sort..
im using xp and firefox when i log onto the net i get directed to a page called
'vhotjnmpkfdjcuuu.com' could not be found..
my home page keeps getting changed to some other page , but even when it hasnt been changed i still get the same blank page with the address above?

i have all day today been scanning pc for anything but im still have no joy, im puter-illiterate so i can only do what other peopl say ( in their opinion is best), i have got cwshedder and that has found nothing, hijackthis has found loads but i dont know what if any to delete? spybot sd keeps finding 'funwebproducts' but cannot delete it ?
any help would really be pappreciated , thnkyou very much in advance

makitso is better at this than me but you could try this link to start.
this was from a search on funwebproducts
www.pctools.com...

To remove a FunWebProduct and your My Web Search toolbar, you must do the following:

1) From your computer's Start button, select "Settings", then select "Control Panel".
2) Double-click on the "Add/Remove Programs" icon.
3) Select "My Web Search Bar" and click "Remove". The My Web Search toolbar and the FunWebProduct feature have now been uninstal


Outlook, Outlook Express and IncrediMail users: To remove a FunWebProduct and the My Web Search navigation bar from your email system, you must do the following:

1) From your computer's Start button, select "Settings", then select "Control Panel".
2) Double-click on the "Add/Remove Programs" icon.
3) Select "My Web Search (Outlook, Outlook Express, and IncrediMail)" and click "Remove". The My Web Search navigation bar and Smiley Central feature have now been uninstalled from your email system.

To remove Search Assistant (this feature provides you with suggested search listings when you mistype or enter an incomplete word or URL into your browser), you must do the following:

1) From your computer's Start button, select "Settings", then select "Control Panel".
2) Double-click on the "Add/Remove Programs" icon.
3) Select "Search Assistant - My Web Search" and click "Remove".

www.funwebproducts.com...

You are here because you want to remove FunWebProducts. FunWebProducts is an application that gets installed on your internet explorer toolbar. This product will track your internet surfing activity and send this information back to their servers.

While they claim to not have any personal information, this will slow down your internet connection. This product has recently been deemed safe by the Aluria Spyware Safe Certification program.

It is hard to tell these days what is spyware and adware, we recommend that you try a free spyware scan from WebRoot Software to remove adware and spyware from your computer. Most people often have just more than 1 type of spyware / adware on their computer.

spyware-removal.thrcomputer.com...

with spybot you can lock your home page as well, pluss backup before you let spybot delet.


[edit on 27/8/2005 by Sauron]

sauron cheers for ur help and time mate:
ive run a few progs and all of them are coming up with 4 funwebproducts still on pc but they are not showing up on the add/remove programes in cntrl panel.....

ive just run a prog called ewido sec suite 3.5 after 171 mins i now find ive got 325 infected files,
ive got rid of all but the funwebproducts
any ideas mate?

Hello Spymaster,

Sorry to hear you still having troubles. I looks like you have really been working hard at removing it.

About not being sure what to remove with hijackthis, there is an automated helper that you just open the web page, scroll down, and paste the contents of your hijack this log into. It will provide you an analysis, and make suggestions of what should stay, and what should probably go.

But back to the funwebproducts issue because I read that hijack this cannot completly remove this one. I believe it has something to do with an inability to detect exploits with longfilenames.

Anyway, I found a post at another website that indicates that Sauron (a great techie if there ever was one) was on the right track with removing it via Add/Remove programs. However it explains some additional steps also that you must do or it will not be removed.

Fair Warning: The registry is critical to all functions of your computer. Don't mess it up.

removal instructions

Close all programs.
Goto Start Menu, Settings, Control Panel, Add/Remove Programs.

In the Add/Remove Programs list, locate and select the Fun Web Products entry, then press the Change/Remove button. Allow the uninstall program to complete. (Optional) Reboot if necessary. (SPYMASTER: I know that it does not show up in yours. Perhaps one of the progams you have been working with did this for you. Just skip this and move on to the next step).

Open My Computer, then locate and delete the following folder (if it still exists):

C

rogram Files FunWebProducts

Open regedit, (see notes below) then locate and delete the following 3 registry keys and values (if they still exist):

HKEY_LOCAL_MACHINE Software FunWebProducts
HKEY_LOCAL_MACHINE Software Microsoft Windows CurrentVersionI nternet Settings User Agent Post Platform FunWebProducts
HKEY_LOCAL_MACHINE SOFTWARE Microsoft Windows Current Version Internet Settings 5.0 User Agent Post Platform FunWebProducts

NOTE: If this step is skipped, your browser will still broadcast that it has FunWebProducts installed.

Reboot your machine.

NOTE: To open the registry, Click Start, and then click Run. In the Open box, type regedit, and then click OK.

NOTE: One of the easiest ways to edit these registry settings is to use the find tool. By selecting edit on the registry toolbar, then select find, type FunWebProducts and press enter. After you delete one, press F3 to search for more instances of funwebproducts.

NOTE: Before you do reboot, you may want to follow Microsofts guide to resetting your homepage after a hijack.

NOTE: I would also check my host file. Host file is located in the C:\WINDOWS\SYSTEM32\DRIVERS\ETC. You can open it with notepad.

Thanks for the props Sauron. That was exceptionally nice.

Best of Luck Spymaster. Feel free to u2u me with questions about the removal process.


makeitso

well I will suggest this, go to start then search for i1srchas.dll in your system (or just download the tool)
i1srchas.dll is a file extension related to Aornum and is the culprit in Funwebproducts.


here is a link to the removal tool
---------------------------------------------------------------------------------------------

source www.spywareremove.com...



I was tracking this down and did not see you post makeitso, and your welcome your on of the best techie's we have on the board

LOL here we are patting each other on the back and poor Spymaster has this head ache.







[edit on 27/8/2005 by Sauron]

now dag nabit, why did I type that stuff about IE? You clearly said you were using firefox. Must be loosing it.


Walks off shaking head..........



Anyway, besides what Sauron said, you could open your browser, type about:config in the location bar, and look for the lines about your homepage, like:

browser. startup. homepage
browser. startup. homepage_override. 1

etc. and modify them as needed. See
kb.mozillazine.org...:_FAQs_:_About:config_Entries#Browser..2A for more info.



[edit on 27-8-2005 by makeitso]

If you are running XP the best progys to use as first defence and clean are MS antispy and counterspy.

They are both similiar and will run actively to stop unwanted spyware from coming in.

Two other programs are adaware and spybot. Download adaware or spybot, install them and then update the program
Switch your computer off and restart the computer in safe mode. Run the scans in safe mode.. At the end choose fix selected problems or tick all entries offered then fix/clean.
restart the computer when complete and rerun the programs. deleting the entries again if any new ones popup.

that should fix it all. including the coolwebsearch and any other nasty browser redirects or search bars.

I recomend downloading and using-adaware se 1.06, spybot search and distroy 1.4, ccleaner,microsoft antispyware and download a demo window washer. I find these programs-yes, I mean use all of them, usually get rid of most issues.

What anti-virus do u run? free are AVG and AVANT
what fire wall(s) do u run? free are many, I like zonealarm 6.X (if u have previous version
***************REMOVE IT FIRST********************************
**************dO NOT UPGRADE-IT WILL SCREW UP*****************

I hope this helps u

caution: use extreme caution with "spy" cleaners, with a name like spymaster, you could possibly delete yourself, or at least your screen personality. hehe.

Do this in order:

#1 Delete all cookies and temp files

#2 Run at least three spy apps.

- Computer Accociates Pest Patrol is the cheapest and was rated #1 by MaximPC ($29.99US)
- Ad Aware is a nice freebie
- Spybot Search and Destroy was rated better than ANY (even bought) anti spy apps and its free.

#3 Open Start, then choose RUN. Type "MSCONFIG". The last tab on the window that appears is STARTUP. You will see a list of things, some checked off some not. EVERYTHING checked here is an app that starts each and every time you boot your PC. The kicker is Windows XP requires NOTHING here to be checked. Make a note of anything there that you dont recognize and its path. UNcheck everything and click apply. Your PC will want to reboot, let it. VERY IMPORTANT: The very FIRST thing you do once your PC reboots is to get back into MSCONFIG. Do this before you open anything. Then look to see if anything rechecked itself to boot at startup. Those are your nasties and now you have the path.

If this doesnt work, back up and reformat my friend!!

Start > Control Panel > Internet Options...

General

Delete Cookies
Delete Temp Files - Delete all offline content
Settings - View Objects - Edit - Select All - Delete

Content

Clear SSL State
Autocomplete - Clear Forums & Clear Passwords

Programs

Reset all Current web settings

Advanced

Uncheck - Disable third party browser extensions

Now go back to GENERAL

Put in a homepage that you would like.

Click on OK

This is most efficient in IE, so with the firefox I would recomment Windows Defender , SMITREM , Adaware SE Personal , or Microsoft Online Virus Scan