IE6 redirect problem

[[AK]FiGHT*CLuB]

Hey guys, I am having a problem with my IE6 that is really annoying me and I cant seem to find a fix for.

While surfing the web with IE6 I keep getting redirected to
"http://209.47.15.67/int/set?type=120-600" which is basicly a popup for amazon.com or a few other online retailers. This happens about every 3 pages I visit and I cant figure out where or how to get rid of it.
Somehow I picked up this hack and I cant find any info online to get rid of it. Tried Microsoft last night for about an hour before I finally gave up becouse I couldnt search without this page poping up..

Hopefully someone may be able to help me!!!!

[[AK]Squidly]

Did you try Ad Aware and/or Spybot search & destroy?

[[AK]StitchJones]

You may also want to download a copy of RegClean. That will parse through your registry for stuff that is not needed and cleans it out. It does find some spyware stuff. but Ad-Aware and or Spybot should be used first.

[[AK]FiGHT*CLuB]

Yes tried Ad Aware and Registry mechanic last night. Didnt help Ill dl spybot and see if it picks anything up ad aware didnt..

[[AK]Clay]

Had a similar problem. Ad-aware never caught it. On Abb's advice I tried Spybot, it caught it and fixed it.

[[AK]FiGHT*CLuB]

Well I just ran all 3 (adaware, spybot, and registry mechanic) again, and spybot did pick up a few things adaware didnt but problem still continues!

This one has me stumped

[[AK]Gunny Highway]

Try running windoctor part of the Norton System Works cd. If you need it let me know I will give you access to my ftp so you can d/l it.

[[AK]FiGHT*CLuB]

Just sent you a PM Gunny, Thanks.. Ill try anything right now... this is driving me nutz

[[AK]Clay]

Hmm... My problem was more specifically with Google. Whenever I'd run a google search on anything, I kept getting what looked like good links, but would instead end up routed to some 3rd party search website - it was very frustrating and at first I thought that the problem was on Google's end. I eventually did solve this problem, I think it was spybot that corrected this. I can't help but wonder if perhaps it was also fixed by deleting cookings and all off-line content under internet options as well. I'm assuming you've already run a recently updated virus scanner.

[[AK]FiGHT*CLuB]

ya updated and ran nortan virus scan last night, nothing.. deleted all offline files and temp files. cleared cookies, which sucks couse now i have to remember a bunch of logins and passwords lol.

Nothing has worked so far

[[AK]Hylander]

Fight Club,

I read this in MaximumPC today. I'm not sure if it's what you have or not, but I thought I would post it.

Someone wrote in about their IE6 getting hijacked and going to Hugesearch.net search engine.

They answered:

We received a whole lot of e-mail about Hugesearch.net this month. An easy to get rid of it is by running Cool Web Shredder, but what if you can't even get to a page to download Cool Web Shredder? Either download the program from an uninfected computer, and then transport it to the afflicted computer on a floppy, or get the app from this month's Maximum CD. (Sorry.. I threw it out already or I would have uploaded it for you). Cool Web Shredder is available at
www.merijn.org/files/cwshredder.zip.

Note: That link doesn't seem to be working for me but you might want to try a google search for the file.

Try this page to download from.

[The Wraith]

Google for "HijackThis". Find it. Run it.

[[AK]FiGHT*CLuB]

Thank Hylander, I did download and try but it came back with 0 problems.
This one is a good one..

The Wraith thanks for the info... I downloaded it and explaind my problem on there forums at http://www.spywareinfo.com/forums/in...T&f=30&t=34570

Hopefully they reply with a fix. Looks like a great site with a lot of Knowledgeable people.

Please let this work.. Ill post to let you know...

[The Wraith]

Eh hem...

I hope that if you went there looking for their help you didn't tell them they were "nolagable". I can't even imagine the onslaught of belittling it would bring.

By the way, I looked at your log and your system is as filthy as a Mexican prostitute. You DO realize you even have a trojan Key Logger application running, right? Everything you type is being recorded and sent (somewhere). Usernames/passwords... Unless you want to become a victim of identity theft, if you've done any online banking or purchased anything online - you might want to start changing PINs, cancelling credit cards, resetting passwords, the works.

ALL these entries in your log are bad:
----------------------------------------------------------
C:\Program Files\PopUp Killer\PopUpKiller.EXE
C:\KeyLogV1-1_source_code\KeyLog.exe
C:\Program Files\CPUCooL\CooLSrv.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = http=localhost:8000;https=www.aws-i.com:2121
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost

O2 - BHO: (no name) - {37FBF6EA-BBFA-C7DA-B09F-EB7EDA71608C} - C:\WINDOWS\system32\buvxhpny.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {BCF96FB4-5F1B-497B-AECC-910304A55011} - C:\WINDOWS\hhU.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &AdultFriendFinder ToolBar - {C51C0E2A-3040-4740-9C14-155758225807} - C:\PROGRA~1\AFFTB\AFFTB.dll

O4 - HKLM\..\Run: [PopUpKiller] C:\Program Files\PopUp Killer\PopUpKiller.EXE
O4 - HKLM\..\Run: [KeyLogRegEntry] "C:\KeyLogV1-1_source_code\KeyLog.exe" -ah-ah
O4 - HKLM\..\Run: [] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [The site you have requested doesn't ex] c:\WINDOWS\System32\The site you have requested doesn't exist.
O4 - HKLM\..\Run: [The associated domain name has probably been reserved by a client ] c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKCU\..\Run: [StartGuard] C:\Program Files\Interapple\@Start\StartGuard.exe
O4 - HKCU\..\Run: [The site you have requested doesn't ex] c:\WINDOWS\System32\The site you have requested doesn't exist.
O4 - HKCU\..\Run: [] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [The associated domain name has probably been reserved by a client ] c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
----------------------------------------------------------


NOTE: Your browser is proxied. If www.aws-i.com isn't your ISP or a proxy you've configured, all your web traffic is being logged there. Personally, you system has so much spyware/malware on it you might want to reformat. You even have the "Hungry Hands" crap:

http://www.pestpatrol.com/PestInfo/h/hungryhands.asp

Hijacker: Any software that resets your browser's settings to point to other sites. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower. Homepage Hijackers will change your home page to some other site. Error Hijackers will display a new error page when a requested URL is not found.

You need to be more careful what program you download and run in the future.

[[AK]Bribo]

And start running Firefox. There are way too many holes in IE.