Unwanted porn site

cockroachfarm

cockroachfarm

Joined
Jan 6, 2001
Messages
4,399
As opposed to one that's loved and wanted? ;)

Seriously - I have an older friend who has recently "discovered" computers and the web. Well, I think I've created a Frankenstein - he now spends several hours each day downloading news, music history, etc.

Problem: his Google "Home Page" has suddenly been replaced by a menu page from a porn site. (I asked him what kind of music he was hoping to download - skin flute? ;) ;) ;) )

I have tried everything to help him get rid of this, but I haven't been able to figure this out. (He's using Windows XP Professional, while I'm using Windows XP Home)

The unwanted page shows up with the following URL:

mk:@MSITStore(****):C:\spe\start.chm::/start.html#

I've tried clearing his temp folders, cookies, history, etc. with no luck.

Any suggestions?
 
Start with adaware and spybot to clean up the adware that's infected him.

Phil
 
Just click "Tools" (alongside "Favorites") then choose "Internet Options." The first choice under the "General" tab lets you enter the homepage of your choice.
 
Ok......here we go again! ;)

His browser has been "hijacked". Very easy to fix. Follow these steps:

1. Download Adaware and update. www.lavasoft.de

2. Download Spybot S&D and update. http://www.majorgeeks.com/download2471.html

3. Download HijackThis and update. http://s89223352.onlinehome.us/mirror/hjt/
(When you run this just do a scan, save the log to a word file and send me the file so I can see what files you need to remove. This is tricky for someone without some spyware savy.)

4. Download Spyware Blaster. http://www.javacoolsoftware.com/spywareblaster.html
(This will prevent spy/ad ware from even getting into your PC. Works very well. I come up clean on all of my scans now. It also locks your homepage so it can't be hijacked)

5. Download, update, and run CWShredder.
http://www.intermute.com/spysubtract/cwshredder_download.html

If you have any questions please feel free to email me.
 
cockroachfarm said:
As opposed to one that's loved and wanted? ;)
.....
Problem: his Google "Home Page" has suddenly been replaced by a menu page from a porn site. (I asked him what kind of music he was hoping to download - skin flute? ;) ;) ;) )
.....
The unwanted page shows up with the following URL:

mk:@MSITStore(****):C:\spe\start.chm::/start.html#

I've tried clearing his temp folders, cookies, history, etc. with no luck.

Any suggestions?
Click to expand...

If you have a CD burner, download the following for him so that you can do this while he is offline:

Step 1: Download Spybot Search and Destroy from Download.com:
http://www.download.com/Spybot-Search-Destroy/3000-8022_4-10289035.html

Step 2: Download the Detection Updates from Spybot (second item down) http://www.safer-networking.org/en/download/index.html

Step 3: Download Lavasoft Adaware from Download.com: http://www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button

Step 4: Download the Adaware "Latest definition file" from Lavasoft: http://www.lavasoftusa.com/software/adaware/

Step 5: burn all this to a CD. If you also know what Anti-Virus he is using, download the updates for that and burn them too.

Step 6: Take it to your friends PC, disconnect from the Internet and install SpybotS&D:
- Spybot S&D: go through the setup, but do NOT check for updates. Once installed, close the program.
- Spybot Detection Updates: doubleclick the file and it will update Spybot S&D.
- Run Spybot and Choose the "Imunize" option
- After that "Search & Destroy" - click the "Check for Problems" button. This will take 10-20 minute depending on the computer. When done, tell it to fix selected problems. It may tell you some problems could not be fixed and may it run on the next start up: tell it yes, and then restart the computer.
- Let the program run again if needed.

Step 7: Install Adaware
- Install the program and close without running
- install the update
- run the program and let it fix anything it finds. (it always does)

Step 8: update the antivirus software and do a compleate scan

Step 9: download and install the GoogleToolbar for Internet Explorer at toolbar.google.com

Step 10: if needed install XP SP2

Step 11: if it still won't let you set the page, contact me

Step 12: sit in a circle, drink coffee, and repeat: "my name is ________ an I have a problem: I click on everything I can".

This compleates your spyware 12 step program. I wish you well.

(I'm an IT manager for a staff of 50 and just typed all this from memory: your friend is not alone) :)

Further preventative measures:
- switch to Mozilla Firefox instead of Internet explore.
- install CookieCopII

(EDIT: and I see Ken just beat me to the post - but he's right)
 
Thanks folks, I knew I'd get the answer here! :cool:

When I was over at his place yesterday, the first thing I did was download SpyBot. Just didn't have time to run it, and told him not to touch anything until I could get some more info here in the forum.

I'll try your suggestions tonight.

(My friend is 65 years old and is like a kid with a new toy. Not only does he spend HOURS a day downloading news and music info -he's an ex-music DJ - but then he PRINTS out everything he's saved! Man, I wish I had the Island InkJet franchise down the block - they're sending their kids through college just on my friend's business! :D )
 
The ultimate solution: Change the perating system to Windows 2000 or XP Professional, and only go onto the Internet using a standard user account. No spyware software needed. No adware scanning. No headaches. Just blissfull surfing.
 
In addition to what Collucci said, some hijackings cannot be resolved the easy way (by universal tools such as Ad-Aware). There are specialised tools out there for certain problems and some can/must be fixed manually(by altering relevant registry entires).

If your friend can put together a list of running processes (open Command Prompt and run "tasklist /svc", without quotes obviously) i might be able to provide more (case-speific) advice or at least point out the suspicious processes that the person fixing the problems shoudl focus on, after they're done with conventional tools like Ad-Aware.

Tools like Ad-Aware remove roughly 50% of spyware/hijackings i
ve ever ran into (combined). The rest you have to do manually.The alternative is fresh installation of the OS and, uhm, using a different browser (i recommend Mozilla/Firefox) which doesn't allow scripts to run automatically and hijack the browser in the first place.
 
Maybe have him fill up a few CDs full of porn, before removing this spyware? ;) :D :D
 
faramir said:
If your friend can put together a list of running processes (open Command Prompt and run "tasklist /svc", without quotes obviously) i might be able to provide more (case-speific) advice or at least point out the suspicious processes that the person fixing the problems shoudl focus on, after they're done with conventional tools like Ad-Aware.
Click to expand...
This is what HijackThis does. It gathers a list of running processes and you remove the affected registry keys. Of course, you have to know what to remove, which I do. I am in the process of compiling a list of the more common corrupted registry files from HJT logs that I have analyzed. :D
 
My steps:

1: Stop using Internet Explorer (it is the devil). Download Mozilla or Mozilla FireFox.

2: Use Spybot S&D, AdAware and all those good things.

That is literally all you have to do, majority of all problems with spyware is caused by IE, so long as you have a decent firewall (McAfee, ZoneAlarm or Norton) you should be fine.
 
Also, go into the control panel>add /remove programs, then look for the WildTangent program, and delete it.
 
Firefox is great, using Lynx works also. IE is the cause of many, many problems...
 
You must log in or register to reply here.
Back
Top