MY home page keeps changing to search for........

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Perfectlawncare, Aug 8, 2004.

  1. Perfectlawncare

    Perfectlawncare Private E-2

    I have spybot and adware 6.0 i have run both of them and still cannot fix this problem. Can anyone help me out??? Thanks

    I have attached a picture of the website that it keeps changing to.
     

    Attached Files:

  2. Perfectlawncare

    Perfectlawncare Private E-2

    I downloaded "hijack this" here is what the log file says

    [REMOVED]
     
  3. Kodo

    Kodo SNATCHSQUATCH

  4. Perfectlawncare

    Perfectlawncare Private E-2

    It Says
     

    Attached Files:

  5. Perfectlawncare

    Perfectlawncare Private E-2

    Can someone help me out because i cannot check my email until i get this fixed because when i go to hotmail and enter my password in and click enter my mailbox comes up and then the searchfor page pops up in its place everytime. Thanks
     
  6. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    Two suggestions.

    Easiest one; Download About:Buster. Run it in safe mode. Twice. At least.

    Try Chaslangs tutorial here: http://forums.majorgeeks.com/showthread.php?t=38772

    Your primary problem is thelines that look like this: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Owner\LOCALS~1\Temp\sp.html

    Try one or both of those steps. Then remove those before using Internet Explorer again. Thats important, close IE when starting and keep it closed.
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    A couple of other comments:
    1) You have HijackThis running from a temp directory (or out of the ZIP file):
    C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 2 for Hijackthis.zip\HijackThis.exe

    Don't do that! Get HijackThis into its own directory. For example, you can make a directory called c:\Program Files\HJT and put the HijackThis.exe file in that directory.

    2) In addition to a variation of the About:Blank hijack, you possibly have a peper trojan or another unknown trojan. Make sure you run these:
    - http://www.memorywatcher.com/uninst.exe
    - http://housecall.trendmicro.com/housecall/start_corp.asp <--- select Auto Clean
    - http://www.pandasoftware.com/activescan/com/activescan_principal.htm

    After that we can continuing working on the About:Blank problem if About:Buster did not fix it. I think this may be one of the forms that About:Buster had problems with (at least previous versions did). We may have to use FINDnFIX (we'll get to that later).
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds