Homepage changing, constant popups, malicous advertisements

declan_tyson · Oct 28, 2005

I followed all the instructions in the read me first thread, but I am still having problems (this is with my father's computer not mine). Whenever I try and open Internet Explorer, instead of the blueyonder site which normally appears, I get a blank page which quickly refreshes to a site called "www.warningmessage.com" which tells me that I've been infected with spyware and it gives me links to some anti-spyware programs which I know are fake, like SpyTrooper. I've tried changing the homepage multiple times but nothing happens. Also, there are frequent popups on the computer, and when browsing, I cannot view certain pages due to the "warning message" site constantly intefering. I have included a HijackThis log, any help would be greatly appreciated.

Thanks in advance

chaslang · Oct 28, 2005

Download smitRem.exe and save the file to your desktop.

Double click on the file to extract it to it's own folder on the desktop.

Reboot into safe mode.

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please attach this log to your next reply.

declan_tyson · Oct 29, 2005

Here's the log, and it appears that the homepage changing and popups have stopped, is there anything else which I need to do?

chaslang · Oct 29, 2005

There were a few other minor items in your JT log I suggest fixing.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.co.uk/myway
R3 - Default URLSearchHook is missing
O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - C:\WINDOWS\system32\hpDACF.tmp <--- SmitRem may have already fixed this one
After clicking Fix, exit HJT.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

Log in or Sign up

Homepage changing, constant popups, malicous advertisements

declan_tyson Private E-2

Attached Files:

log.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

declan_tyson Private E-2

Attached Files:

smitfiles.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member