Homepage gets erased

[Ken]

When I start my computer, 9 out of 10 times the homepage is erased and
set to http:///. I have run AdAware with the latest refercne files,
SpyBot, and McAfee Virus Scan, and none of them find anything. I even
had SpyBot lock my homepage from being changed and it is still being
erased. Does anyone know what I can do to prevent this from
happening? Thanks in advance for any help.

-Ken

 

[H Leboeuf]

For some clues start here.
http://www.generation.net/~hleboeuf/iehome.htm

Look at the tool suggested on the page.


Interested in finding out if you have a new variant of a parasite.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

 

[Ken]

Thanks Henri, I havent gotten around to posting the results yet, but I
didn't find anything that looked suspicious to me. However, I did
find a program called zonavipbd.exe in my running processes. I
couldn't find any info on it online, but when I closed it and opened
it again, I got some wierd dialer program that was in some other
language. After opening it again, my homepage was erased, so I'm
figuring that that may be the problem. Thanks again.

-Ken

For some clues start here.
http://www.generation.net/~hleboeuf/iehome.htm

Look at the tool suggested on the page.


Interested in finding out if you have a new variant of a parasite.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

When I start my computer, 9 out of 10 times the homepage is erased and
set to http:///. I have run AdAware with the latest refercne files,
SpyBot, and McAfee Virus Scan, and none of them find anything. I even
had SpyBot lock my homepage from being changed and it is still being
erased. Does anyone know what I can do to prevent this from
happening? Thanks in advance for any help.

-Ken

 

[H Leboeuf]

This parasite will create an 8 lette filename.

FreeScratchAndWin http://www.doxdesk.com/parasite/FreeScratchAndWin.html
Files: IdleUI.dll, runpool.dll, fswinst.ocx, support.exe, random
eight-letter filenames in the System folder ( Ex: bprplgqf.exe )
Ref: xzoomy.com, free-scratch-cards.com, freescratchandwin.com
Variants: Beta, v5, v6, FSW, FSC, CPM Media Folder: 'FSW' folder
inside 'Program Files'. Block: HOSTS file.

Thanks Henri, I havent gotten around to posting the results yet, but I
didn't find anything that looked suspicious to me. However, I did
find a program called zonavipbd.exe in my running processes. I
couldn't find any info on it online, but when I closed it and opened
it again, I got some wierd dialer program that was in some other
language. After opening it again, my homepage was erased, so I'm
figuring that that may be the problem. Thanks again.

-Ken

"H Leboeuf" <[email protected]> wrote in message

For some clues start here.
http://www.generation.net/~hleboeuf/iehome.htm

Look at the tool suggested on the page.


Interested in finding out if you have a new variant of a parasite.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

When I start my computer, 9 out of 10 times the homepage is erased and
set to http:///. I have run AdAware with the latest refercne files,
SpyBot, and McAfee Virus Scan, and none of them find anything. I even
had SpyBot lock my homepage from being changed and it is still being
erased. Does anyone know what I can do to prevent this from
happening? Thanks in advance for any help.

-Ken