Computer newbies forum: home page take over & "adult"/offensive pop ups

Dirtydust,

1. Do you have the latest Spybot (Vers. 1.3)? If not, go here to get it.

2. Spybot (or for that matter, Ad-Aware) doesn't always get all of these browser hijackers (that's what's bugging you) out. So, here's some additional stuff for you:

The Cleaner (free for 30 days)

CWShredder (freeware)

Hijack This! (free) NOTE: This app is very powerful and can easily foul everything up if you're not real careful. The link also includes detailed instructions for its use; READ THEM!

Then, wander over to the CNET Virus and Security Alerts Forum, especially if you have questions about Hijack This!

Hope this helps...

I find many times that running Spybot 1.3 (with latest updates) in Safe Mode will locate and remove additional Hijackers that aren't found when booted up in standard. For sure, with hijackers running (redirecting web sites) you must also run HiJackThis software and CAREFULLY remove embedded registry items to fully remove
Good luck
wyn

Susan,

One caveat for all of us that download something we think can be free, please READ the user agreement. Nothing is free, and most of these programs, like weatherbug for instance, do come with an ad or spyware program.

Bingo! In most cases, there really IS no such thing as a free lunch! Now, on to the issue at hand:

Yes, you have a Registry in need of a good scrubbing. A couple free (and scumware-free) programs I'd recommend are:

RegClean: Microsoft's now nonsupported (but still effective) Registry cleaner only does a part of the Registry, but it does work OK for what it does.

RegSeeker: It's fast, free and quite thorough - and I've never had a problem with it deleting something I later wished I had back. Just in case, though, the program does offer to backup the deletions; do so.

Also, Spybot S&D Version 1.3 does look for extraneous Registry entries, but I'd read the tutorial and get real comfortable before I'd rely heavily on it as a Registry app.

Hope this helps! Let us know what happens, OK?

Laslo's suggestion on the last post in this thread about running PC Pitstop is also excellent - and one I should have remembered...

i cant seem to fine the system configuration utility. i got as far as tools, all i got was Net Diagnostic, System Restore,File Signature Ver.,Direct X diagnostic tool, and Dr. Watson

Webroot spy sweeper has a feature when left on it will automatically convert the homepage back to the default page you determine...
its free!!!!!! and you can find it on cnet!!!!!!
good luck... and no more homepage hijackings.. i love it... Yaaaaaaaaaaaaaa.....

In Win98, go to Start/Programs/Accessories/System Tools/System Information, and then on the "Tools" menu select System Configuration Utility. You can also get there by going to Start/Run/msconfig. I have had excellent results avoiding spyware and home-page hijacking by using all of the following freeware: Spyware Blaster, Spyware Guard, Spybot Search & Destroy, and Zone Alarm. To solve frequent crashes (more than one per week), use Norton Disc Doctor and Win Doctor (both part of Norton Utilities). Good luck.

The easiest way to do this is to use system restore and restore your system to a date prior to the take over of your home page. This assumes you are using windows ME or XP.

I have use both ad-aware and spybot. I have installed the Google IE toolbar. You can download it at: http://toolbar.google.com/. This tool bar has a pretty effective popup blocker. The other thing I do is run spybot at least once a week, sometimes more often. The combination of these two has done the trick. I no longer get those annoying takeovers of my home page and haven't seen an unwanted popup for a long time. To date, Google has blocked 3,410 popups. Remember, Spybot is good, but you have to use it on a regular basis and in combination with a popup blocker. Hope this helps.

My homepage has been taken over by allneedsearch.com
And every time I delete them, the following links return to my favorites:
Youngest girls every day, Sex porn land..., Full collection dirty porno etc.
SPYBOT and popbusters as well as strict internet tool commands have managed to prevent these sites from opening, but NOTHING is able to efface their existence on my system.
WHAT DO I DO ?

I think u might have a virus. Basically I read a lot of articles about all these viruses that does that, I am quite sure this is not just an adware. Then again I cannot confirmed if its an adware then u have to find out what adware is that and u might have to remove it manually. U might want to start with scanning your pc or computer with your anti-virus software first and then if there is no virus then u have to find out what adware it is. U might have to go step by step as in follow the site where u have visited.

Your the victom of a browser hijacking varient
most likely of a of a cool web search variety
download a removal tool called CWShredder
a simple tool and very effective

http://www.spywareinfo.com/~merijn/downloads.html

-these instructions come from a few websites searched from google using the words "about blank trojan"

-b4 following these instructions TURN OFF system restore(or it will just return)

-this CWS variant hides in the registry and somehow Windows Regedit can't see it. Use reglite

1) Download reglite (http://www.resplendence.com/)

2) install "Reglite" and run it, enter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs into the address bar or scroll down to it.

3) Double click on AppInit_DLLs to open a "Data Editor" properties window, if the bottom textfield named "Value" contains a .dll file; then this is the hidden file you need to get rid off.

4) You should not be able to delete this file if you try to clear the value field, IMPORTANT: take note of the path and name of the .dll file. Write it down so you do not forget it.

5) Rename the Folder "Windows" (This is a purple "highlighted" folder in the left hand window) to NOTWINDOWS. Simply click on the folder, click on "Edit" in the menu bar and select "Rename".

6) Click AppInit_DLLs again and clear the value containing the .dll and ok it. This should have removed the .dll

7) Rename the windows folder back to its original name "Windows".

8) Run SpyBot, Ad-Aware and CWShredder to clean last bits away

now

make sure you can see all files folders and hidden operating system files (using folder options)

navigate to the offending .dll file that you carefully took note of in step 4.

now simply rename it.

now drag it onto your desktop

then into the recycle bin

and empty it way.

restart machine

an easy way to spot if it as gone is to download and install avg 6.0 from grisoft.com.be sure to update Initially Norton did not detect this! but I'm sure they will add it to their virus update

hope this helps.

Kudos to NexusUK in dslreports.com/forum for this fix

EDIT: It will come back every 24 hours after the original infection. so it might be a day b4 you see it come back if you rely on cwshredder thingy

You have a hijacked browser, these can be one hell of a chore to get rid of and the steps you will have to take will differ with every hijack. I would suggest getting a program called hijack this. It scans your registry and displays all of the relavent registry keys, then you look through the list and delete anything that looks suspicious. then open up internet properties and change the homepage and restart the computer. If you forget to change the home page before you open internet explorer again you run the risk of getting reinfected. Also, be careful with what you delete from the registry.

....any of the suggestions mentioned throughout this thread. At least it doesn't appear so. To get you started, please click on the links below and run the free online antivirus scans they provide:

Housecall Online Virus Scanner

Panda Online Virus Scanner

Next, please download, install, then update and run the free spyware removal tools listed below:

Ad-Aware 6 Spyware Removal Tool

Spybot Search & Destroy Spyware Removal Tool

On this next spyware removal tool, simply download it to your desktop from the link below, then double click on the file to run the scanner.

CWShredder Hijack Removal Tool


Hope this helps and let us know how it goes.

Grif