- Look for 'browser helpers' and dns settings changed.
- They can do it two ways - by changing the dns server or by adding to
c:\windows\system32\drivers\etc\hosts
- Look for a 'search assistant' installed in control panel -> add/remove
programs
The most common one I see now days is mywebsearch that has a browser
plugin, email plugin, and application installed
On Mon, Aug 10, 2009 at 8:54 AM, Eric Cope <
eric.cope@gmail.com> wrote:
> she's pissy over using firefox, the world will implode if I switch it to
> Linux...
>
> Firefox and Noscript have stopped it...
> malwarebytes doesn't find anything.
> spybot is running right now.
> DNS records look ok (but I am far from an expert).
> Any other ideas? My wife told me her mom us suffering the same thing. Any
> ideas to scan my website?
>
> Thanks,
> Eric
>
>
> On Sun, Aug 9, 2009 at 10:03 PM, Michael Butash <michael@butash.net>wrote:
>
>> Haha, do like I did, force my wife to eat linux for her main
>> workstation. Past a few weeks of trepidation and being pissy, she's now
>> quite thankful.
>>
>> Rehab for windoze users, it's for their own good to perform
>> intervention. :)
>>
>> -mb
>>
>>
>> On Sun, 2009-08-09 at 17:18 -0700, Bob Elzer wrote:
>> > Might have to do an upgrade to wife 1.2 :-)
>> >
>> >
>> >
>> > ______________________________________________________________
>> > From: plug-discuss-bounces@lists.plug.phoenix.az.us
>> > [mailto:plug-discuss-bounces@lists.plug.phoenix.az.us] On
>> > Behalf Of Eric Cope
>> > Sent: Sunday, August 09, 2009 4:15 PM
>> > To: michael@butash.net; Main PLUG discussion list
>> > Subject: Re: OT - Web browsing issue
>> >
>> >
>> >
>> > I recently wiped it due to a similar issue. But my wife visits
>> > the same sites...
>> >
>> > On Sun, Aug 9, 2009 at 3:57 PM, Michael Butash
>> > <michael@butash.net> wrote:
>> > How often do you actually ask windows-only people for
>> > anything helpful
>> > even for windoze? :)
>> >
>> > Sounds like something is manipulating your outbound
>> > traffic, try
>> > malwarebytes, or a format. I don't trust any windoze
>> > install once it's
>> > been compromised, and only slightly more even fully
>> > patched. I had a
>> > friends new windoze install get owned in less than day
>> > of them ignoring
>> > my warning of using firefox w/noscript, and got the
>> > same kind of
>> > behavior hijacking url's like that. Even when cleaned
>> > with
>> > malwarebytes, something still persisted that it
>> > couldn't find, so they
>> > just wiped it again. Hopefully it wasn't one of those
>> > mbr-resident
>> > stealth ones thanks to sony...
>> >
>> > -mb
>> >
>> >
>> > >
>> > > why are we asking windows questions on Linux list?
>> > >
>> > > Craig
>> > >
>> > >
>> >
>> >
>> >
>> > ---------------------------------------------------
>> > PLUG-discuss mailing list -
>> > PLUG-discuss@lists.plug.phoenix.az.us
>> > To subscribe, unsubscribe, or to change your mail
>> > settings:
>> >
>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>> >
>> >
>> >
>> >
>> > --
>> > Eric Cope
>> > http://cope-et-al.com
>> > ---------------------------------------------------
>> > PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
>> > To subscribe, unsubscribe, or to change your mail settings:
>> > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
>> To subscribe, unsubscribe, or to change your mail settings:
>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>
>
>
>
> --
> Eric Cope
> http://cope-et-al.com
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
(text/plain)