My son's homepage hijacked!

David · David's Garage

My 12yo son had his homepage hijacked by a supposed antivirus software. I say supposed, because now a porn site pops up. I've checked his cookies and the sites he's allowed to go to are there and there aren't any he's not allowed to, so I don't think he's been porn surfing.

I've been lax and hadn't loaded antivirus software on his computer, I know that was stupid. I've loaded it now and it's keeping the porn popup from coming up. I've run CWShredder, Spywareblaster, and Hijackthis and none have worked. The homepage still won't change. Help.

Mr_Wizard · 11-25-2006, 03:25 PM

Try Microsoft Windows Defender.

Flatbutt1 · 11-25-2006, 03:25 PM

Quote:

Originally posted by 125shifter
My 12yo son had his homepage hijacked by a supposed antivirus software. I say supposed, because now a porn site pops up. I've checked his cookies and the sites he's allowed to go to are there and there aren't any he's not allowed to, so I don't think he's been porn surfing.

I've been lax and hadn't loaded antivirus software on his computer, I know that was stupid. I've loaded it now and it's keeping the porn popup from coming up. I've run CWShredder, Spywareblaster, and Hijackthis and none have worked. The homepage still won't change. Help.

that happened to me two years ago. I had to have a pro come in and clean out the cookie that was resetting my homepage. I installed Symantec and haven't had any issue since.

Flatbutt1 · 11-25-2006, 03:39 PM

Quote:

Originally posted by mikester
Symantec takes up a ton of memory - on slower systems it can bring things to a crawl (just cleaned up my mother in law's system from it).

If you have windows XP the Windows Defender software works extremely well and doesn't kill the system.

Cool, I'll try that , thanks!

Moses · 11-25-2006, 03:50 PM

Three kids. Three Macs. ZERO issues.

David · David's Garage

Windows Defender found it and said it fixed it but it didn't. I ran it a few times and it kept finding it and fixing it, but now it's not even finding it. Next?

Don Plumley · Don Plumley's Garage

By changing his homepage, I assume you mean the default site for IE (not hijacking a public website).

Give this a try: http://www.lavasoftusa.com/products/ad-aware_se_personal.php

lendaddy · 11-25-2006, 04:50 PM

Quote:

Originally posted by 125shifter
Windows Defender found it and said it fixed it but it didn't. I ran it a few times and it kept finding it and fixing it, but now it's not even finding it. Next?

Try it from safe mode?

HardDrive · 11-25-2006, 04:54 PM

What is the name of the virus being reported?

onlycafe · 11-25-2006, 05:31 PM

you might have good luck with ewido.

David · David's Garage

The site that it keeps setting as the homepage is h tt p : / / yourieprotect . com . EDIT: I added the period at the end so you can't click on it. EDIT#2: If you add a period at the end, also delete the URL's around it. I just clicked on it to make sure no one else could and guess where I went!!! Hopefully I got away fast enough.

It looks like a anti-virus page, one that says you've got a bad virus so click here. I guess my son saw the evil sounding message and clicked on it. I've seen a few a these, but nothing like this. It looks like it may be too late to save it, things are acting very weird.

There's a guy on Rennlist that's having the same problem on his daughter's computer!

lendaddy · 11-25-2006, 05:59 PM

A search gave me the answer that this site has a manual and automatic tool to remove this specific virus, good luck.

http://www.nosnoopware.com/removals/eprotectpage.htm

David · David's Garage

That program found them, but now they want $37 to fix it. Hum, I wonder who created the virus?

I'm not big on giving these clowns money. I'd rather reformat the harddrive.

Any other ideas?

lendaddy · 11-25-2006, 06:13 PM

Quote:

Originally posted by 125shifter
That program found them, but now they want $37 to fix it. Hum, I wonder who created the virus?

I'm not big on giving these clowns money. I'd rather reformat the harddrive.

Any other ideas?

Seriously? That blows. I'm sure a free one is out there.

goldgunner · 11-25-2006, 07:07 PM

Symantec is generally considered sub-standard these days.

The free version of Grisoft is considered much more capable than Symantec, and will probably get rid of this pest:

http://free.grisoft.com/doc/2/lng/us/tpl/v5

H.G.P. · 11-25-2006, 07:12 PM

The site in question is not now listed in explorer "Favorites" is it?

TimT · 11-25-2006, 07:35 PM

Its quite nefarious.

you have to go into your network config, and change some things

what these instances do is a bit more than set as a homepage...

David · David's Garage

Not in favorites

genrex · 11-25-2006, 09:49 PM

Webroot Spy Sweeper will keep the homepage from being reset. Download and run the free version of Spy Sweeper, then go into Control Panel -> Internet Options, and make sure the homepage is what it's supposed to be. Should solve the homepage problem.

McAfee has a free antivirus search page at:
http://us.mcafee.com/root/mfs/default.asp?cid=9435
You might want to bookmark that..

Norton ain't so good anymore.

slodave · slodave's Garage

Does the supposed AV software mention Winfixer? If so, I'll point you to the software that removes it.

Dave