Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

home page take over & "adult"/offensive pop ups

May 31, 2004 11:39PM PDT

My Internet explorer homepage is now a different site and will not let me go back to the my original. Also pop ups for various adult sites keep popping up. I have tried ad-aware & spybot search and destroy and still nothing. What can I do

Discussion is locked

- Collapse -
Re:home page take over &
Jun 1, 2004 12:17AM PDT

Dirtydust,

1. Do you have the latest Spybot (Vers. 1.3)? If not, go here to get it.

2. Spybot (or for that matter, Ad-Aware) doesn't always get all of these browser hijackers (that's what's bugging you) out. So, here's some additional stuff for you:

The Cleaner (free for 30 days)

CWShredder (freeware)

Hijack This! (free) NOTE: This app is very powerful and can easily foul everything up if you're not real careful. The link also includes detailed instructions for its use; READ THEM!

Then, wander over to the CNET Virus and Security Alerts Forum, especially if you have questions about Hijack This!

Hope this helps...

- Collapse -
Addendum Re: Spybot
Jun 1, 2004 12:21AM PDT

Spybot has an immunize function that is very effective in preventing new infections of such trash. I suggest you activate it.

- Collapse -
Re: Addendum Re: Spybot
Jun 25, 2004 1:25AM PDT

I find many times that running Spybot 1.3 (with latest updates) in Safe Mode will locate and remove additional Hijackers that aren't found when booted up in standard. For sure, with hijackers running (redirecting web sites) you must also run HiJackThis software and CAREFULLY remove embedded registry items to fully remove
Good luck
wyn

- Collapse -
Re:home page take over &
Jun 24, 2004 10:27PM PDT

I need some help too...I had the same problem, IE being taken over by an "add-on" advertising program...so I ran Spybot. Ok, now I have that annoying pest program gone, but everytime I boot my computer, I am now missing pathways to programs I do not need that were removed by Spybot. Do I now need to run registry cleaner to get rid of those? they basically are more annoying than anything else.
One caveat for all of us that download something we think can be free, please READ the user agreement. Nothing is free, and most of these programs, like weatherbug for instance, do come with an ad or spyware program. I spent years just clicking on the user agreements until the last year or so, when there have been some pretty obtrusive programs that started popping up because I agreed to the license requirements.
Also, I deleted HP center, because I never used it, and now have an "invalid backweb application 173719" that I can't get rid of. Again, another annoying popup box at start up, but I would like to get rid of it also. I do know it is attached to the HP center, or is what is left of it, but I really would like to cleanup.
Thank you all for your help in advance,
Susan

- Collapse -
Re:home page take over &
Jun 24, 2004 11:56PM PDT

Susan,

One caveat for all of us that download something we think can be free, please READ the user agreement. Nothing is free, and most of these programs, like weatherbug for instance, do come with an ad or spyware program.

Bingo! In most cases, there really IS no such thing as a free lunch! Now, on to the issue at hand:

Yes, you have a Registry in need of a good scrubbing. A couple free (and scumware-free) programs I'd recommend are:

RegClean: Microsoft's now nonsupported (but still effective) Registry cleaner only does a part of the Registry, but it does work OK for what it does.

RegSeeker: It's fast, free and quite thorough - and I've never had a problem with it deleting something I later wished I had back. Just in case, though, the program does offer to backup the deletions; do so.

Also, Spybot S&D Version 1.3 does look for extraneous Registry entries, but I'd read the tutorial and get real comfortable before I'd rely heavily on it as a Registry app.

Hope this helps! Let us know what happens, OK?

- Collapse -
Re:home page take over &
Jun 25, 2004 11:10AM PDT

Thank you for the quick answer!! I will definitely be working on it and report back to let you know how I am doing...I feel I have a LOT of work to do on this.
Susan

- Collapse -
P.S., Susan,
Jun 25, 2004 12:01AM PDT

Laslo's suggestion on the last post in this thread about running PC Pitstop is also excellent - and one I should have remembered...

- Collapse -
Re:home page take over &
Jun 5, 2004 12:53AM PDT

If you have Windows, do this:

The problem is located in your "System Configuration Utility". A script virus put several little 'utilities' in there. All you have to do is UNCHECK the boxes next to the scripts to deactivate them.

To find the SCU go to start/programs/accessories/system tools/system information/tools/system configuration.

In the SCU dialog box, click the Start Up tab. These little utilities start to run when you start up your computer. The adult web site put some of them here. You have to shut them off. Ad-aware cannot remove them.

Here's the tough part. You have to KNOW which program in the SCU box to shut off. Some are very important and you shouldn't be shut off.

Go to http://www.sysinfo.org/startuplist.php for a full list of what each of the 'programs' do.

Go to http://www.pacs-portal.co.uk/startup_content.php for an explanation of start up programs.

After you uncheck the utilities, restart and go to Tools/internet options/general/homepage, in IE6 then click 'use blank'. That should do it.

Always check the "System Configuration Utility" box if your computer seems to be 'hijacked'. Also I recommend that you get Norton Antivirus 2004 if you are going to surf adult content.It stops these scripts cold.

- Collapse -
Re:home page take over &
Jun 24, 2004 5:05PM PDT

i cant seem to fine the system configuration utility. i got as far as tools, all i got was Net Diagnostic, System Restore,File Signature Ver.,Direct X diagnostic tool, and Dr. Watson

- Collapse -
Re:home page take over &
Jun 24, 2004 5:48PM PDT

Neither can I.

I am running Windows XP and in the Tools menu of System Information, (Start menu/Accessories/System Tools/System Information), there is no option for System Configuration. In fact I don't remember seeing one in Windows 98 or ME!

Paul C has the right idea. However I would also suggest a further option. You say you use AdAware. The Adaware programmers have a very good support forum at

http://www.lavasoftsupport.com/

and in one of their threads there is extensive discussion about using HijackThis and expert help in reviewing the HijackThis log.

I suggest you visit there, scroll down the page and look at the threads under the heading "HijackThis Logs".

If you cannot find a solution in one of the answers given there, you can post your Adaware log and HijackThis log for the experts to look at.

Good luck.

- Collapse -
Re:home page take over &
Jun 24, 2004 6:49PM PDT

Webroot spy sweeper has a feature when left on it will automatically convert the homepage back to the default page you determine...
its free!!!!!! and you can find it on cnet!!!!!!
good luck... and no more homepage hijackings.. i love it... Yaaaaaaaaaaaaaa.....

- Collapse -
Re:home page take over &
Jun 24, 2004 7:16PM PDT

The commands you need are in the start menu select run type msconfig and that will take you to the utility from here continue as previous email

- Collapse -
Re:home page take over &
Jun 26, 2004 5:13AM PDT

In Win98, go to Start/Programs/Accessories/System Tools/System Information, and then on the "Tools" menu select System Configuration Utility. You can also get there by going to Start/Run/msconfig. I have had excellent results avoiding spyware and home-page hijacking by using all of the following freeware: Spyware Blaster, Spyware Guard, Spybot Search & Destroy, and Zone Alarm. To solve frequent crashes (more than one per week), use Norton Disc Doctor and Win Doctor (both part of Norton Utilities). Good luck.

- Collapse -
Re:home page take over &
Jul 24, 2004 5:10AM PDT

xylitolsmint:
To open MS Configuration utility:
Click start, run, in the command line type: msconfig,
then click ok, this will open the configuration utility, (note: there is no msconfig in Windows 2000)
If you do a search for msconfig for W2k, there should be links for this utility that can be downloaded for W2k.
Hope this helps.
Snow Dog One.

- Collapse -
Re: home page take over &
Jun 24, 2004 11:02PM PDT

The easiest way to do this is to use system restore and restore your system to a date prior to the take over of your home page. This assumes you are using windows ME or XP.

- Collapse -
Re: home page take over & "adult"/offensive pop ups
Jun 24, 2004 11:30PM PDT

Go to www.pcpitstop.com. register for free and run a full scan of your system to check for performance and spyware. It will tell you how to fix your computer for optimal performance and also step by step, how to get rid of spyware and tell you what spyware you have. Best of all, after you register, they don't hound you with emails and junk. Great site! I've been going there for a couple of years.

- Collapse -
Re: home page take over &
Jun 25, 2004 1:05AM PDT

I have use both ad-aware and spybot. I have installed the Google IE toolbar. You can download it at: http://toolbar.google.com/. This tool bar has a pretty effective popup blocker. The other thing I do is run spybot at least once a week, sometimes more often. The combination of these two has done the trick. I no longer get those annoying takeovers of my home page and haven't seen an unwanted popup for a long time. To date, Google has blocked 3,410 popups. Remember, Spybot is good, but you have to use it on a regular basis and in combination with a popup blocker. Hope this helps.

- Collapse -
Re: home page take over & "adult"/offensive pop ups
Jun 25, 2004 3:59AM PDT

I have gotten to the stage where I delete all files containing the names and descriptions of the offender. Anything I don't want, I search for. Then I go to the registry and remove all references to it. I sometimes back up the registry but not usually. Everybody says back it up or die but I haven't lost anything I cared about. I tried deleting Messenger also but MS kept putting it back. So I removed it from startup

- Collapse -
Re: home page take over & "adult"/offensive pop ups
Jun 25, 2004 1:35PM PDT

My homepage has been taken over by allneedsearch.com
And every time I delete them, the following links return to my favorites:
Youngest girls every day, Sex porn land..., Full collection dirty porno etc.
SPYBOT and popbusters as well as strict internet tool commands have managed to prevent these sites from opening, but NOTHING is able to efface their existence on my system.
WHAT DO I DO ?

- Collapse -
Re: home page take over &
Jul 24, 2004 5:21AM PDT

Rub:
I would say you are just lucky, as a technical support rep, I would never advise anyone to run regedit, unless they know what they are doing. i.e. trusted information (instructions) from a technical support person, or information printed from a web site that you trust. There are numerous places in the registary that can contain ref. to the third party sw you are trying to remove. Not to mention removing an enty that could cause your OS to become inoperable.
JUST A WORD OF WARNING TO ALL.
Snow Dog One.

- Collapse -
Re: home page take over & "adult"/offensive pop ups
Jun 25, 2004 7:54AM PDT

I think u might have a virus. Basically I read a lot of articles about all these viruses that does that, I am quite sure this is not just an adware. Then again I cannot confirmed if its an adware then u have to find out what adware is that and u might have to remove it manually. U might want to start with scanning your pc or computer with your anti-virus software first and then if there is no virus then u have to find out what adware it is. U might have to go step by step as in follow the site where u have visited.

- Collapse -
Re: home page take over & "adult"/offensive pop ups
Jun 25, 2004 11:08AM PDT

all you need to do is get a popupblocker and a spyware blocker, try earthlinks, I have had no problems since I switched I used to get a lot, and there tech support can help if those two don't work. also try reinstalling internet explorer that might help.

- Collapse -
Re: home page take over & "adult"/offensive pop ups
Jun 25, 2004 7:45PM PDT
- Collapse -
Re: home page take over &
Jun 26, 2004 4:42AM PDT

I have ran into this problem before, heres what to do.
1. Download and install Spybot http://www.safer-networking.org/index.php?page=download and SpywareBlaster http://www.javacoolsoftware.com/sbdownload.html.
2. Close IE and run both programs, restart computer.
3. Go to Start>Control Panel>Internet Options on the General Tab reset the home page to http://www.google.com or somehting, click OK
4. Run SpywareBlaster again, in the Tools>Misc. IE Settings tab check the box 'Disable IE Home page setting...'
5. Start Internet Explorer, Google should be the home page now, if not close and repeat from step 2 - 4 If all is well, delete unwanted shortcuts from Favorites. One optional final step
6. Got to Housecall http://housecall.trendmicro.com/ and run a free online virus scan of the entire computer.

- Collapse -
If this CWS keeps coming back try this
Jun 27, 2004 9:57PM PDT

-these instructions come from a few websites searched from google using the words "about blank trojan"

-b4 following these instructions TURN OFF system restore(or it will just return)

-this CWS variant hides in the registry and somehow Windows Regedit can't see it. Use reglite

1) Download reglite (http://www.resplendence.com/)

2) install "Reglite" and run it, enter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs into the address bar or scroll down to it.

3) Double click on AppInit_DLLs to open a "Data Editor" properties window, if the bottom textfield named "Value" contains a .dll file; then this is the hidden file you need to get rid off.

4) You should not be able to delete this file if you try to clear the value field, IMPORTANT: take note of the path and name of the .dll file. Write it down so you do not forget it.

5) Rename the Folder "Windows" (This is a purple "highlighted" folder in the left hand window) to NOTWINDOWS. Simply click on the folder, click on "Edit" in the menu bar and select "Rename".

6) Click AppInit_DLLs again and clear the value containing the .dll and ok it. This should have removed the .dll

7) Rename the windows folder back to its original name "Windows".

Cool Run SpyBot, Ad-Aware and CWShredder to clean last bits away

now

make sure you can see all files folders and hidden operating system files (using folder options)

navigate to the offending .dll file that you carefully took note of in step 4.

now simply rename it.

now drag it onto your desktop

then into the recycle bin

and empty it way.

restart machine

an easy way to spot if it as gone is to download and install avg 6.0 from grisoft.com.be sure to update Initially Norton did not detect this! but I'm sure they will add it to their virus update

hope this helps.

Kudos to NexusUK in dslreports.com/forum for this fix

EDIT: It will come back every 24 hours after the original infection. so it might be a day b4 you see it come back if you rely on cwshredder thingy

- Collapse -
Re: home page take over & "adult"/offensive pop ups
Jun 29, 2004 12:58AM PDT

I use a combination of spybot, spywhare blaster, zone alarm, norton antivirus and "System Mechanic 4". You can try the mechanic as a trial and it will list all those who reside within your registry. Clean your registry often to know if there have been any changes you don't know about. Norton system works will help, spybot is great for detection, and System Mechanic 4 is pretty good. Only the Norton will cost you. Another good cleaner you can use for 30 days is TuneUp Utilities 2003, 2004.

- Collapse -
Re: home page take over & "adult"/offensive pop ups
Jun 29, 2004 5:34PM PDT

You have a hijacked browser, these can be one hell of a chore to get rid of and the steps you will have to take will differ with every hijack. I would suggest getting a program called hijack this. It scans your registry and displays all of the relavent registry keys, then you look through the list and delete anything that looks suspicious. then open up internet properties and change the homepage and restart the computer. If you forget to change the home page before you open internet explorer again you run the risk of getting reinfected. Also, be careful with what you delete from the registry.

- Collapse -
Re: home page take over & "adult"/offensive pop ups
Jun 30, 2004 5:43AM PDT

My computer has set my homepage to dorkodrom. What exactly does dorkodrom do, and how do I get rid of it? thanks

- Collapse -
Therock, It Appears Like You Didn't Try....
Jun 30, 2004 6:24AM PDT

....any of the suggestions mentioned throughout this thread. At least it doesn't appear so. To get you started, please click on the links below and run the free online antivirus scans they provide:

Housecall Online Virus Scanner

Panda Online Virus Scanner

Next, please download, install, then update and run the free spyware removal tools listed below:

Ad-Aware 6 Spyware Removal Tool

?Spybot Search & Destroy? Spyware Removal Tool

On this next spyware removal tool, simply download it to your desktop from the link below, then double click on the file to run the scanner.

CWShredder Hijack Removal Tool


Hope this helps and let us know how it goes.

Grif

- Collapse -
Re: Therock, It Appears Like You Didn't Try....
Jun 30, 2004 12:57PM PDT

Thanks a lot for the info. I'm pretty illiterate when it comes to virus removal and things like that so I need all the help I can get. What exactly does dorkodrom do? I know it's a hijacker and takes over your homepage and things like that, but does it have more damaging or dangerous effects than that? Again, sorry for my ignorance in the situation, but I do appreciate all the help. Thanks