IE6 redirect problem

Hey guys, I am having a problem with my IE6 that is really annoying me and I cant seem to find a fix for.

While surfing the web with IE6 I keep getting redirected to
"http://209.47.15.67/int/set?type=120-600" which is basicly a popup for amazon.com or a few other online retailers. This happens about every 3 pages I visit and I cant figure out where or how to get rid of it.
Somehow I picked up this hack and I cant find any info online to get rid of it. Tried Microsoft last night for about an hour before I finally gave up becouse I couldnt search without this page poping up..

Hopefully someone may be able to help me!!!!

Did you try Ad Aware and/or Spybot search & destroy?

You may also want to download a copy of RegClean. That will parse through your registry for stuff that is not needed and cleans it out. It does find some spyware stuff. but Ad-Aware and or Spybot should be used first.

Yes tried Ad Aware and Registry mechanic last night. Didnt help :( Ill dl spybot and see if it picks anything up ad aware didnt..

Had a similar problem. Ad-aware never caught it. On Abb's advice I tried Spybot, it caught it and fixed it.

Well I just ran all 3 (adaware, spybot, and registry mechanic) again, and spybot did pick up a few things adaware didnt but problem still continues!

This one has me stumped

Try running windoctor part of the Norton System Works cd. If you need it let me know I will give you access to my ftp so you can d/l it.

Just sent you a PM Gunny, Thanks.. Ill try anything right now... this is driving me nutz

Hmm... My problem was more specifically with Google. Whenever I'd run a google search on anything, I kept getting what looked like good links, but would instead end up routed to some 3rd party search website - it was very frustrating and at first I thought that the problem was on Google's end. I eventually did solve this problem, I think it was spybot that corrected this. I can't help but wonder if perhaps it was also fixed by deleting cookings and all off-line content under internet options as well. I'm assuming you've already run a recently updated virus scanner.

ya updated and ran nortan virus scan last night, nothing.. deleted all offline files and temp files. cleared cookies, which sucks couse now i have to remember a bunch of logins and passwords lol.

Nothing has worked so far :(

Fight Club,

I read this in MaximumPC today. I'm not sure if it's what you have or not, but I thought I would post it.

Someone wrote in about their IE6 getting hijacked and going to Hugesearch.net search engine.

They answered:

We received a whole lot of e-mail about Hugesearch.net this month. An easy to get rid of it is by running Cool Web Shredder, but what if you can't even get to a page to download Cool Web Shredder? Either download the program from an uninfected computer, and then transport it to the afflicted computer on a floppy, or get the app from this month's Maximum CD. (Sorry.. I threw it out already or I would have uploaded it for you). Cool Web Shredder is available at
www.merijn.org/files/cwshredder.zip.

Note: That link doesn't seem to be working for me but you might want to try a google search for the file.

Try this page to download from.

Google for "HijackThis". Find it. Run it.

Thank Hylander, I did download and try but it came back with 0 problems.
This one is a good one..

The Wraith thanks for the info... I downloaded it and explaind my problem on there forums at http://www.spywareinfo.com/forums/in...T&f=30&t=34570

Hopefully they reply with a fix. Looks like a great site with a lot of Knowledgeable people.

Please let this work.. Ill post to let you know...

Eh hem...

I hope that if you went there looking for their help you didn't tell them they were "nolagable". I can't even imagine the onslaught of belittling it would bring.

By the way, I looked at your log and your system is as filthy as a Mexican prostitute. You DO realize you even have a trojan Key Logger application running, right? Everything you type is being recorded and sent (somewhere). Usernames/passwords... Unless you want to become a victim of identity theft, if you've done any online banking or purchased anything online - you might want to start changing PINs, cancelling credit cards, resetting passwords, the works.

ALL these entries in your log are bad:
----------------------------------------------------------
C:\Program Files\PopUp Killer\PopUpKiller.EXE
C:\KeyLogV1-1_source_code\KeyLog.exe
C:\Program Files\CPUCooL\CooLSrv.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = http=localhost:8000;https=www.aws-i.com:2121
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost

O2 - BHO: (no name) - {37FBF6EA-BBFA-C7DA-B09F-EB7EDA71608C} - C:\WINDOWS\system32\buvxhpny.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {BCF96FB4-5F1B-497B-AECC-910304A55011} - C:\WINDOWS\hhU.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &AdultFriendFinder ToolBar - {C51C0E2A-3040-4740-9C14-155758225807} - C:\PROGRA~1\AFFTB\AFFTB.dll

O4 - HKLM\..\Run: [PopUpKiller] C:\Program Files\PopUp Killer\PopUpKiller.EXE
O4 - HKLM\..\Run: [KeyLogRegEntry] "C:\KeyLogV1-1_source_code\KeyLog.exe" -ah-ah
O4 - HKLM\..\Run: [] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [The site you have requested doesn't ex] c:\WINDOWS\System32\The site you have requested doesn't exist.
O4 - HKLM\..\Run: [The associated domain name has probably been reserved by a client ] c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKCU\..\Run: [StartGuard] C:\Program Files\Interapple\@Start\StartGuard.exe
O4 - HKCU\..\Run: [The site you have requested doesn't ex] c:\WINDOWS\System32\The site you have requested doesn't exist.
O4 - HKCU\..\Run: [] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [The associated domain name has probably been reserved by a client ] c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
----------------------------------------------------------


NOTE: Your browser is proxied. If www.aws-i.com isn't your ISP or a proxy you've configured, all your web traffic is being logged there. Personally, you system has so much spyware/malware on it you might want to reformat. You even have the "Hungry Hands" crap:

http://www.pestpatrol.com/PestInfo/h/hungryhands.asp

Quote:

---

Hijacker: Any software that resets your browser's settings to point to other sites. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower. Homepage Hijackers will change your home page to some other site. Error Hijackers will display a new error page when a requested URL is not found.

---

You need to be more careful what program you download and run in the future.

And start running Firefox. There are way too many holes in IE.

Firefox is teh a$$

Though firefox may not be compatible with everything out there... so I wouldn't be 100% dependent on it.

I don't like the way bookmarks are handled, sometimes the menus get "stuck" or are downright laggy. It just isn't polished. And then there are the compatibility issues. Whole sections of my moveable type blog interface don't show up when using Firefox.

If IE would implement tabs it would be the perfect solution.

Safari is still the best browser, IMO.

Firefox may have a few anomalies but it's still a great browser. Super fast. User friendly. And most importantly secure.

Occasionally I'll have a problem with a website not disaplying properly (more than likely due to the not coding to standards) and I then load up Exploder to view it.

I'm happy with it and the price was right.

Fight Club,

If you do happen to need any help with ID theft situations, prevention of or handling after the fact, let me know. I hope that isn't the case though!

firefox strictly adheres to w3c standards, so the majority of improper page rendering is usually fault of the webmaster. i'm not saying firefox has its problems, but i'd say blame should be placed elsewhere for improper rendering. bless internet explorer's "superior" rendering and support for obsolete code for making webmasters dumber.

there's a lot of plug-ins and extensions for mozilla. it's now my default browser, but once in a while i'll still have to fire up internet explorer. i can tell mozilla to open internet explorer in the same page with this extension.

i also use proxomitron in my daily browsing, so filtering out annoying gimmicks like pop-up banners and sound effects are a cinch.

I could care less what standards it adheres to...if it doesn't display pages properly and some other browser does, then that other browser will eventually be the one I use more often.

I'm happy that you're happy. Use whatever you want.

I use Firefox myself as my "primary" browser, but I still use IE as a few places I visit don't work 100% with Firefox. For example, the quick formatting buttons in Movable Type do not show up for me in Firefox, so I use IE for that.

I agree with squidly about the bookmarks... they are clumsy at best. How I do love tabbed browing though!!

If IE had tabbed browsing, I'd never even think of using another browser.

Squid check this out then. MYIE

I downloaded it and I am trying it now... seems pretty sweet! I'm going to beat this around for awhile and see if I can break it. It handles/renders Moveable Type's management page well.

I've used MYIE. It's pretty good, but I prefer Firefox.

MYIE seems a lot deeper. I like the concept of groups, the favorites are handled a ton better, and it seems to render pages. More testing will take place, though.

I like how favorites work in Firefox. I put the sites I constantly look at (three of them) in a folder, then open them all in tabs at the same time. You can even set it up such that all your favorite sites are opened simultaneously when you launch the browser.

How does the security features of MyIE stack up? I have to agree with Squigly, this thing's pretty cool!

I'm using the avant browser overlay for IE. Just wondering how it stacks up with the other's listed above..? I like avant for the auto pop up blocker with the tabbed windows (that are remebered if they are open when you close the progie to reopen those pages when you restart the browser.) But I haven't had any experiance with the others, so if anyone's used avant as well and care to comment that'd be spiffy.

I just want to thank everyone who helped out here... Looks like I got it fixed thanks to The Wraith.

The Wraith, There was allot of stuff there that I actually use that shouldn’t be deleted but I believe what did fix it was checking O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe

I think that was the problem.
Got rid of a few other thing also which seems to help my startup also so that program worked great. Thanks...


C:\Program Files\PopUp Killer\PopUpKiller.EXE
C:\KeyLogV1-1_source_code\KeyLog.exe
C:\Program Files\CPUCooL\CooLSrv.exe

As for the keylogger, yes I installed it and it is client only. I double checked my firewall access to make sure it has never sent out and its fine.
popupkiller is a client popup blocker I use and works great.
CPU cool is a monitoring program that came with my ASUS motherboard.
As for the "www.aws-i.com" that was a proxy server I tried out for a few.. Yes I set that up..

Quote:

---

Originally posted by [AK]Hylander
Fight Club,

If you do happen to need any help with ID theft situations, prevention of or handling after the fact, let me know. I hope that isn't the case though!

---

Thank you very much Hylander, That hasn’t been the case yet but I thank you for the offer and its good to know in case something like that did ever happen…

Thank you again everyone for your help!!!

How do we know you're the real FiGHT*CLuB?

;)

You may not want to answer this, but I'm curious, why are you running a key logger on your own computer?

Quote:

---

Originally posted by [AK?]Clay
You may not want to answer this, but I'm curious, why are you running a key logger on your own computer?

---

I had the same thought. But, I suppose people spy on their significant others all the time.