Home page I can't remove

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

pH - 19 Sep 2004 16:43 GMT

Hi:

For some reason, I get a search site as my home page and
also their toolbar, which I cannot seem to remove. I
scanned my disk and it cannot seemed to find any spyware.

How can I remove this and get my browser to use the home
page I specify?

Thanks!

Reply to this Message

Sandi - Microsoft MVP - 20 Sep 2004 13:25 GMT

Your browser has been hijacked by malware. Please follow the troubleshooting
instructions at the URL below:
http://inetexplorer.mvps.org/data/tshoot.htm

Signature

_______________________________________
Hyperlinks used to ensure advice is current
Sandi - Microsoft MVP since 1999 (IE/OE)
http://inetexplorer.mvps.org

> Hi:
>
[quoted text clipped - 6 lines]
>
> Thanks!

Reply to this Message

pH - 21 Sep 2004 20:06 GMT

Hi. I tried what the page on this link shows, and things
have gotten worse.

First, stupid me: I ran the procedures on the page in
reverse order.

Second stupid me: I did not save the second one to my
computer.

Now, when i open the browser, it tries to open a page
called cannotfind.net (I think, I'm not there now,
obviously). Also, I use Hotmail through my Outlook
Express and it can't seem to make an internet connection.

Any suggestions?

Thanks
pH

>-----Original Message-----
>Your browser has been hijacked by malware. Please follow the troubleshooting
[quoted text clipped - 13 lines]
>
>.

Reply to this Message

PA Bear - 22 Sep 2004 05:59 GMT

More detailed:

Dealing with Trojans & Hijackware

A. Trojans

1. Check in at Windows Update and install all critical updates & reboot.

2. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

3. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow *all* Removal steps, including editing the Registry if directed.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then:

Disk Cleanup > More options > Delete all but the most recent Restore
Point.

B. Hijackware

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder v1.59.1 (no updates available currently; fix all found)

2. Ad-Aware SE (reconfigure per Post #2 in
http://aumha.org/forum/viewtopic.php?t=5877; fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You must seek updates for Ad-Aware, Spybot, etc., before each and
every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://forum.aumha.org/downloads/hijackthis.zip) is the preferred tool to
use. It will help you to both identify and remove any hijackware/spyware.
**Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957

Signature

~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

Are You Ready for WinXP SP2?
http://www.microsoft.com/athome/security/protect/default.aspx

WinXP SP2 Release Notes
http://support.microsoft.com/default.aspx?scid=kb;en-us;835935

AumHa Forums
http://forum.aumha.org

> Hi. I tried what the page on this link shows, and things
> have gotten worse.
[quoted text clipped - 37 lines]
>>
>> .

Reply to this Message

pH - 22 Sep 2004 20:17 GMT

Thanks for all this info.

I can't seem to access my browser at all. (it tries to
open cannotfind.net to no avail). Any way I can get this
stuff or fix my computer without having access to a
browser on that machine?

>-----Original Message-----
>More detailed:
[quoted text clipped - 8 lines]
>
>3. Update your virus definitions, enable Show Hidden Files

(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/
2002092715262339)

>and then run a full system scan in Safe Mode

(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/
2001052409420406)

>with nothing else running in background. Note the files identified and
>removed then find the corresponding page for the file at your AV maker's
[quoted text clipped - 86 lines]
>
>.

Reply to this Message

PA Bear - 23 Sep 2004 08:06 GMT

You can download all those tools on another machine and save them to, say,
CD or a thumb drive which you can then use on the problem machine, pH.

I suggest also printing out a copy of my post for reference.

Signature

~PA Bear

> Thanks for all this info.
>
[quoted text clipped - 130 lines]
>>
>> .

Reply to this Message

joeserhal - 22 Feb 2005 10:45 GMT

Hi there,
I'm using IE 5.0 on my PC, and I'm facig the same problems:
My Norton Antivirus detected a virus (Trojan Horse) called Trojan.StartPage.
It tried to delete the infected ".dll" file, but a windows pops up saying it
could finf the file... And when I open IE, my homepage is set to
"about:blank" and another IE pops up.

If I download IE 6.0 with SP1, does it solve my problem??

> More detailed:
>
[quoted text clipped - 98 lines]
> >>
> >> .

Reply to this Message

PA Bear - 22 Feb 2005 21:38 GMT

No.

Signature

~Robear Dyer (PA Bear)
MS MVP-Windows (Shell, IE/OE) & Security

> Hi there,
> I'm using IE 5.0 on my PC, and I'm facig the same problems:
[quoted text clipped - 126 lines]
>>>>
>>>> .

Reply to this Message

Jon Kennedy - 22 Feb 2005 21:52 GMT

No, your problem will not be solved by installing IE 6. The trojan will
remain on your system. If NAV cannot clean Trojan.StartPage on its own,
here are the manual removal instructions.
http://securityresponse.symantec.com/avcenter/venc/data/trojan.startpage.html
There are several variants of this trojan out there - the instructions above
are for the original version. The others will be identified by NAV as
Trojan.StartPage.X where "X" is a letter.

Signature

Jon R. Kennedy
Charlotte, NC, USA
jkennedy2@carolina.rr.com

> Hi there,
> I'm using IE 5.0 on my PC, and I'm facig the same problems:
[quoted text clipped - 6 lines]
>
> If I download IE 6.0 with SP1, does it solve my problem??

Reply to this Message

Mark - 07 Oct 2004 13:25 GMT

I went thru this same thing too, the home page was "Iwantsearch.com"
something like that.
I got sick of it, a free spyware scan detected 90 adware pieces ! So I went
to www.netscape.com and got Netscape 7.2 free, and never had the problem
again. I now remember there was a reason I hated IE. NS even allows you to
import IE Favorites, it finds the folder for you and makes it part of the
bookmarks. I will never go back to IE since its full of spyware crap. NS
even blocks popups ! Now that is what I call a superior program.

> Hi:
>
[quoted text clipped - 6 lines]
>
> Thanks!

Reply to this Message