Homepage hijack

whatnext · May 31, 2005

My IE homepage is being hajacked by the following site http://81.222.131.49/index.php. Each time I reset to my trusted google default it return to this unwanted page. I have run spyware, spybot, adware and nothing seems to resolve. Please help.

chaslang · May 31, 2005

Please follow the below steps:

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

whatnext · Jun 3, 2005

I have followed your reply with the following results

Could not access internet in safe mode with networking so ran Trend Micro's and Symantec in normal mode.

Trend Micro- not completely happy that it fully executed

Symantec listed two areas of danger; Hijack Exposure Check & Trojan Horse check.

Stinger- executed with no findings

CCleaner - executed

Adware with plugin- had trouble with pc freezing & rebooting. Ran Microsoft Spyware and it detected TIB Porn Dialer, Possible Browser Hijacker, People on Page. Removed and then run Adware and it executed this time.

Spybot executed with no findings and systyem immunised

Cw shredder Executed

Kill2 me executed

Buster & HSRemove executed.

When browsing I am still getting popup's which look like porn of some type and I have to run microsoft spyware each time I exit the internet to remove these. Again they are TIB porn Dialer & Possible browser Hijacker.

I have attached Hijackthis file.

chaslang · Jun 3, 2005

HJT logs must be from normal boot mode and you must install HJT as requested. You are running HJT directly from the ZIP file which is what we specifically request you not do.

Log in or Sign up

Homepage hijack

whatnext Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

whatnext Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member