Something wrong with my browser

[adrian8311]

Hi,
I've encountered a serious problem, I doubt there's spyware/parasites inside my computer. I don't know why whenever I typed in a web site in the browser, like www.hotmail.com, I will be redirected to the http://www.magicsearch.ws/Refinance.html web site, and I have to type "www.hotmail.com" again in the search bar of the magicsearch website. Does anyone know why? And how I can solve this problem? Thx.

Adrian

[saturnotaku]

Have you tried running Spybot or Ad Aware?

[adrian8311]

Yes I've just both, but doesn't work....

[monkeydust]

Hmm... Ad Aware should have worked.

I just went over to a friends house last night and fixed his computer that was doing something similiar. What you might want to try is search your registry for "http://www.magicsearch.ws/Refinance.html" and replace it with something like "http://www.google.com/" or whatever. If you do that and it comes back, you probably have a .dll installed on your box that is putting that site back into your registry.

[eL_PuSHeR]

I guess you have downloaded latest definitions (updates) for Spybot S&D, right?

[de><ta]

One of the older computers that I have is fully choked with spyware. Serves me right for giving every one access to it.

Here is what I do,
login in via non-admin, before explorer starts up when you log in (not IE explorer) I start up the taskmanager, and end all the processes that are not system based including explorer.

Then re-run explorer via the run command and that seems to ensure that no spyware is booted into memory. That computer too has Spybot, but it still does it not good.

Another suggestion is too start using firebird/firefox instead of IE. One of my friends was telling me how some spyware actually edits the IE executable to load up specific spyware, yar it is bad.

[threedaysdwn]

Check the %systemroot%/System32/drivers/etc/HOSTS file using WordPad.

Something may have added erroneous entries to that file which could redirect you in such a way.

Although, if that were the case, entering the address again probably wouldn't help you... but I'd say check it out.

Also check msconfig and see what's running at startup. Disable anything you can't idenfity.

[adrian8311]

Hi,
Thx guys, actually, I've just found the complete solution to remove the magicsearch.ws in http://www.aameen.org/ (inside the forum)
And I successfully removed it, however, after I restart the and reenter the web site, the spyware came back again........ I will tried out your suggestions, but I think spybot and ad-aware wouldn't help, since this is not a simple spyware. Thx for your help.

adrian