Results 1 to 9 of 9

Thread: homepage hijacked by: http://awesomehomepage.com/newsletter.php?list=positivethoughts

  1. #1
    Junior Member
    Join Date
    Aug 2007
    Posts
    23

    Default homepage hijacked by: http://awesomehomepage.com/newsletter.php?list=positivethoughts

    My homepage has been hijacked by the above webpage. I have installed latest spybot + updates and done a scan. I have gone to tools>browserpages and tried to replace the above website to my preferred homepage. spybot Dialogue states change denied. However when i start a browser my preferred page comes up, but if i reboot pc above homepage starts.

    Please can you help?

  2. #2
    Senior Member spybotsandra's Avatar
    Join Date
    Oct 2005
    Location
    Germany
    Posts
    5,276

    Default

    Hello,

    Change your start page:
    Please run Spybot - Search & Destroy and switch to the Advanced mode via the menu item Mode.
    Now select 'Tools' - 'Browser pages' from the navigation bar on the left.
    There, please search for the entry with the unwanted starting pages.
    Mark it and click "Change" (in the bar at the top).
    Then type your wanted starting page like www.google.de or perhaps about:blank.
    Now go to 'Tools'->'IE Tweaks'. There you'll see a group of Recommended miscellaneous locks.
    Untick the checkboxes in front of both Lock IE... options.
    You may need to close all Explorer windows, and maybe even restart Windows before these changes take place.

    Please allow the change with the resident TeaTimer.

    If it is denied - perhaps you have clicked the notification from the Resident TeaTimer away instead of allowing it, because you can't read the buttons clearfully.

    This is a little bug in version 1.4:
    http://www.safer-networking.org/en/news/2005-06-22.html
    We have already been able to locate and fix it. The fix will be downloadable with our next program upgrade. We hope that it will be available soon. As a current solution you can work with your keyboard. Use the cursor keys to switch between the buttons ("Allow" is on the left, "Deny" on the right) and the space key to enter your selection. You can also press "A" on your keyboard for "Allow change" or "D" for "Deny change". The Checkbox for "Remember this decision" will work correctly in spite of the graphical issue.
    If you don't like to use the above workarounds you can disable TeaTimer as follows: - Go into Spybot - Mode - Advanced Mode - Tools - Resident.
    - Uncheck the following: Resident "TeaTimer" (Protection of over-all system settings) Active.
    For more information please have a look here:
    http://forums.spybot.info/showthread.php?t=44
    And you'll find a little workaround here:
    http://forums.spybot.info/showthread.php?t=122

    Best regards
    Sandra
    Team Spybot

  3. #3
    Junior Member
    Join Date
    Aug 2007
    Posts
    23

    Default

    I am finding it very hard to follow your instructions, but given time, maybe i will browse the links you suggested and will understand better. Will keep you informed and thanks for yr prompt help.

  4. #4
    Junior Member
    Join Date
    Aug 2007
    Posts
    23

    Default

    ok. i have followede yr instruction regarding allowing or denying a homepage entry. i have entered the homepage address and it was allowed.

    however when i restart my pc i still get the page that hijacked my pc as the homepage

    What is yr advice as to how to get my preferred homepage back, please?

  5. #5
    Senior Member spybotsandra's Avatar
    Join Date
    Oct 2005
    Location
    Germany
    Posts
    5,276

    Default

    Hello,

    Please download HijackThis:
    PHP Code:
    [url]http://www.downloads.subratam.org/hijackthis.zip[/url] 
    Double click HijackThis.exe.
    Just start the program.
    Hit Scan.
    When the scan is finished, the "Scan" button will change into a "Save Log" button.
    Please mail that log to our detectives at detections(at)spybot.info.

    Best regards
    Sandra
    Team Spybot
    Last edited by tashi; 2007-08-30 at 22:20. Reason: Added code. ;-)

  6. #6
    Junior Member
    Join Date
    Aug 2007
    Posts
    23

    Default

    Thanks I have sent an email to detections AT spybot.info with the HJT log.
    Last edited by tashi; 2007-08-30 at 21:57. Reason: Disabled email link

  7. #7
    Junior Member
    Join Date
    Aug 2007
    Posts
    23

    Default

    an email from detections AT spybot.info suggested this:
    Please fix the follwing items with hijackthis:

    Running processes:
    C:\Program Files\CleanMyPC\Registry Cleaner\RCScheduler.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    PHP Code:
    [url]http://awesomehomepage.com/newsletter.php?list=positivethoughts[/url] 
    O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Program
    Files\CleanMyPC\Registry Cleaner\RCScheduler.exe" /startup

    Please make a fresh system start after fixing these items.


    However after reboot, homepage is still hijacked
    Last edited by tashi; 2007-08-30 at 21:59. Reason: Disabled email link and R0 url

  8. #8
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    32,627

    Default

    Hi elvira,

    Let's take a look from a different angle, please follow the procedure in this link:
    "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)
    Please use the link and instructions there for a Trend Micro HJT log.

    Then start your own thread in the Malware Removal Forum

    A helper will advise you when available. Best regards.
    Last edited by tashi; 2007-08-30 at 22:19. Reason: clarify
    Microsoft MVP. Consumer Security 2006-2014


  9. #9
    Junior Member
    Join Date
    Feb 2008
    Posts
    1

    Default hijacked

    I too, have been hijacked by awesome home pages.I have the latest updates, and, I scan a couple of times a week. I still can't get rid of it.
    larry martin

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •