annoying url

[ajmmac]

hi everyone--my pc seems to have been invaded by an annoying url--it is "http://windowsupdate.com" --it is not an actual site but rather attaches itself to genuine urls--so for example if i click on to my desktop shortcut to google it throws up instead a page for some sort of search site--search for anything despite fact the web address bar actual the google site--often the same occurs when i click on other links--it is not always that search page--sometimes it is other pages but there seems no logical pattern--i have run spybot-adaware-and my antivirus s/w--i am searched the registry to no avail--i have historykill which deletes all my cookies--i should add no matter what page it throws up it is always the correct url i have asked for in the address bar--i have also tried to restore my system to an earlier date--tried about 10 different valid   restore points but in each case the machine says it cannot restore to that point--don't know if the 2 are connected--nothing has worked--it does not seem to be a serious invasion cos i can always eventually get the site i want but it is a real damn nuisance--anybody any ideas--all advice welcome thanks

[PatTheRat]

Tricky. U seem to know what you're doing regarding spyware, anti-virus etc. If you click on internet explorer does it bring up your normal homepage? Are all your spyware, anti-virus things up-to-date? This one might be so simple that suggesting it may be stupid, but have you checked: tools>internet otions>homepage?? Just to see if your homepage has been changed?

Im no expert, but normally these kind of things always seem to happen to me also.

[palfreyman18]

I think whats happening there is that, everytime that there is a new windows update installed or installing on your computer then it sets the homepage to windowsupdate.com. Its not spyware or adware or anything: ive had windows update set as my homepage automatically many times where it's installed new updates and i dont have spyware or any viruses on my computer.

[ajmmac]

thanks pattherat and palfreyman--first pat--i never use internet explore icon--i have broadband an permanently connected--out of interest tho i just tried it and it brought up the rogue page i mentioned--all my s/w is fully up to date and my home page has not been changed--even tho this rogue page comes up the address bar still shows i am on my correct home--in other words what it shows in the address bar does not correspond with this rogue 'search all' page--hope that also answers u too palfreyman--and my home page has never been changed after an update--i have many yrs of experience in pcs-in fact(red faced) i install-maintain-upgrade-build and troubleshoot them but never seen this problem b4--thank u both for ur contributions--i'll keep working on it

[meta]

Have you tried running hijackthis?

This sometimes will show up something that is hijacking your system that other adware/spyware cleaners will miss.  Download an up-to-date copy and then visit a special hijackthis forum (Lavasoft have one > http://www.lavasoftsupport.com/index.php?showforum=44 ).

 

Hopefully this will find something that shouldn't be there.

[ajmmac]

hi meta thanks for ur suggestion--so far i have downloaded an up to date version of hijackthis and had a look at the lavasoft forum and read its recommended procedure--it gave a link to a site to d/l a version of adaware different from mine--i did this as a 1st step and ran it--altho i had updated my copy of adaware this version was different--it found more than 50 infections that neither my adaware nor spybot had found--i have acted on this and will wait a few days to see if the problem has been solved--so far (after 2 hrs) the signs are good-- i'll keep ppl posted--many thanks to everyone--arthur

[rinkytink]

 

Is it anything to do with this ??

 

http://www.sophos.com/virusinfo/articles/windowsupdate.html

[palfreyman18]

Thats a very good point rinkytink. it says that the update site for windows update is windowsupdate.microsoft.com. But, according to the article, the Blaster Worm is windowsupdate.com. So i reckon it is the Worm and it needs removing. Try AVG virus scan, HijackThis, Ad-Aware SE professional, Spyware Blaster or any other free Spyware/Worm/Virus Removal utilities.

[Wraith]

Check your Add/Remove program and check for a program called 'DeskAdSevices'.

If it's there remove it and then run AdAware and SpyBot again from Safe Mode.

 

If it is this one I had a job removing it from a works computer yesterday. I only noticed it because I looked at what tasks were running in the background and found DeskAdServ and DeskAdKeep. Whenever I ended one task the other one started it again. In the end I Googled for info and found out what I've just described.

 

Hope this helps.

[ajmmac]

thank you all for ur contributions--i seem to have got rid of problem now but not sure it was any one procedure that did it--rather a combination of the various suggestions--i think the removal of some browser hijack infections and something preventing me restore to an earlier checkpoint  using adaware did the trick--thank u all again for all ur help--your all tops