Re: Unwanted Homepages

anonymous_at_discussions.microsoft.com
Date: 04/17/04 

Date: Sat, 17 Apr 2004 03:59:24 -0700

Well I downloaded adware spybot and now HiJackThis and
scanned my system I saved the log and went to the site
that you suggested "http://computercops.biz/forums.html"
and created an account but when I try to post a new
message on any topic on the board it bounces me back out
to the login. So I have no idea what to do with this log
file now. I checked to make sure I was logged in several
ways it says I have an account and I received my email and
password it also says its a valid password.. if I put it
in correctly though it just stays on the same page asking
for my login/pass, and if I put it in incorrectly the top
of the applet says incorrect login/pass and bounces me
back to the same place. I don't know if there is someplace
else I can have someone help me with these logs but I
can't seem to beable to post at the other site.

>-----Original Message-----
>Hi,
>Go to:
http://www.mvps.org/winhelp2002/unwanted.htm#HijackThis!
>Download "Hijack This!" [freeware]
>
>Unzip, double-click "HijackThis.exe" and Press "Scan".
>
>When the scan is finished, the "Scan" button will change
into a "Save Log"
>button.
>Click: "Save Log" (generates: "hijackthis.log")
>
>Next, go to the below location:
>http://computercops.biz/forums.html
>
>Sign in, go to the "Spyware and Hijackware Removal"
section.
>Press "New Topic", copy and paste hijackthis.log into
your new message.
>
>Post back with the URL where you posted if you want help
with your log.
>__________________________________________________________
__
>Mike Burgess [MVP Windows Shell\User]
http://www.mvps.org/winhelp2002/
>Blocking Spyware, Adware, Parasites, Hijackers, Trojans,
with a HOSTS file
>http://www.mvps.org/winhelp2002/hosts.htm [updated 04-15-
04]
>Please post replies to this Newsgroup, email address is
invalid
>--
>
><anonymous@discussions.microsoft.com> wrote in message
>news:030801c42451$6171b7d0$a101280a@phx.gbl...
>>
>> >-----Original Message-----
>> >"Slim" <slimwhitman@ahotmail.com> wrote in message
>> >news:1d4ba01c4237a$dd706750$a301280a@phx.gbl
>> >> Recently I was misdirected to an unwanted page and
now
>> >> that page is stuck as my home page. If I change the
>> >> homepage it changes itself back next time I open a
page.
>> >> I've deleted my cookies and cleared my temp files
but I
>> >> can't find whats doing this. I'm running XP and IE6.0
>> any
>> >> help on this would be great thanks.
>> >
>> >First eliminate any scumware.
>> >See
>> >Dealing with Unwanted Malware, Parasites, Toolbars and
>> Search Engines
>> >http://mvps.org/winhelp2002/unwanted.htm
>> >especially
>> >http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch
>> >
>> >Note that AdAware and SpyBot S & D will each catch some
>> things the other
>> >won't. Also, each needs to be updated with the
program's
>> update function
>> >before every use, even when just downloaded. There's
>> also a lot more to do
>> >than just those two programs. CWShredder is also
>> available here:
>> >http://www.kellys-korner-
xp.com/regs_edits/cwshredder.zip
>> >**Post your HijackThis log to
>> >http://forums.spywareinfo.com/ or the Spyware forum at
>> >http://forum.aumha.org/ for expert analysis, not
here.**
>> >Alternative download pages for Ad-Aware, Spybot,
>> HijackThis and CWShredder
>> >may be found on this page:
>> >http://aumha.org/a/parasite.htm.
>> >If trying everything at that site does not fix the
>> problem please post back
>> >in the same thread.
>> >
>> >--
>> >Frank Saunders, MS-MVP, IE/OE
>> >Please respond in Newsgroup. Do not send email
>> >http://www.fjsmjs.com
>> >Protect your PC
>> >http://www.microsoft.com/security/protect/
>> >
>> >
>> >.
>> >Well I downloaded the Spybot program and I've done alot
>> of reading.. I'm kinda new to all this and I'm trying to
>> catch up.. when I ran spybot it found a bunch of
varrious
>> things that were flagged I had it fix them but it won't
>> get rid of 2 of them.. they seem to be what my problem
is
>> because every time I load my browser its still sending
me
>> to some porno search page. and when I looked around on
the
>> page it mentioned the same directory and suggests
>> downloading an executable file to get rid of them as my
>> home page. I figured that was a bad idea and came back
>> here. anyway here are the ones spybot found but can't
seem
>> to get rid of... even if it fixes them they are there if
>> you rescan.
>> Common hijacker: Prefix change (Registry change, nothing
>> done)
>>
>>
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio
>> n\URL\Prefixes\www=http://
>>
>> Common hijacker: Prefix change (Registry change, nothing
>> done)
>>
>>
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio
>> n\URL\DefaultPrefix\=http://
>>
>> Any help you can give to get rid of this would be
awesome.
>
>
>.
>