sylvafern Posted May 9, 2006 Share Posted May 9, 2006 My b/f looked at a Thai website (www.upseed.com) that has a slightly 'unsavoury' picture on it's homepage and now the website keeps reappearing as the homepage every time the computer is turned on. If the computer stays on and internet is closed and opened again, it retains the new homepage that I've set (e.g. yahoo) but it doesn't retain the settings when shut down and turned back on. I've tried blocking the website using internet options - content - content advisor and have deleted the history, cookies and temp internet files but it still keeps coming back. What else can I try to permanently block it, or to stop it setting itself as my homepage? thanks for any help. Link to comment Share on other sites More sharing options...
Wolfie Posted May 9, 2006 Share Posted May 9, 2006 Id try running a spyware checker against your PC and possibly a virus checker also. I had similar problems a long time ago, it turned out to be spyware. Good luck, let us know how you get on! Link to comment Share on other sites More sharing options...
Firefoxx Posted May 9, 2006 Share Posted May 9, 2006 It's a very common exploit used... go to any malicious site using IE (and IE is the most vulernable) and you'll automatically get infected. You need to either run a anti-spyware program or manually remove the virus. If your boyfriend likes to go to porn sites (and porn sites are the main users of these exploits), make him use an alternative browser like Firefox or Opera. Link to comment Share on other sites More sharing options...
WideWheels Posted May 9, 2006 Share Posted May 9, 2006 If you are running a genuine copy of windows you can download windows defender (http://www.microsoft.com/athome/security/spyware/software/default.mspx) which is a spyware scanning and removal tool. It will also do real time scanning, and will alert you if a website is trying to alter your IE settings, like your default homepage. WideWheels. Link to comment Share on other sites More sharing options...
britmaveric Posted May 9, 2006 Share Posted May 9, 2006 Spyware removal tool. Might have to run it in safe mode to be completely rid of the basta*d. Link to comment Share on other sites More sharing options...
katana Posted May 9, 2006 Share Posted May 9, 2006 Hi, Its sounds like you may have had your browser hijacked. You may be able to remove the Hijacker with a program called HijackThis. The start page is usually one of the R1/R0 entries. Link to comment Share on other sites More sharing options...
The Real Mandrake Posted May 9, 2006 Share Posted May 9, 2006 http://www.safer-networking.org/en/download/ ... is a great free utility to get rid of crap on your system. I've not used it for a long time though because I have excellent sucurity software so I'd be interested to hear comments about it's recent performance. I agree with all the other posters... You're level of security is clearly very low. You should take action to correct it. Link to comment Share on other sites More sharing options...
sylvafern Posted May 12, 2006 Author Share Posted May 12, 2006 Thanks for all your suggestions - I've tried them all but to no avail. Don't have a real version of Windows so couldn't download Windows defender, downloaded Spybot that TRM suggested and that found and fixed some problems, but didn't seem to find this one. Tried HijackThis which picked up the problem but when I went to fix it, Spybot denied access. Uninstalled Spybot and tried HijackThis again - appeared to work but when I restarted the computer the website was back again as the homepage! Ughh! Very frustrating. I think I will need to take it into a computer shop and see if they can fix it. Does anyone have some suggestions for what I can ask the fix-it man to do to my computer to improve the security? Link to comment Share on other sites More sharing options...
katana Posted May 12, 2006 Share Posted May 12, 2006 There's likely some file, in addition to the R0/R1 entries that's resetting the Homepage on reboot. This file may show up in the HijackThis Log. It may be worth Googling each entry in the HijackThis log to see which are malware entries and which are legitimate Windows entries. Link to comment Share on other sites More sharing options...
sylvafern Posted May 12, 2006 Author Share Posted May 12, 2006 Thanks - I'll give that a go tomorrow. It did come up saying to be careful about fixing them in case they are legitimate entries which is why I only ticked the R0 one. Don't know enough about computers to play around with things I'm not sure of. Link to comment Share on other sites More sharing options...
britmaveric Posted May 12, 2006 Share Posted May 12, 2006 Sylvafern - run the spyware removal tools in Safe Mode - some of the nasties pop back up if you don't do this. Link to comment Share on other sites More sharing options...
katana Posted May 12, 2006 Share Posted May 12, 2006 In addition to what britmaveric said, ensure all browser windows are closed when deleting with HijackThis. Link to comment Share on other sites More sharing options...
zoltannyc Posted May 12, 2006 Share Posted May 12, 2006 Sylvia: Here is a very good guide on browser hijacking. http://www.pcstats.com/articleview.cfm?articleID=1579 and here is the Microsoft page: http://www.microsoft.com/athome/security/o..._hijacking.mspx Link to comment Share on other sites More sharing options...
the scouser Posted May 12, 2006 Share Posted May 12, 2006 If you're not too sure about computers, you can post your problem on:- http://forums.spywareinfo.com/ and one of their experts will talk you through a fix. Scouse. Link to comment Share on other sites More sharing options...
Totster Posted May 13, 2006 Share Posted May 13, 2006 (edited) If you're not too sure about computers, you can post your problem on:-http://forums.spywareinfo.com/ and one of their experts will talk you through a fix. Scouse. I agree.. I've used www.bleepingcomputer.com who got my problem solved quickly You will need to post the Hijackthis log and they will tell you what to do, step by step totster Edited May 13, 2006 by Totster Link to comment Share on other sites More sharing options...
Rice_King Posted May 13, 2006 Share Posted May 13, 2006 If you know the date that your PC was infected, try doing a SYSTEM RESTORE to the date just PRIOR to the infection. SYSTEM RESTORE is found in START>PROGRAMS>ACCESSORIES>SYSTEM TOOLS>SYSTEM RESTORE. If you use SYSTEM RESTORE, the programs and applications you loaded since the restore date will be removed as well and will need to be reinstalled again. Email, saved files, etc will not be affected. Link to comment Share on other sites More sharing options...
kebabman7 Posted May 16, 2006 Share Posted May 16, 2006 I had a similar trojan that got picked up by a number of spyware & trojan removal programs but none of them could delete it perminantly. In the end I got rid of it using ewido - you can download a 14 day free trial version at http://www.ewido.net/en/download/ As said before, you might need to run it in safe mode to be sure. Good luck!! Link to comment Share on other sites More sharing options...
Wolfie Posted May 16, 2006 Share Posted May 16, 2006 If all else fails on the Spyware removal stuff, try a virus removal tool... Dont take it to a shop for fixing, you will get charged for something we can work out here (for free.. well a chang or two) Link to comment Share on other sites More sharing options...
.png.3b3332cc2256ad0edbc2fe9404feeef0.png)
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now