"Another" Computer Problem/Question (Trojan Resets Homepage)

HacheMan · Nov 16, 2004

I know these computer threads get old, but this freakin thing is driving me so nuts I'm about to wipe my whold drive out and reinstall everything. It's a trojan that keeps resetting my homepage and adding things to my favorites list. Nortan, ad-aware, or spybot won't touch it.........

michael777 · Nov 16, 2004

try the free scan at trendmicro.com

joel2002 · Nov 16, 2004

michael777 said:
try the free scan at trendmicro.com

it fixed my problem I had couple months ago

HacheMan · Nov 16, 2004

Thanks guys, I'll give it a shot..........

HacheMan · Nov 16, 2004

I have to ask though, did you have to rid of it manually?

michael777 · Nov 16, 2004

usually when i hit delete, it will remove it,sometimes have to do it manually

kenisdon4sp · Nov 16, 2004

Get the bug !!!

Hi,

<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com

ffice

ffice" /><o

> </o

>

Why don’t you try:

<o

> </o

>

<o

> </o

>

The Stinger is a specific designed tool from McAfee to remove Trojan and other bug, if this does not the trick try pestpatrol, just online from their website

<o

> </o

>

Good luck !:digit:

<o

> </o

>

Anonymous1 · Nov 16, 2004

thanks all...i have had the same problem with a machine on a network and the tech nerds used mac and spy...and it did not wipe it out...will give these idea's a shot...

Muddy · Nov 16, 2004

http://www.softwarepatch.com/tips/about-blank-adware.html

LEYKIS101 · Nov 16, 2004

Hache,

Any of those end up working for you? The http://vil.nai.com/stinger link doesnt work for me and I get an error when running the free scan at trend micro.
I think I have your problem, the about:blank page is now my homepage. I have Norton and just downloaded Adaware remover gold and had Adaware personal, but that page still comes up.

Any suggestions?

Muddy · Nov 16, 2004

I had this problem and fixed it manually using hijackthis

LEYKIS101 · Nov 16, 2004

NightHawk said:
I had this problem and fixed it manually using hijackthis

I guess I will have to try that one now.. $49, bring my total up to $108 today just to remove this crap.

Know of any free or cheaper solution Nighthawk?

Muddy · Nov 16, 2004

hijackthis was free, it should still be free

http://www.spychecker.com/program/hijackthis.html

LEYKIS101 · Nov 16, 2004

Thanks, I found the free one too.

Now I just have to figure which file it is causing the problem. I removed around 10, but the about:blank page is still coming up on my homepage. Any ideas?

LEYKIS101 · Nov 16, 2004

Thanks for you help Nighthawk. I picked some logical ones and it looks like it's back to MSN like it should be.

Thanks,

Here's to you ---:drink:

fathead · Nov 16, 2004

I have found Bazooka helpful. You have to manually remove the problem, though. It just tells you how.

http://www.download.com/Bazooka-Adware-and-Spyware-Scanner/3000-8022_4-10247783.html?tag=lst-0-1

Muddy · Nov 16, 2004

I did this about 7-8 weeks ago, you have to read the help/code file for hijackthis and see which ones you dont need and remove them.

Also, I just remembered there was another version of hijack this called hijackthis for browser add-ons.exe

If the first doesnt help download the second exe

You'll see these codes if you click on the info button

The different sections of hijacking possibilities have been separated into these groups:
R - Registry, StartPage/SearchPage changes
R0 - Changed registry value
R1 - Created registry value
R2 - Created registry key
R3 - Created extra registry value where only one should be
F - IniFiles, autoloading entries
F0 - Changed inifile value
F1 - Created inifile value
N - Netscape/Mozilla StartPage/SearchPage changes
N1 - Change in prefs.js of Netscape 4.x
N2 - Change in prefs.js of Netscape 6
N3 - Change in prefs.js of Netscape 7
N4 - Change in prefs.js of Mozilla
O - Other, several sections which represent:
O1 - Hijack of auto.search.msn.com with Hosts file
O2 - Enumeration of existing MSIE BHO's
O3 - Enumeration of existing MSIE toolbars
O4 - Enumeration of suspicious autoloading Registry entries
O5 - Blocking of loading Internet Options in Control Panel
O6 - Disabling of 'Internet Options' Main tab with Policies
O7 - Disabling of Regedit with Policies
O8 - Extra MSIE context menu items
O9 - Extra 'Tools' menuitems and buttons
O10 - Breaking of Internet access by New.Net or WebHancer
O11 - Extra options in MSIE 'Advanced' settings tab
O12 - MSIE plugins for file extensions or MIME types
O13 - Hijack of default URL prefixes
O14 - Changing of IERESET.INF
O15 - Trusted Zone Autoadd
O16 - Download Program Files item
O17 - Domain hijack
O18 - Enumeration of existing protocols
O19 - User stylesheet hijack

LEYKIS101 · Nov 16, 2004

Thanks for that one too Fathead.

The computer threads are needed; most of us here are gamblers/investors not computer geeks. I will never visit that porn site again...sheesh. :nono5:

fathead · Nov 16, 2004

If you will download the latest Spybot S&D (1.3) from their web site and use the "immunize" function, you can prevent a lot of these problems. Part of the immunizaton of Internet Explorer can include anti-hijacking if you wish. You will have to choose "advanced mode" from the menu at the top to access the immunization.

http://www.safer-networking.org/en/mirrors/index.html

Also, using a non-microsoft browser like Firefox or Opera can prevent a lot of this headache.

HacheMan · Nov 17, 2004

Thanks guys, appreciate all of the help & sites, the trendmicro found it for me. Took a little work in digging deep to rid of a few things, but it's not gone. Wouldn't you love to just get your hands around the neck of the guys putting out these out?!