http://scrk.com/passthrough/index.html? HELP !!!

[jbensous]

For some reason I get a toolbar at the bottom of my screen and my home page re-written every time I open my browser to this :

http://scrk.com/passthrough/index.html?http://www.yahoo.com/

I have tried cleaning my PC with Aware6, deleting temp files, cookies, and history. Looked for scrk in my registry with no luck. What is this and why can't i get it to go away?

It also rewrote the computer name on my PC to "dontmessmeup". I searched my hard drive and found one txt file. When I opened it the following text was written therein :

nc
840
scrk.com/
1024
337696512
29638353
518355616
29564954
*

The file name and location itself was ::

dontmessmeup@scrk[1].txt :: located in widows\TEMP\Cookies

There is no telling what else this thing is doing. But apparently it is not being detected by either Adware or by McAfee. There are also processes running I do not recognise, and my PC has been freezing a lot and I am getting a lot of GPFs lately. Could this be a virus? What should I do?

[Dani]

Seems a lot like a virus of some sort to me (even if it may not be a malicious one).

Have you ever tried Norton Antivirus? I've been told it seems to catch more than McAffee does. Also, you are using the latest virus definitions (updates), right?

[jbensous]

Yes, I am using the latest virus definitions. It does sound like a virus to me as well, and I know of one other person who has the same issue, but no one seems to know anything about how to get rid of it. *sigh*

I'm sure it is most likely the reason my computer is freezing and crashing all of the time, but I don't know how to go about finding it and deciphering exactly what it is doing and how to stop it.

If someone could help me with this I would be most grateful!!!!!

[vintage]

you could always try resetting the masterboot record.

[Dani]

What would redoing the mbr do?

[vintage]

a popular method of writing virii is to infect the master boot record or process's that the mbr controls. resetting the mbr can help for the process affected thus taking away new process or creating a new mbr using fdisk can stop the infection if it's at the mbr level. keeping a program in the mbr or those initial process will definately hide a program from view.

[Xelfinn]

Why don't you just go directly to Yahoo.com instead of that pass through site?

[TallCool1]

For some reason I get a toolbar at the bottom of my screen and my home page re-written every time I open my browser... What should I do?

It looks like a nasty browser hijacker, NOT a virus. Try SpyBot Search & Destroy instead of AdAware -- it works better. Download links are available from http://Security.Kolla.de, where you can also find an EXCELLENT forum where you can post this question.

As far as virus checkers go, I can't recommend Norton; it's too much of a resource hog. I use Grisoft AVG from http://www.Grisoft.com (free for personal use). AVG runs in the background like McAfee or Norton (but I like it better than either).

[vintage]

if it is spyware, or adware, it still has some components of virii. more than likely it's comprised of plymorphic code to regenerate upon deletion from the registry. search and destroy, ius a could program to combat the solution with though. it's pretty comprehensive on it's ability to detect modern adware.

[AuraAngel]

man i am plagued by the same problem. will try the solutions recommended.

[TallCool1]

man i am plagued by the same problem. will try the solutions recommended.

It turns out that this is one of the hijack sites used by Lop.com. Any spyware/adware killer that you use must be up-to-date, since Lop updates itself continuously to avoid deletion. It can be removed by Spybot Search & Destroy. Go to http://www.download.com and search for "spybot" to download. Be sure to get the updates before first scan. Also see http://Security.Kolla.de for more info on Spybot Search & Destroy.

[berlitz]

Hey, I have had the same problem with scrk and their toolbar. I found what seems to be a sort of temperary or maybe permanent fix. When i looked at my homepage settings i saw that it added "http://scrk.com/passthrough/index.html" to the begining of my homepage address no matter what page it was. So I just changed my home page settings to about:blank. It seems to prevent the bar from poping up. good luck