I thought it was malware also, but now its doing it to my work PC and Firefox. I think my Wordpress installation has been compromised. Dang! On Mon, Aug 10, 2009 at 9:10 AM, JD Austin wrote: > > - Look for 'browser helpers' and dns settings changed. > - They can do it two ways - by changing the dns server or by adding to > c:\windows\system32\drivers\etc\hosts > - Look for a 'search assistant' installed in control panel -> > add/remove programs > The most common one I see now days is mywebsearch that has a browser > plugin, email plugin, and application installed > > > On Mon, Aug 10, 2009 at 8:54 AM, Eric Cope wrote: > >> she's pissy over using firefox, the world will implode if I switch it to >> Linux... >> >> Firefox and Noscript have stopped it... >> malwarebytes doesn't find anything. >> spybot is running right now. >> DNS records look ok (but I am far from an expert). >> Any other ideas? My wife told me her mom us suffering the same thing. Any >> ideas to scan my website? >> >> Thanks, >> Eric >> >> >> On Sun, Aug 9, 2009 at 10:03 PM, Michael Butash wrote: >> >>> Haha, do like I did, force my wife to eat linux for her main >>> workstation. Past a few weeks of trepidation and being pissy, she's now >>> quite thankful. >>> >>> Rehab for windoze users, it's for their own good to perform >>> intervention. :) >>> >>> -mb >>> >>> >>> On Sun, 2009-08-09 at 17:18 -0700, Bob Elzer wrote: >>> > Might have to do an upgrade to wife 1.2 :-) >>> > >>> > >>> > >>> > ______________________________________________________________ >>> > From: plug-discuss-bounces@lists.plug.phoenix.az.us >>> > [mailto:plug-discuss-bounces@lists.plug.phoenix.az.us] On >>> > Behalf Of Eric Cope >>> > Sent: Sunday, August 09, 2009 4:15 PM >>> > To: michael@butash.net; Main PLUG discussion list >>> > Subject: Re: OT - Web browsing issue >>> > >>> > >>> > >>> > I recently wiped it due to a similar issue. But my wife visits >>> > the same sites... >>> > >>> > On Sun, Aug 9, 2009 at 3:57 PM, Michael Butash >>> > wrote: >>> > How often do you actually ask windows-only people for >>> > anything helpful >>> > even for windoze? :) >>> > >>> > Sounds like something is manipulating your outbound >>> > traffic, try >>> > malwarebytes, or a format. I don't trust any windoze >>> > install once it's >>> > been compromised, and only slightly more even fully >>> > patched. I had a >>> > friends new windoze install get owned in less than day >>> > of them ignoring >>> > my warning of using firefox w/noscript, and got the >>> > same kind of >>> > behavior hijacking url's like that. Even when cleaned >>> > with >>> > malwarebytes, something still persisted that it >>> > couldn't find, so they >>> > just wiped it again. Hopefully it wasn't one of those >>> > mbr-resident >>> > stealth ones thanks to sony... >>> > >>> > -mb >>> > >>> > >>> > > >>> > > why are we asking windows questions on Linux list? >>> > > >>> > > Craig >>> > > >>> > > >>> > >>> > >>> > >>> > --------------------------------------------------- >>> > PLUG-discuss mailing list - >>> > PLUG-discuss@lists.plug.phoenix.az.us >>> > To subscribe, unsubscribe, or to change your mail >>> > settings: >>> > >>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >>> > >>> > >>> > >>> > >>> > -- >>> > Eric Cope >>> > http://cope-et-al.com >>> > --------------------------------------------------- >>> > PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us >>> > To subscribe, unsubscribe, or to change your mail settings: >>> > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >>> >>> --------------------------------------------------- >>> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us >>> To subscribe, unsubscribe, or to change your mail settings: >>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >>> >> >> >> >> -- >> Eric Cope >> http://cope-et-al.com >> >> --------------------------------------------------- >> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us >> To subscribe, unsubscribe, or to change your mail settings: >> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >> > > > --------------------------------------------------- > PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us > To subscribe, unsubscribe, or to change your mail settings: > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss > -- Eric Cope http://cope-et-al.com