xenodor

I did a search for this here and on google, but didn't come up with anything.

I have a client that seems to have been hijacked. Called last night and brought his laptop down for me to clean up. It needed a LOT Of cleaning up... about 100 occurances of spyware, lots of temp files, etc.

However, that's not what prompted him to call. He uses msn.com as his home page. Which works like it should, but if you enter a url in the address bar that doesn't "exist", the browser is redirected to "http://search.xenodor.somethingorother" (I don't have the pc right in front of me right now.) instead of the typical MSN search page that comes up when a page is not found.

He said he did a little poking around and it seems the search site is related to Alexa.

I've run Spybot and removed all the spyware it found (about 100 cases). It relieved some things but not the xenodor search page above. I'm going to run the old AdAware, because it is noted to remove Alexa references.

Anyone seen this before and/or have any ideas?

Thanks!
wildlife

 

hi woodie....i also came up with nothing except the dorfs and dragons

but you might want to take a look at a similar thread.
http://forums.techguy.org/t112889/s.html

 

Wildlife, not woodie.. lol

Interesting....

What's gonna be the easiest way to track this bugger down? I've searched the registry for it and for Alexa and deleted any keys that mentioned either (there weren't any that mention xenodor)

Thanks for the reply, Steve

Wildlife

 

woodie guthrie................lol.....sorry.............ok,try this go here:
http://www.lurkhere.com/~nicefiles/
and download "startuplist" run,copy/paste the result here and lets see if anything shows in there.

ok wildlife

 

As your search has been hijacked look in your hosts file.

Navigate via

Windows 95/98/Me c:\windows\hosts

Windows NT/2000/XP Pro c:\winnt\system32\drivers\etc\hosts

Windows XP Home c:\windows\system32\drivers\etc\hosts

Delete the entries relating to msn search. If there are no entries relating to msn search then this is not the cause of your problem.

You can always back the entries up if you are uncomfortable doing this.

Default setting of hosts file is.....

127.0.0.1 localhost

 

Well I haven't run the startuplist yet...

I did run the old AdAware, and it found 1 key (Alexa) and another file that Spybot and I didn't find. I removed them and everything is back to normal. How bout that...

I would like to run startuplist to check to make sure there isn't anything else lurking in there... but I've done a major cleanup on this system now.. and everthing is just peachy....

Funny how them nasty hijackers can take over without much of a trace.

thanks for everyone's help...

wildlife