New Clsid

[srfox]

This morning going to: http://www.baxbex.com/ or in updating RoboForm (I don't know which caused it) to update a window popup to update Yahoo to set as search page and supposedly to install messenger came up. This was a very graphical box window. I didn't get a snapshop. Sorry. Well it look legit, but after selecting it, it disabled Spyware blasters restore and host safes. It also removed my browser buttons for RoboForms. I have Spyware Guard installed as well. It put an extra bar in browser but with nothing next to it. I had to use system restore to get back to the way my system was. Neither Spyware guard or Spyware blaster detected this.
Then lo and behold after system restore I again had the backups for spyware blaster but the many host safe files that I created were gone.

[Gareth]

Umm, Looks like another job for Javacool,

you should get the CLSID from Downloaded objects but Javacool will sort it.

Here is some info: http://forums.techguy.org/t143678/sab1c8d31f55e7d8d16c7a18bb25f1ce0.html

Was it robo forms?

Umm, Claims to be no spyware, sure it it.

[javacool]

When you say it disabled SpywareBlaster's restore, do you mean that all of your created Restore Snapshots disappeared? It certainly wouldn't surprise me, but any details on the problems you encountered would be very helpful.

(I haven't found this yet, but I will keep trying.)

Best regards,

-Javacool

[srfox]

Yes all of the snapshots disappeared and when I did an XP restore they came back. Don't think it was robohelp. I have a licensed copy and I've been very happy with it. I had to reinstall it, so it's not them. Possibably someone temporily riding on a site on temp hack. The thing is it looked so authentic. There was another Yahoo hoax last month that came in peoples email. Said something about dump file. I didn't fall for that one, but a lot of people did. It redirected people to go to a site that looked exactly like Yahoo.
I have a file I've created to email out with my recommendations of software for spys, trojans, hacks, etc. It includes spyware blaster, spyware Guard Spybot and some files from GRC. Anybody wants a copy just let me know. All is freeware for most part.

[Pieter_Arntz]

{QUOTE-> quoting: srfox link=board=34;threadid=11730;start=0#msg75868 date=1059193605]
It redirected people to go to a site that looked exactly like Yahoo.
<-QUOTE}

Hi srfox,

I have recently seen two yahoo related hijacks.
One of them adds a dll to your winsock LSP
You can find some solutions here: http://www.spywareinfo.com/forums/index.php?act=ST&f=11&t=8519&s=3c5a3e41983bc34205215ec6aef33c99
If you have an installer for that one, I would appreciate it if you could mail it to the address in my profile.

Regards,

Pieter

[srfox]

Don't think I've got it but let me check, ahh, here's a screen capture of dump message.