xenodor

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Wildlife

Thread Starter
Joined
Aug 1, 2002
Messages
53
I did a search for this here and on google, but didn't come up with anything.

I have a client that seems to have been hijacked. Called last night and brought his laptop down for me to clean up. It needed a LOT Of cleaning up... about 100 occurances of spyware, lots of temp files, etc.

However, that's not what prompted him to call. He uses msn.com as his home page. Which works like it should, but if you enter a url in the address bar that doesn't "exist", the browser is redirected to "http://search.xenodor.somethingorother" (I don't have the pc right in front of me right now.) instead of the typical MSN search page that comes up when a page is not found.

He said he did a little poking around and it seems the search site is related to Alexa.

I've run Spybot and removed all the spyware it found (about 100 cases). It relieved some things but not the xenodor search page above. I'm going to run the old AdAware, because it is noted to remove Alexa references.

Anyone seen this before and/or have any ideas?

Thanks!
wildlife
 

Wildlife

Thread Starter
Joined
Aug 1, 2002
Messages
53
Wildlife, not woodie.. lol

Interesting....

What's gonna be the easiest way to track this bugger down? I've searched the registry for it and for Alexa and deleted any keys that mentioned either (there weren't any that mention xenodor)

Thanks for the reply, Steve

Wildlife
 
Joined
Nov 10, 2002
Messages
1,344
As your search has been hijacked look in your hosts file.

Navigate via

Windows 95/98/Me c:\windows\hosts

Windows NT/2000/XP Pro c:\winnt\system32\drivers\etc\hosts

Windows XP Home c:\windows\system32\drivers\etc\hosts

Delete the entries relating to msn search. If there are no entries relating to msn search then this is not the cause of your problem.

You can always back the entries up if you are uncomfortable doing this.

Default setting of hosts file is.....

127.0.0.1 localhost
 

Wildlife

Thread Starter
Joined
Aug 1, 2002
Messages
53
Well I haven't run the startuplist yet...

I did run the old AdAware, and it found 1 key (Alexa) and another file that Spybot and I didn't find. I removed them and everything is back to normal. How bout that...

I would like to run startuplist to check to make sure there isn't anything else lurking in there... but I've done a major cleanup on this system now.. and everthing is just peachy....

Funny how them nasty hijackers can take over without much of a trace.

thanks for everyone's help...

wildlife
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top