My b/f looked at a Thai website (www.upseed.com) that has a slightly 'unsavoury' picture on it's homepage and now the website keeps reappearing as the homepage every time the computer is turned on. If the computer stays on and internet is closed and opened again, it retains the new homepage that I've set (e.g. yahoo) but it doesn't retain the settings when shut down and turned back on.

I've tried blocking the website using internet options - content - content advisor and have deleted the history, cookies and temp internet files but it still keeps coming back. What else can I try to permanently block it, or to stop it setting itself as my homepage?

thanks for any help.

Id try running a spyware checker against your PC and possibly a virus checker also.

I had similar problems a long time ago, it turned out to be spyware.

Good luck, let us know how you get on!

It's a very common exploit used... go to any malicious site using IE (and IE is the most vulernable) and you'll automatically get infected. You need to either run a anti-spyware program or manually remove the virus.

If your boyfriend likes to go to porn sites (and porn sites are the main users of these exploits), make him use an alternative browser like Firefox or Opera.

If you are running a genuine copy of windows you can download windows defender (http://www.microsoft.com/athome/security/spyware/software/default.mspx) which is a spyware scanning and removal tool. It will also do real time scanning, and will alert you if a website is trying to alter your IE settings, like your default homepage.

WideWheels.

Spyware removal tool. Might have to run it in safe mode to be completely rid of the basta*d.

Hi,

Its sounds like you may have had your browser hijacked.

You may be able to remove the Hijacker with a program called HijackThis. The start page is usually one of the R1/R0 entries.

http://www.safer-networking.org/en/download/

... is a great free utility to get rid of crap on your system. I've not used it for a long time though because I have excellent sucurity software so I'd be interested to hear comments about it's recent performance.

I agree with all the other posters... You're level of security is clearly very low. You should take action to correct it.

Thanks for all your suggestions - I've tried them all but to no avail. Don't have a real version of Windows so couldn't download Windows defender, downloaded Spybot that TRM suggested and that found and fixed some problems, but didn't seem to find this one. Tried HijackThis which picked up the problem but when I went to fix it, Spybot denied access. Uninstalled Spybot and tried HijackThis again - appeared to work but when I restarted the computer the website was back again as the homepage! Ughh! Very frustrating. I think I will need to take it into a computer shop and see if they can fix it. Does anyone have some suggestions for what I can ask the fix-it man to do to my computer to improve the security?

There's likely some file, in addition to the R0/R1 entries that's resetting the Homepage on reboot. This file may show up in the HijackThis Log. It may be worth Googling each entry in the HijackThis log to see which are malware entries and which are legitimate Windows entries.

Thanks - I'll give that a go tomorrow. It did come up saying to be careful about fixing them in case they are legitimate entries which is why I only ticked the R0 one. Don't know enough about computers to play around with things I'm not sure of.

Sylvafern - run the spyware removal tools in Safe Mode - some of the nasties pop back up if you don't do this.

In addition to what britmaveric said, ensure all browser windows are closed when deleting with HijackThis.

Sylvia:

Here is a very good guide on browser hijacking.

http://www.pcstats.com/articleview.cfm?articleID=1579

and here is the Microsoft page:

http://www.microsoft.com/athome/security/o..._hijacking.mspx

If you're not too sure about computers, you can post your problem on:-

http://forums.spywareinfo.com/

and one of their experts will talk you through a fix.

Scouse.

If you're not too sure about computers, you can post your problem on:-

http://forums.spywareinfo.com/

and one of their experts will talk you through a fix.

Scouse.

I agree..

I've used www.bleepingcomputer.com who got my problem solved quickly

You will need to post the Hijackthis log and they will tell you what to do, step by step

totster

Edited May 13, 200620 yr by Totster

If you know the date that your PC was infected, try doing a SYSTEM RESTORE to the date just PRIOR to the infection. SYSTEM RESTORE is found in START>PROGRAMS>ACCESSORIES>SYSTEM TOOLS>SYSTEM RESTORE. If you use SYSTEM RESTORE, the programs and applications you loaded since the restore date will be removed as well and will need to be reinstalled again. Email, saved files, etc will not be affected.

I had a similar trojan that got picked up by a number of spyware & trojan removal programs but none of them could delete it perminantly.

In the end I got rid of it using ewido - you can download a 14 day free trial version at http://www.ewido.net/en/download/

As said before, you might need to run it in safe mode to be sure. Good luck!!

If all else fails on the Spyware removal stuff, try a virus removal tool...

Dont take it to a shop for fixing, you will get charged for something we can work out here (for free.. well a chang or two)