Offensive site pops up automatically?

I have a problem that when I restart... "Start, Shut
Down, Restart" my computer
it will always automatically dial the internet and log on
to one of 2 sites.
Sometimes it goes to a "foreclosure.com" but most of the
time it goes to
"sexfiles.com" then the address in Internet Explorer
changes to
"http://194.237.110.170/content/"

I have run Spybot S&D and AdAware both are up to date and
neither have found
anything, I am at a loss as to how to fix this, I am about
to format the HDD
and start from scaratch. I need to get this to stop before
it happens when
the grand kids are at the computer or when we are using it
to demmo EPPS, Help
system and Website work?


HELP, Bill

P.S.
The kid does visit "fetish and punk rock sites" but swears
non are x-rated,
I have been to a few foreclosure site

Bill,

Your PC appears to have been hijacked by a commercial parasite, possibly a
variant of CoolWebSearch although it could be an entirely new parasite as I
find few references to either sexfiles.com or foreclosure.com on the net
relating to malware.

When did you last check your system for malware using your preferred antivirus
application making sure first that you are using an updated current set of
viral reference signatures? If you haven't yet managed to install an
antivirus application the download and use Stinger
(http://vil.nai.com/vil/stinger/) and perhaps also F-Prot which will allow you
to scan your system from DOS (http://www.f-prot.com/products/home_use/dos/).

I note that you have already used AdAware and SpyBot (did you remembner to
update them first?) This would be a good time to download yourself a copy of
the free BHODemon (http://www.definitivesolutions.com/bhodemon.htm that checks
for
unwanted Browser Help Objects and SpywareBlaster
(http://www.wilderssecurity.net/spywareblaster.html) which can help prevent
some parasites getting a grip on your PC.

Then there is CWShredder
http://www.spywareinfo.com/~merijn/files/cwshredder.zip which is the best way
of getting rid of the many forms of the CoolWebSearch hijacker details of
which can be found at http://www.spywareinfo.com/~merijn/cwschronicles.html
and also http://www.pestpatrol.com/pestinfo/c/cws.asp..

Finally if you still continue to experience problems download a copy of
HijackThis from (http://www.spywareinfo.com/~merijn/downloads.html). Create a
folder called HJT on C: and copy the file you downloaded to that folder. Close
as many applications as you can including all instances of Internet Explorer.
Enable Explorer to see all files and fodlers (Tools | Folder Options | View
and check "Show hidden files and folders" and uncheck "Hide protected
operating system files") and then run hijackthis.exe and post back the log to
either the HijackThis Forum at http://forums.spywareinfo.com/ or alternatively
http://forum.aumha.org/viewforum.php?f=30 and hopefully this will enable
someone to identify the cause of your problem.

See also: Dealing with Unwanted Malware, Parasites, Toolbars and
Search Engines http://mvps.org/winhelp2002/unwanted.htm and also Browser
Hijacking http://www.spywareinfo.com/articles/hijacked/
--
Mike Maltby



Bill Rigsby wrote:

I have a problem that when I restart... "Start, Shut
Down, Restart" my computer
it will always automatically dial the internet and log on
to one of 2 sites.
Sometimes it goes to a "foreclosure.com" but most of the
time it goes to
"sexfiles.com" then the address in Internet Explorer
changes to
"http://194.237.110.170/content/"

I have run Spybot S&D and AdAware both are up to date and
neither have found
anything, I am at a loss as to how to fix this, I am about
to format the HDD
and start from scaratch. I need to get this to stop before
it happens when
the grand kids are at the computer or when we are using it
to demmo EPPS, Help
system and Website work?


HELP, Bill

P.S.
The kid does visit "fetish and punk rock sites" but swears
non are x-rated,
I have been to a few foreclosure site

-----Original Message-----


I have a problem that when I restart... "Start, Shut
Down, Restart" my computer
it will always automatically dial the internet and log on
to one of 2 sites.
Sometimes it goes to a "foreclosure.com" but most of the
time it goes to
"sexfiles.com" then the address in Internet Explorer
changes to
"http://194.237.110.170/content/"

I have run Spybot S&D and AdAware both are up to date and
neither have found
anything, I am at a loss as to how to fix this, I am
about
to format the HDD
and start from scaratch. I need to get this to stop
before
it happens when
the grand kids are at the computer or when we are using
it
to demmo EPPS, Help
system and Website work?


HELP, Bill

P.S.
The kid does visit "fetish and punk rock sites" but
swears
non are x-rated,
I have been to a few foreclosure site
.I had this problem and it was a virus which my scan did
not pick up, I downloaded Ad Aware free and it done the
job, good luck