Need techie help for a possessed PC

All of a sudden my PC is directing me to the Yahoo Mail homepage when I click on the shortcut for Gmail, Hotmail and even CPF.

I don't have Yahoo on my PC and have never used it. Looking at IE, everything looks OK. I've checked for new viruses and used Ad Aware but everything checks out.

How do I fix this?

Hi, Marty!

Just assume /ubbthreads/images/graemlins/stupid.gif before reading ...

My guess is you have been gifted with a drive-by browser helper. Typically, that crappy kind of software changes browser behavior ... although I'm not familiar with one that points to Yahoo.

You can always right-click on each shortcut to make sure the URL is correct ... and fix it if necessary; but, if a browser helper is running on your system, those shortcuts will probably just revert to their current state after a little while.

If you don't already have it, you should seriously consider downloading, installing and running Uncle Bill's AntiSpyware product from: MS AntiSpyware home page It's not the best on the market, but does a pretty good job and it's free for the time-being.

If this doesn't solve your problem, you may want to check out HijackThis! from Merijin downloads and then visit their help forum. Be advised, the software programs at Merijin.org are powerful. Use them with care.

Good luck!

Search your windows directory for a file called "hosts" and delete it.

Don't delete your hosts file. The hosts file is a ascii text file, and can be edited. Take a look at it with notepad, and see if some entries have been made to point where it shouldn't. If so, delete those lines.

I found 3 hosts files.

- hosts
- hosts.bak
- lmhosts.sam

All of them are in C:\windows\system32\drivers

Should I still look at them?

Yes. The hosts.bak file may be your original. No need to look at lmhosts.sam

The 'hosts' file doesn't have a file extension. Don't add one if you make changes and save the file.

It's the hosts file with no extensions that you want.

This is the only entry you need in the file:
127.0.0.1 localhost

There are a bunch of "comments" in there that can be ignored. Those are lines that start with the pound sign, and are harmless.

Most hosts files have nothing else, and nothing else is needed. If you have other entries that don't start with 127.0.0.1, I'd be suspicious.

I agree that Microsoft's Antispyware beta seems to be a good thing. I use it. As always on my machine, it finds nothing, although it runs each night at 2am. Also it seems that Spywareblaster is good. I use that too.

You can see what browser helpers are installed by clicking on Tools > Manage add-ons. Knowing which ones are good and which are bad would take some research.

The "hosts" file was empty. It appears to be a sample HOSTS file used by MS TCP/IP for Windows and looks innocuous.

I haven't had the Yahoo problem in the last hour and all of the shortcuts look OK. The problem may have been transitory (I hope).

I agree, it's actually better to just edit the hosts file than delete it. It IS the hosts file with no file extension. Open it with notepad and edit out any uncommented lines that don't point to 127.0.0.1 (your local machine's loopback address).

sounds like you had a transitory DNS problem

Found the problem.

Somehow the Yahoo Toolbar was added to my browser. I deleted it and things are A-OK.

Thanks for everyone's help.

My suggestion is run Lavasoft Adaware, Spybot Search and destroy and do an online spyware scanner like the one in www.spywareinfo.com online scanner.

Get Spywareblaster installed, get Highjackthis and load Spyads database, do a search with this terms.

Install a firewall, Kerio, ZoneAlarm, or Norton Internet Security.

Knock on wood, but I never, ever gotten any crapware or virus on my machines.

HTH
AlexGT

what AlexGT said