Windows Forum

Ask something
Discussion Locked

www.ads234.com search hijack

0 helpful
7 replies

by sgt_shultz

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

tried resetting web settings in ie6 and ran latest ad-aware but cannot get rid of this search hijack. does anybody know this one: www.ads234.com
nothing in the registry by that name. not sure which values in registry it might be...

7 replies

by pierrejamme

You have Netspry. It is diffucult to remove, but ideas are plentiful. (google Netspry)
You must turn off "System Restore". Click Start > right-click My Computer, and then click Properties.
Click the System Restore tab.
Select the "Turn off System Restore" check box and then click OK.
Click Yes when you receive the prompt to the turn off System Restore.

Spy Bot Searc & Destroy 1.3 is a help for removing. http://www.safer-networking.org/index.php?page=download

CW shredder is one of the tools recommended.
http://www.aluriasoftware.com/tools/cwshredder.zip

After removing the hijacker and reboooting, rescan your system one more time then re-enable system restore.
Here is a link that says they can remove Netspry:
http://www.fonynet.co.uk/spyware-NetSpry-remove.php
When you think everything is gone then:

Turn on System Restore Back on. Clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
Reduce the size of the System Restore to 3% or less. You don't need the 12% default.

by lmon

Looks like you got some new type of trojan that everyone seems to be having trouble removing. Remember first remove system restore then get stinger.exe see if that helps if it dont then go to the link below and see what that does.

http://www.angelfire.com/un/midaddle/index.html

by pb_valiant

Manual way to delete these trojans is

Disable System Restore as already advised.

1. CTRL+ALT+DELETE - Task Manager - Remove any processes that shouldn't be there. E.G. FKHLEOFDGM or ghea5s7fs4

2. Edit following registry values: HKLM>software>microsoft>windows>currentversion>run
Remove any entries that you dont think should be there. EG if its not for a program you installed it shouldn't be there.

HKLM>software>microsoft>windows NT>currentversion>windows
If there is anything listed in data next in AppInitDLLs key remove it by right click - Modify and delete the value data only not the entire entry.

3. Go to Windows>System32 and Windows folders and delete all Applications that shouldn't be there. They'll have wierd names like hkdirnmg; and will all be roughly the same size. BE VERY CAREFUL NOT TO DELETE ANY REQUIRED APPLICATIONS. ALSO DON'T ACCIDENTALLY OPEN ONE THE MALWARE APLLICATIONS OR YOU WILL HAVE TO RE-DO THE ABOVE AGAIN.

4. Delete all cookies and temporary internet files and reset home page.

5. Reboot - Should be gone without having to reformat.

This discussion is closed to new replies.