General discussion

aaabesthomepage removal HELP!!!!!

I hope someone can help me on this! I have ran both Ad-Aware and Spybot to remove "aaabesthomepage" from my computer. Everytime I run it, it says everything is clear. But, when I open up my Internet Explorer first thing when I start my system, it shows it in the history folder (even though the folder is clear prior to restart). I am loosing my mind. It is affecting one of my Java-based programs that I use thats detrimental to my job.

Any help would be great on how to remove this once and for all.


Discussion is locked

Reply to: aaabesthomepage removal HELP!!!!!
PLEASE NOTE: Do not post advertisements, offensive materials, profanity, or personal attacks. Please remember to be considerate of other members. If you are new to the CNET Forums, please read our CNET Forums FAQ. All submitted content is subject to our Terms of Use.
Reporting: aaabesthomepage removal HELP!!!!!
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
- Collapse -
try running cw shredder

HI James

Download the stand-alone CWShredder V2.13.0.0:

Close all other programs and run CWShredder.exe.

Click Fix, OK, let it fix anything it finds, click Next, then exit

then run an updated adaware se 1.05

Problem gone?

- Collapse -
Probably won't work

Version 2.13 doesn't seem to work at all, and I'm not sure I'd be recommending it as a primary cure, although it doesn't hurt to try it. In a post below (which I will update soon) I mentioned using it, then following up that scan with a Spy Sweeper scan, which found 3 CWS incidents that 2.13 missed. Looks to me like they're more interested in selling their paid version than they are in updating 2.13.

- Collapse -
Well, I don't know IF you are correct

we are still successfull in the HJT forums where we can SEE the nasties in the logs. So far NO problems at all.

- Collapse -
Re: Try running CW Shredder

Marianna, ran the CW, nothing appeared. Then ran SpySubract, detected a few things then things are running fine. Haven't restarted the comp though so can't tell for certain if it was solved or not.


- Collapse -
(NT) (NT) James, pls. let us know if everything is ok after reboo
- Collapse -
Re: Pls let is know if everything is ok after reboot

Hey All!! I would like to thank everyone that has helped so far. Unfortunately, nothing is working. If I load up my IE and my homepage loads up (mind you everything in the history log is cleared) everything is fine. The window ghosts out (the top of the window goes from dark blue to light/ghosted blue), then I click on it and everything is ok (I might have to do this a couple of times). After I click on my history button, it shows in the history "" with sub-foldered 5 "updates". I have tried to stop it by blocking it in my security settings under "restricted sites". Nothing works. I was able to get the program finally loaded after I do a "Ctrl-N". I have done the spybot, cwshredder, the start>run, & SpySweeper with no success. It catches various things but once I do a reboot the "aaabesthomepage" shows in the history screen once I start IE (after I have cleared the history) prior to reboot.

I am thinking there is something in the code for IE that is causing this.

- Collapse -

Try this:

Download: CCleaner
Once installed, run CCleaner click the Windows tab

Select the following:
Internet Explorer:
Temp Internet
Recently Typed URLs
Delete Index.dat files

Empty Recycle Bin
Temporary Files
Memory Dumps
Chkdsk File Fragments
Old Prefetch Data

Next: click Options click the Settings tab
Uncheck: "Only delete files older than 48 hrs.", click Ok
Then click Run Cleaner (bottom right) then Exit (reboot)

Did it help?

- Collapse -
exactly where is this malware?

have you been able to locate it, and if so where does it reside?

- Collapse -
Re: exactly where is this malware?

I have tried everywhere and haven't been able to find out where it resides.

- Collapse -
go to Start> Run


clcik on start up tab and see if it is there.

if it is uncheck it.

- Collapse -
re: start> run

Would it show up there even when it doesn't open up a IE window. It only goes to it (in the background) when I open up a IE window.

- Collapse -
seems to me it is starting up.

your scans have not pinpointed it's location.

IE starts when you boot, notwithstanding that you have to click on it to open.

the alternative would be to run the scan that found this and write down the EXACT location and post back, with that information.

- Collapse -
Re: seems to me it is starting up

Nothing at all in there

- Collapse -
run the program Marianne told you about

and post in that forum for a response.

do not post your HJT log here.

- Collapse -
My suggestion

Whatever the result of the CWShredder (or other) scans are, here's what I'd strongly suggest you do. Go to the downloads (download .com) and down load the 30 day trial version of Spy Sweeper 3.5 from Webroot. It's a long download, so be patient.

Here's how to use it:

1. Save it in it's own folder. You must then open the folder to install it.
2. Before running, click on the updates - they are new - the downloaded program is not.
3. Make sure your computer is NOT online when you run the scan. If it is, and you have a trojan downloader on your system, you will be re-infecting faster than the scan cycle can run.
4. Run the scan again.
5. If you have them, you can then run Ad-Aware, CWShredder, AVG7, Spybot, etc. They should all come up clean, except for Ad-Aware, which will find data miners (most from this site) and a couple of MRUs.

BTW, while this is touted on "downloads" as a "30 free trial", it gives you only 1 update, so it is more like a one week trial, considering how often you need to be updating these things.

- Collapse -
Home Page

Have you tried installing and running Browser Hyjack Blaster?

CNET Forums

Forum Info