Ok, after getting a zillion IE windows/pages of crap opening up on my laptop 3 days ago, I believe I finally got it clean. These pages added directories, programs, files, dialers, etc to my pc and registry. When I first got all this adware/spyware(and I just learned alot about this in the past couple of days), I removed most of what I knew was a problem from my pc and registry. This included things like ISTsvc, ClearSearch, GlobalDialer, slotch.com, xrenoder.com and studsss.da.ru, to name most. I thought I had it fixed, and was doing fine on the Internet last night for about 5 minutes when it started acting up again.
So, I just installed both Ad-aware and Spybot(Spybot found a few things ad-aware did not) and thought that did the trick and it did take care of 99% of my problem but when I would open my IE my homepage kept coming up as studsss.da.ru. I removed all the statements in the registry(start page, search page, things like that) that included this url but after rebooting my pc IE kept doing the same thing and the url would show back up in the registry. I finally found a file called sys.reg, edited it and found it contained this url. Appearently, when the pc gets rebooted, the registry grabs this sys.reg file and adds back into itself. I moved sys.reg and another file that had today's date on it, called winlog.html, from the root directory to another directory I created called CRAP, rebooted my pc and it came up with a registry error looking for the sys.reg file and an IE winmain.exe error which I was sure had something to do with that winlog file. I found the winmain.exe file(with today's date on it) in my WINNT directory and moved that to CRAP as well. I also went into the registry and removed all the statements containing sys.reg and winmain.exe and my pc is now acting fine.
Sorry for being so long-winded but hope this helps with these phantom urls and what I am now calling crapware! One last thing, I'd say backup your registry before editing it but it's probably already messed up if you're reading this. So, be careful in there...
Here's a url about winmain.exe:
http://www.nsclean.com/psc-htas.html and one about sys.reg:
http://www.itsecurity.com/asktecs/aug3903.htm
