Damn spyware nightmares - Help please

[minendo]

My dad calls yesterday because he somehow screwed up my mom's computer and needs me to fix it before she gets home. (She is up here visiting my sister and me.) Well, in order to fix it I have been VNCing in, but I can't seem to find what took over.

Basically it hijacks internet explorer and redirects it to some Homepage. Even if I reset the homepage to google.com, it defaults back to this Homepage. Once that pages loads you can browse the web again, but there are some issues. I browse to google.com and run a search. The results are all advertisements and not the actual results returned by google as verified by using firefox to run the search.

I have run Spybot S&D as well as Adaware 6 with no luck. Have any ideas?

 

[pelikan]

Here.

 

[BlueWeasel]

To what homepage is it redirecting?

 

[minendo]

Originally posted by: BlueWeasel
To what homepage is it redirecting?

http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D
%00@%77%77%77%2e%65%2d%66%69%6e%64%65%72%2e%63%63/%68%70/

The link no longer works since I got rid of whatever it was pointing to, but it keeps updating IE's homepage to that link.

 

[simms]

I think it's probably CWS (CoolWebSearch). You're gonna need CWShredder.. and some other things found on the link above. Schedosser or whatever his name is should get so many :beer: for helping us all out.

Keep the system clean afterward by installing Spyware Blaster. OMG i just found out about it, it's great. 🙂

 

[Schadenfroh]

post your hijackthis log after you have complete the instructions in the removal guide in my sig, instructions on what to post in your hijackthis log is also in my sig