Home page virus

[Tony Pagett]

Please could somebody help me? I have had enough.

A virus of some sort has taken over IE on my PC.

It has set its own page as my home page and will not let me access any web
sites other than its own so called anti adware programs.

I have run several adware removal programs -spy bot included - but nothing
is found.

Each time I click on the Home icon a different page comes up but all with
the same results--No access to the internet.

A right click and properties gives me www.e-finder.cc/hp/

 

[Beauregard T. Shagnasty]

Please could somebody help me? I have had enough.

A virus of some sort has taken over IE on my PC.

It's spyware/malware, not a virus.

It has set its own page as my home page and will not let me access
any web sites other than its own so called anti adware programs.

I have run several adware removal programs -spy bot included - but
nothing is found.

Each time I click on the Home icon a different page comes up but
all with the same results--No access to the internet.

A right click and properties gives me www.e-finder.cc/hp/

Most IE problems where a ".cc" page is involved are the CoolWebSearch
hijacker. Get the CWShredder and run that.
http://www.intermute.com/spysubtract/cwshredder_download.html
"Download the stand-alone version of CWShredder."

Then, consider upgrading to a modern, secure, unhijackable browser:
http://home.rochester.rr.com/bshagnasty/tips.html

 

[Steve C]

Please could somebody help me? I have had enough.

A virus of some sort has taken over IE on my PC.

It has set its own page as my home page and will not let me access any web
sites other than its own so called anti adware programs.

I have run several adware removal programs -spy bot included - but nothing
is found.

Each time I click on the Home icon a different page comes up but all with
the same results--No access to the internet.

A right click and properties gives me www.e-finder.cc/hp/

Have you tried the solution given to you when posted this same problem
yesterday?

 

[Tony Pagett]

I tried this CW shredder yesterday after your suggestion. It did not find
CoolWebSearch on my system.

Any more suggestions please.

 

[Tony Pagett]

I can no longer get any access to the internet due to this virus so any
downloads are out of the question.

 

[Beauregard T. Shagnasty]

I tried this CW shredder yesterday after your suggestion. It did
not find CoolWebSearch on my system.

Then it would have been nice of you to respond in the same thread, and
so state the results. Please don't expect us to remember each thread,
and poster's name and question.

Any more suggestions please.

Have you switched to a modern browser?

 

[Tony Pagett]

I am sorry I started another thread. I am new to newsgroups.
I have tried several suggestions from people but no joy.
I have not switched to a modern browser. How would I do this?

 

[Ian Kenefick]

I can no longer get any access to the internet due to this virus so any
downloads are out of the question.

It's spyware/malware, not a virus.


Most IE problems where a ".cc" page is involved are the CoolWebSearch
hijacker. Get the CWShredder and run that.
http://www.intermute.com/spysubtract/cwshredder_download.html
"Download the stand-alone version of CWShredder."

Then, consider upgrading to a modern, secure, unhijackable browser:
http://home.rochester.rr.com/bshagnasty/tips.html

Download ad-aware from an internet cafe
Download spybot S&D from an internet cafe

Burn them to disk, install them on your machine and scan your machines
for spyware.

Regards,
Ian Kenefick
http://www.ik-cs.com

 

[Bud]

I am sorry I started another thread. I am new to newsgroups.

Everybody's new sometime. ;-)

I have tried several suggestions from people but no joy.
I have not switched to a modern browser. How would I do this?

Here's Firefox, a very nice one.

http://www.mozilla.org/products/firefox/

Couple it with this email 'Thunderbird' and most needs are met.

http://www.mozilla.org/products/thunderbird/releases/

Can't offer anything new re: the home page problem. :-(

 

[Steve C]

I am sorry I started another thread. I am new to newsgroups. I have tried
several suggestions from people but no joy. I have not switched to a
modern browser. How would I do this?

If at all possible download and install Firefox it's an alternate browser
to IE and to a great extent not as vulnerable to malware as IE.
http://www.mozilla.org/products/firefox/

 

[Tony Pagett]

Thanks for your suggestions but unfortunately I cant get access to the internet. The virus or whatever it is puts up a page saying the following: (The link just takes you to the same pages that have become my home page)

Access Blocked - Virus Warning!
You cannot access this site due to following reason:
Your computer was infected by Spyware or Adware Software.
This is dangerous software which disclose your personal
and transferred data and/or display unsolices advertising.
You can use this ADWARE/SPYWARE REMOVAL tools in
order to solve this problem and prevent futurer infection.


You can click Search to look for information on the Internet.




HTTP Error - Access Blocked

 

[Steve C]

I am sorry I started another thread. I am new to newsgroups. I have tried
several suggestions from people but no joy. I have not switched to a
modern browser. How would I do this?

You may also want to avoid posting your "real" email address to a
newsgroup as they can be collected by spammers with the obvious
consequences.

 

[Tony Pagett]

It gets more complicated all the time!!!

How do I not send my real e-mail address?

 

[Beauregard T. Shagnasty]

Thanks for your suggestions but unfortunately I cant get access to
the internet.

Are you using the machine now? Your Outlook Express is connecting to
the internet for these newsgroups. Did you mean the World Wide Web is
inaccessible?

The virus or whatever it is puts up a page saying the
following: (The link just takes you to the same pages that have
become my home page)

Obviously a hijack.

Access Blocked - Virus Warning!
You cannot access this site due to following reason:
Your computer was infected by Spyware or Adware Software.
This is dangerous software which disclose your personal
and transferred data and/or display unsolices advertising.

...is it really misspelled like that? unsolices?

You can use this ADWARE/SPYWARE REMOVAL tools in
order to solve this problem and prevent futurer infection.

Some malware attempts to sell you anti-malware software. Do not bite
on that. There is nothing you need to pay for to be clean.

You can click Search to look for information on the Internet.

HTTP Error - Access Blocked

You are going to have to go to another machine - preferably a friend
with broadband - and download the recommended tools to burn to a CD to
clean up your machine.

Then, begin practicing safe hex.

Oh, since you admitted to being a newbie, perhaps a read of this page
when you get WWW access, would be beneficial:
http://oakroadsystems.com/genl/unice.htm

 

[bassbag]

Please could somebody help me? I have had enough.

A virus of some sort has taken over IE on my PC.

It has set its own page as my home page and will not let me access any web
sites other than its own so called anti adware programs.

I have run several adware removal programs -spy bot included - but nothing
is found.

Each time I click on the Home icon a different page comes up but all with
the same results--No access to the internet.

A right click and properties gives me www.e-finder.cc/hp/

Maybe trends online scanner may fix it...
Description...

http://www.trendmicro.com/vinfo/grayware/graywareDetails.asp?SNAME=SPYW_C
OOLWEB.F

online scanner
http://housecall.trendmicro.com/housecall/start_corp.asp

me

 

[Beauregard T. Shagnasty]

It gets more complicated all the time!!!

It is all a matter of experience. It isn't really complicated.

How do I not send my real e-mail address?

Open up your Tools > Accounts and select your usenet account. Choose
Properties. Navigate to the tab where your email address is entered.
Change it to: (e-mail address removed) (Yes, exactly like this.)
Save the changes.

 

[Bud]

Thanks for your suggestions but unfortunately I cant get access to the

internet.

Prolly redundant but have you tried booting into Safe mode and scanning
with Spybot S&D, etc.? ?

(XP) Start> Run> msconfig> BOOT.INI> Safeboot minimal> OK> Restart.

 

[bassbag]

Thanks for your suggestions but unfortunately I cant get access to the internet. The virus or whatever it is puts up a page saying the following: (The link just takes you to the same pages that have become my home page)

Access Blocked - Virus Warning!
You cannot access this site due to following reason:
Your computer was infected by Spyware or Adware Software.
This is dangerous software which disclose your personal
and transferred data and/or display unsolices advertising.
You can use this ADWARE/SPYWARE REMOVAL tools in
order to solve this problem and prevent futurer infection.


You can click Search to look for information on the Internet.




HTTP Error - Access Blocked

Yours hosts file is probably hijacked.Heres how to tell ....
http://russelltexas.com/malware/HOSTS.htm

FAQ 14: I can't go to certain webpages...either to download antivirus
patches or to get help from malware fighter sites. What happened?

Answer: Your HOSTS file is probably hijacked.


The HOSTS file is a non-extension file found in this location:

C:\Windows\System32\Drivers\ETC\HOSTS XP

C:\WINNT\System32\Drivers\ETC\HOSTS Windows 2000

C:\Windows Windows 98 and Millennium


Two ways to fix...rename and replace or edit the original:

1. Rename and Replace HOSTS file (recommended)

Open Windows Explorer: type the word explorer at Start/Run box and click
OK:

Find this file: (XP systems)
C:\Windows\system32\Drivers\ETC\HOSTS file

Rename the file HOSTS to HOSTS.OLD. (a fresh new HOSTS file will be
created when you restart Windows). Later you can delete the HOSTS.OLD
file when things are back to normal.

2. Edit HOSTS file:

To open and view the HOSTS file to doublecheck for bad entries, left
button double click on the HOSTS file. A message will appear saying
Windows can't open the file. Check the circle at the bottom entitled:

Select the program from a list.

Now click OK. In the next window....Scroll down in programs until you see
Notepad and select it and click OK.

If you see this line below the header info:

127.0.0.1 localhost

.....And nothing below it then you have not been hijacked.

If you see many double column entries and most are antivirus and anti-
malware sites then remove all the entries leaving only the 127.0.0.1
localhost entry.

You can install a HOSTS protection file replacement to make it less
vulnerable.

I use this one http://mvps.org/winhelp2002/hosts.htm (Download it,
unzip it, and replace your old HOSTS file with this excellent protector).
Full details on that page with a good overview of the HOSTS file and how
it works.

Back to Hijackthis FAQ


me