Who's Hijacking my IE6 Homepage

[Guest]

Every time I open IE something has changed my home page to blank:about and I
get a pop-up telling me I have Spy-ware and to click to get a list of
spy-ware blockers!! And it also is able to turn the IE pop-up blocker off
also.
I have scanned the machine with AdAware, Spy Blocker,Spy Sweeper and Ran
WindowsWasher and McAfee. Found nothing and fixed nothing. WHAT'S DOING
THIS???????
Thanks if you can help
Roger

 

[Frank Saunders, MS-MVP IE/OE]

Every time I open IE something has changed my home page to
blank:about and I get a pop-up telling me I have Spy-ware and to
click to get a list of spy-ware blockers!! And it also is able to
turn the IE pop-up blocker off also.
I have scanned the machine with AdAware, Spy Blocker,Spy Sweeper and
Ran WindowsWasher and McAfee. Found nothing and fixed nothing.
WHAT'S DOING THIS???????
Thanks if you can help
Roger

First, if you don't have WinXP SP2, get LSP-Fix - a free program to repair
damaged Winsock 2 stacks
http://www.cexx.org/lspfix.htm
save it because you might need to repair the Winsock 2 stacks after removing
the culprit.
For WinXP SP2 this command will restore the Winsock stacks if you can't
connect after clearing the malware.
Go to Start | Run and type
CMD
In the command window type
netsh winsock reset
Then get CWShredder
http://www.intermute.com/products/cwshredder.html

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx

 

[Guest]

First, if you don't have WinXP SP2, get LSP-Fix - a free program to repair
damaged Winsock 2 stacks
http://www.cexx.org/lspfix.htm
save it because you might need to repair the Winsock 2 stacks after removing
the culprit.
For WinXP SP2 this command will restore the Winsock stacks if you can't
connect after clearing the malware.
Go to Start | Run and type
CMD
In the command window type
netsh winsock reset
Then get CWShredder
http://www.intermute.com/products/cwshredder.html

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx

 

[Guest]

Frank,
Thanks for the quick response but I have not gotten far enough to worry
about the stack yet. My problem IS the malware. How do I identify it? How do
I get rid of it?? Since it changes settings as IE opens it seems to me it
must be a Broswer Helper. I used SpyBot to remove one that it did not
recognise, with no change. Any Ideas?
Thanks again,
Roger

 

[Guest]

Frank,
Thanks for the quick response but I have not gotten far enough to worry
about the stack yet. My problem IS the malware. How do I identify it? How do
I get rid of it?? Since it changes settings as IE opens it seems to me it
must be a Broswer Helper. I used SpyBot to remove one that it did not
recognise, with no change. Any Ideas?
Thanks again,
Roger

Try "About buster" or the "ADS" scan in Ad-AwareSE,If no help check out the
silent runners link.Good Luck.
http://www.silentrunners.org/sr_cwsremoval.html
http://www.resplendence.com/reglite


Sometimes,when you remove malware it will stop your TCP/IP
stack from working (Internet connection).
Winsock or LSP-fix will correct the problem,Download first.
Note to anyone using NOD32 Anti-Virus software,Do Not delete the
"imon.dll" this fix reports,That is your e/mail scanning engine.

YES-You need more than 1 malware program,the one's below are all free
and work well.
LSP-fix- http://www.cexx.org/lspfix.htm
Spybot S&D - http://www.safer-networking.org/en/index.html
CWS Smart Killer- http://www.safer-networking.org/minifiles.html

About Buster- http://www.spychecker.com/program/aboutbuster.html
Ad-Aware SE - http://www.lavasoftusa.com/software/adaware/
CWShredder - http://www.majorgeeks.com/download4086.html
Hijack this - http://www.majorgeeks.com/download3155.html\
Hijackthis tutorial - http://forums.maddoktor2.com/index.php?showtopic=165
SpywareBlaster - http://www.javacoolsoftware.com/spywareblaster.html
SpywareGuard - http://www.javacoolsoftware.com/spywareguard.html
WinPatrol - http://winpatrol.com
BHODemon - http://pcworld.com/downloads/file_download.asp?fid=23611&fileidx=1
Bazooka -http://www.kephyr.com/spywarescanner/index.html
asquared2 "Trojan Remover" - http://www.emsisoft.com/en/
Socklock- http://nsclean.com/socklock.html
A nice site -
http://groups.msn.com/TeMercInternetSecuritySite/malwarecountermeasures.msnw
NOD32Anti-Virus Free 30 day trial
http://nod32.com/download/trial.htm
Process Guard-
http://www.diamondcs.com.au/processguard/index.php?page=download
A link for free online virus and trojan scanners.
http://virusall.com/downscan.html

 

[Guest]

Roger and Frank,

I've had the SAME problem that occurred last night when I was updating my
Virus software. The update installed Spyware, Trojans, Malware, etc. Now, I
am unable to use I.E. without the ABOUT: BLANK page and numerous Pop ups. I
am using Firefox to access this page...and have deleted the virus software
and exchanged it with a 30 day trial of Panda.

First, I've downloaded about 10 different Spyware Blockers, Malware
Blockers, and others like mentioned in your posts. I've done the Winsock
repairs, and numerous other RUN commands. NOTHING.

Everything is fine, until I try to open Internet Explorer. Here is what my
Virus scan and other blockers are showing:

C:\WINDOWS\system32\appnn32.exe
C:\WINDOWS\atlvl32.exe
Backdoor.Win32.Small.dc
Trj/Downloader.AIC
C:\WINDOWS\d3gy32.exe

PLEASE! Any help with this would be Greatly appreciated!