- Look for 'browser helpers' and dns settings changed.
   - They can do it two ways - by changing the dns server or by adding to
   c:\windows\system32\drivers\etc\hosts
   - Look for a 'search assistant' installed in control panel -> add/remove
   programs
   The most common one I see now days is mywebsearch that has a browser
   plugin, email plugin, and application installed


On Mon, Aug 10, 2009 at 8:54 AM, Eric Cope <eric.cope@gmail.com> wrote:

> she's pissy over using firefox, the world will implode if I switch it to
> Linux...
>
> Firefox and Noscript have stopped it...
> malwarebytes doesn't find anything.
> spybot is running right now.
> DNS records look ok (but I am far from an expert).
> Any other ideas? My wife told me her mom us suffering the same thing. Any
> ideas to scan my website?
>
> Thanks,
> Eric
>
>
> On Sun, Aug 9, 2009 at 10:03 PM, Michael Butash <michael@butash.net>wrote:
>
>> Haha, do like I did, force my wife to eat linux for her main
>> workstation.  Past a few weeks of trepidation and being pissy, she's now
>> quite thankful.
>>
>> Rehab for windoze users, it's for their own good to perform
>> intervention.  :)
>>
>> -mb
>>
>>
>> On Sun, 2009-08-09 at 17:18 -0700, Bob Elzer wrote:
>> > Might have to do an upgrade to wife 1.2 :-)
>> >
>> >
>> >
>> >         ______________________________________________________________
>> >         From: plug-discuss-bounces@lists.plug.phoenix.az.us
>> >         [mailto:plug-discuss-bounces@lists.plug.phoenix.az.us] On
>> >         Behalf Of Eric Cope
>> >         Sent: Sunday, August 09, 2009 4:15 PM
>> >         To: michael@butash.net; Main PLUG discussion list
>> >         Subject: Re: OT - Web browsing issue
>> >
>> >
>> >
>> >         I recently wiped it due to a similar issue. But my wife visits
>> >         the same sites...
>> >
>> >         On Sun, Aug 9, 2009 at 3:57 PM, Michael Butash
>> >         <michael@butash.net> wrote:
>> >                 How often do you actually ask windows-only people for
>> >                 anything helpful
>> >                 even for windoze?  :)
>> >
>> >                 Sounds like something is manipulating your outbound
>> >                 traffic, try
>> >                 malwarebytes, or a format.  I don't trust any windoze
>> >                 install once it's
>> >                 been compromised, and only slightly more even fully
>> >                 patched.  I had a
>> >                 friends new windoze install get owned in less than day
>> >                 of them ignoring
>> >                 my warning of using firefox w/noscript, and got the
>> >                 same kind of
>> >                 behavior hijacking url's like that.  Even when cleaned
>> >                 with
>> >                 malwarebytes, something still persisted that it
>> >                 couldn't find, so they
>> >                 just wiped it again.  Hopefully it wasn't one of those
>> >                 mbr-resident
>> >                 stealth ones thanks to sony...
>> >
>> >                 -mb
>> >
>> >
>> >                 >
>> >                 > why are we asking windows questions on Linux list?
>> >                 >
>> >                 > Craig
>> >                 >
>> >                 >
>> >
>> >
>> >
>> >                 ---------------------------------------------------
>> >                 PLUG-discuss mailing list -
>> >                 PLUG-discuss@lists.plug.phoenix.az.us
>> >                 To subscribe, unsubscribe, or to change your mail
>> >                 settings:
>> >
>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>> >
>> >
>> >
>> >
>> >         --
>> >         Eric Cope
>> >         http://cope-et-al.com
>> > ---------------------------------------------------
>> > PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
>> > To subscribe, unsubscribe, or to change your mail settings:
>> > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
>> To subscribe, unsubscribe, or to change your mail settings:
>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>
>
>
>
> --
> Eric Cope
> http://cope-et-al.com
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>