IE-5/win 98 Browser adware virus?

[johnwa]

Somehow, I picked-up some kind of "adware" browser virus. From what I can see, it updates the IE default homepage so that it displays a page with advertising links at browser startup. I tried to update the homepage via the tools function, but it only lasts for the duration of the browser session; in other words, at the next startup, it goes back to the advertising page.

I have since run an adware/spyware program that identified several bad files that I have since removed. I have also cleared my cookies and temp internet files. With no positive result. I've reloaded windows; restarted IE, and it still displays the advertising links page at startup.

I also lookied for any files that may have been loaded to my PC on that date, and nothing falls out.

So I'm trying to figure out where it's picking up that bogus homepage url at startup. Is anyone out there familiar enough with the internals of IE to know where they may have possibly changed my default homepage?

Thanks very much.

[snowmaker]

Do a Google search on 'Browser Helper Objects'. BHO's, like a telephone, can be real useful, until a scum-sucking marketing agency starts using them..

[YvetteKuhns]

http://www.wilderssecurity.net/bhblaster.html

You may want to try this. Your computer registry was edited, but please be careful when trying to edit your registry. Make a backup if you are not sure.

[Barry]

Thought I'd chime in too. I've got this on my XP system - the home page has been change to nkvd.us, another search listing. Thanks Yvette, I'm looking at the link you gave. Gets real tiring to clean things out and the darn page keeps coming back.

[(jj)]

Check out CWshredder and BHOdemon HERE (http://www.spywareinfo.com/downloads.php).

[johnwa]

Once again, thank you all very much for your input.

Update: I ran the bhodemon and it identified a moduled called gfjai.dll.
The bhodemon gives you the option to disable the offending module, but that did not help. So I simply renamed the gfjai.ddl to something else, and it cleared up the problem. Just for future reference, I'm still trying to figure out who is loading the gfjai.dll in the first place. It must be defined somewhere so it gets loaded.

[YvetteKuhns]

Try Norton Systemworks WinDoctor registry scan if you have it, Spybot freeware or another registry editor.

[(jj)]

Just remember, before you do ANYTHING in your registry, to back it up FIRST.