1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

xenodor

Discussion in 'Virus & Other Malware Removal' started by Wildlife, Jan 16, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. Wildlife

    Wildlife Thread Starter

    Joined:
    Aug 1, 2002
    Messages:
    53
    I did a search for this here and on google, but didn't come up with anything.

    I have a client that seems to have been hijacked. Called last night and brought his laptop down for me to clean up. It needed a LOT Of cleaning up... about 100 occurances of spyware, lots of temp files, etc.

    However, that's not what prompted him to call. He uses msn.com as his home page. Which works like it should, but if you enter a url in the address bar that doesn't "exist", the browser is redirected to "http://search.xenodor.somethingorother" (I don't have the pc right in front of me right now.) instead of the typical MSN search page that comes up when a page is not found.

    He said he did a little poking around and it seems the search site is related to Alexa.

    I've run Spybot and removed all the spyware it found (about 100 cases). It relieved some things but not the xenodor search page above. I'm going to run the old AdAware, because it is noted to remove Alexa references.

    Anyone seen this before and/or have any ideas?

    Thanks!
    wildlife
     
  2. $teve

    $teve

    Joined:
    Oct 9, 2001
    Messages:
    9,396
  3. Wildlife

    Wildlife Thread Starter

    Joined:
    Aug 1, 2002
    Messages:
    53
    Wildlife, not woodie.. lol

    Interesting....

    What's gonna be the easiest way to track this bugger down? I've searched the registry for it and for Alexa and deleted any keys that mentioned either (there weren't any that mention xenodor)

    Thanks for the reply, Steve

    Wildlife
     
  4. $teve

    $teve

    Joined:
    Oct 9, 2001
    Messages:
    9,396
    woodie guthrie................lol.....sorry.............ok,try this go here:
    http://www.lurkhere.com/~nicefiles/
    and download "startuplist" run,copy/paste the result here and lets see if anything shows in there.

    ok wildlife:D
     
  5. Top Banana

    Top Banana

    Joined:
    Nov 10, 2002
    Messages:
    1,344
    As your search has been hijacked look in your hosts file.

    Navigate via

    Windows 95/98/Me c:\windows\hosts

    Windows NT/2000/XP Pro c:\winnt\system32\drivers\etc\hosts

    Windows XP Home c:\windows\system32\drivers\etc\hosts

    Delete the entries relating to msn search. If there are no entries relating to msn search then this is not the cause of your problem.

    You can always back the entries up if you are uncomfortable doing this.

    Default setting of hosts file is.....

    127.0.0.1 localhost
     
  6. Wildlife

    Wildlife Thread Starter

    Joined:
    Aug 1, 2002
    Messages:
    53
    Well I haven't run the startuplist yet...

    I did run the old AdAware, and it found 1 key (Alexa) and another file that Spybot and I didn't find. I removed them and everything is back to normal. How bout that...

    I would like to run startuplist to check to make sure there isn't anything else lurking in there... but I've done a major cleanup on this system now.. and everthing is just peachy....

    Funny how them nasty hijackers can take over without much of a trace.

    thanks for everyone's help...

    wildlife
     
  7. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/113554

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice