Unwanted Web Site

[Jon_Dear]

I just left an old friend (81) where I was trying to get his Win XP computer
working properly. Somehow, a malicious program has taken charge of his
Internet Explorer, and every time he tries to get on the internet, he is
sent to a Porn site. The only way we could get out of this was to click
Ctl-Al-Del and bring up Task manager. His home page was Yahoo. When I click
on Tools/Internet Options/General/. the address in the home page box reads
"C:\Windows\System32\IESP.MHT. I looked in Exporer and located the
file.After I got home, I checked my XP computer and there is no such file
name in the folder.On his computer I typed in the Home Page Box the address
for Yahoo, clicked on apply, and it took a long time to change the home page
address. However, after closing the tools dialog box, and reopening it, we
were right back where we started.Anyone have any experience in something
like this? Does anyone have the above file in their Windows/System32 Folder?
I am tempted to go to System Restore and go back 30 days to restore the
system as it used to be.
Any help will be appreciated.

Jon

P.S. Has anyone tried Google popup blocker?

 

[Jupiter Jones [MVP]]

Jon;
You could also try System Restore.
If you use System Restore and that resolves the issue, be sure to
remove corrupted data from system Restore files:
Turn off/on System Restore to delete corrupted files:
Start/All Programs/Accessories/System Tools/System Restore.
Click System Restore Settings on left side.
Check "Turn off System Restore", click OK, follow prompts and reboot.
This deletes ALL Restore Points including corruption.

Follow the steps in yellow on this link:
http://www3.telus.net/dandemar/slowcom.htm

 

[Michael D. Alligood]

You can try downloading Spybot and Ad-aware, but honestly I do not think it
will fix all the problem. Pest Patrol is excellent and normally detects and
deletes pretty much everything. If you feel comfortable with the instruction
below, it will rid your friends PC of IESP.MHT

1. Shutdown Internet-Explorer, go to your Taskmanager and kill all processes
named IEXPLORE.EXE
2. Delete this Files:
C:\WINDOWS\system32\IEsp.mht
C:\WINDOWS\system32\msadocm32.dll
C:\WINDOWS\system32\sqlpool.dll

3. Change the Following Registry-Key to "about:blank" (without quotes)
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

4. Run regedit.exe and delete the following Registry Keys,or Run Hijackthis
and Scan and fix ONLY these entries if they exist:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
285}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
285}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
285}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
285}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
285}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{0B519E07-7824-4adc-8890-93D5EABBF285}
or execute
reg.exe delete
HKLM\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF285}

5. Delete the Value {0B519E07-7824-4adc-8890-93D5EABBF285} from
HKEY_CLASSES_ROOT\ADODB.Comand\CLSID\


--
Best of luck!

Michael D. Alligood
MCSA, MCP, CCNA, A+,
Network+, i-Net+, CIW A, CIW CI

 

[Miss Perspicacia Tick]

You can try downloading Spybot and Ad-aware, but honestly I do not
think it will fix all the problem. Pest Patrol is excellent and
normally detects and deletes pretty much everything. If you feel
comfortable with the instruction below, it will rid your friends PC
of IESP.MHT

1. Shutdown Internet-Explorer, go to your Taskmanager and kill all
processes named IEXPLORE.EXE
2. Delete this Files:
C:\WINDOWS\system32\IEsp.mht
C:\WINDOWS\system32\msadocm32.dll
C:\WINDOWS\system32\sqlpool.dll

3. Change the Following Registry-Key to "about:blank" (without quotes)
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

4. Run regedit.exe and delete the following Registry Keys,or Run
Hijackthis and Scan and fix ONLY these entries if they exist:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{0B519E07-7824-4adc-8890-93D5EABBF285}
or execute
reg.exe delete
HKLM\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF285}

5. Delete the Value {0B519E07-7824-4adc-8890-93D5EABBF285} from
HKEY_CLASSES_ROOT\ADODB.Comand\CLSID\

Sledgehammer nut. Spybot and AdAware will do the job admirably. You are
asking a novice to edit their registry. Will you fix if for them if it goes
wrong...?

May MS never make you an MVP....

 

[Guest]

No System won't help
The file is Spyware related
http://computercops.biz/postt55120.html - manual deletion

Get both of the following (free) programs
Spybot - http://www.safer-networking.org - FAQ, Help & Forum @ Site.
Ad-aware - http://www.lavasoft.de/ - FAQ, Help & Forum @ Site.

Preventative measures
Helpful Links:
http://www.cexx.org/noadware.htm
http://aumha.org/secure.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.doxdesk.com/parasite/
http://www3.telus.net/dandemar/index.htm
http://www.pestpatrol.com/
http://www.spywareinfo.com/~merijn/

 

[Michael D. Alligood]

Certain spyware programs are very difficult to get off. Which is why I use 4
different programs to remove spyware. Despite follow up posts to my last,
please read my post. If you do not feel comfortable editing the registry (I
do not know what experience you have) do not perform those steps listed. I
only included them because they have worked for me.

--
Best of luck!

Michael D. Alligood
MCSA, MCP, CCNA, A+,
Network+, i-Net+, CIW A, CIW CI

 

[Jon_Dear]

Many thanks for the answers to my post. Will attempt to clear this filth
from my friend's computer.
Jon

 

[Hilary Karp]

Jon, I use the Google toolbar as a pop up blocker. It works fine.