Internet Home page changed

I got infected by a worm (and cleaned it via Norton) but since then, I'm not
able to get to my usual home page in Internet Explorer (www.google.com).
Instead I'm getting www.securityerrors.com page and I cannot access the
google page even typing it. How Can I get rid of it for good and get back to
my regular page ?

Any ideas/solutions are more than welcomed.
Thanks

From: "Michel" <>

| I got infected by a worm (and cleaned it via Norton) but since then, I'm not
| able to get to my usual home page in Internet Explorer (www.google.com).
| Instead I'm getting www.securityerrors.com page and I cannot access the
| google page even typing it. How Can I get rid of it for good and get back to
| my regular page ?
|
| Any ideas/solutions are more than welcomed.
| Thanks


For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/

* SpyBot Search and Destroy v1.4
http://security.kolla.de/

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

* BHODemon
http://www.definitivesolutions.com/bhodemon.htm

http://www.majorgeeks.com/downloadge...4332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/archive/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

When all else fails, HijackThis v1.99.1
(http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html or http://aumha.net/viewforum.php?f=30
for expert analysis, not here.**

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Security, Shell/User)

Michel wrote:
> I got infected by a worm (and cleaned it via Norton) but since then, I'm
> not
> able to get to my usual home page in Internet Explorer (www.google.com).
> Instead I'm getting www.securityerrors.com page and I cannot access the
> google page even typing it. How Can I get rid of it for good and get back
> to
> my regular page ?
>
> Any ideas/solutions are more than welcomed.
> Thanks

Hi PA Bear,

I've posted my log on http://castlecops.com/forum67.html

Michel

"PA Bear" wrote:

> Checking for/Help with Hijackware
> http://aumha.org/a/parasite.htm
> http://aumha.org/a/quickfix.htm
> http://aumha.net/viewtopic.php?t=5878
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/archive/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://defendingyourmachine.blogspot.com/
>
> When all else fails, HijackThis v1.99.1
> (http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
> It will help you to both identify and remove any hijackware/spyware. **Post
> your log to http://forums.spywareinfo.com/,
> http://castlecops.com/forum67.html or http://aumha.net/viewforum.php?f=30
> for expert analysis, not here.**
>
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE/OE, Security, Shell/User)
>
> Michel wrote:
> > I got infected by a worm (and cleaned it via Norton) but since then, I'm
> > not
> > able to get to my usual home page in Internet Explorer (www.google.com).
> > Instead I'm getting www.securityerrors.com page and I cannot access the
> > google page even typing it. How Can I get rid of it for good and get back
> > to
> > my regular page ?
> >
> > Any ideas/solutions are more than welcomed.
> > Thanks
>
>

Username?

Did you comply with the preliminaries listed on this page?
http://castlecops.com/t102301-Hijack...e_Posting.html
--
~PA Bear


Michel wrote:
> Hi PA Bear,
>
> I've posted my log on http://castlecops.com/forum67.html
>
> Michel
>
> "PA Bear" wrote:
>
> > Checking for/Help with Hijackware
> > http://aumha.org/a/parasite.htm
> > http://aumha.org/a/quickfix.htm
> > http://aumha.net/viewtopic.php?t=5878
> > http://mvps.org/winhelp2002/unwanted.htm
> > http://inetexplorer.mvps.org/data/prevention.htm
> > http://inetexplorer.mvps.org/archive/tshoot.html
> > http://www.mvps.org/sramesh2k/Malware_Defence.htm
> > http://defendingyourmachine.blogspot.com/
> >
> > When all else fails, HijackThis v1.99.1
> > (http://aumha.net/downloads/hijackthis.zip) is the preferred tool to
> > use. It will help you to both identify and remove any
> > hijackware/spyware. **Post your log to http://forums.spywareinfo.com/,
> > http://castlecops.com/forum67.html or
> > http://aumha.net/viewforum.php?f=30 for expert analysis, not here.**
> >
> > --
> > ~Robear Dyer (PA Bear)
> > MS MVP-Windows (IE/OE, Security, Shell/User)
> >
> > Michel wrote:
> > > I got infected by a worm (and cleaned it via Norton) but since then,
> > > I'm not
> > > able to get to my usual home page in Internet Explorer
> > > (www.google.com). Instead I'm getting www.securityerrors.com page and
> > > I cannot access the google page even typing it. How Can I get rid of
> > > it for good and get back to
> > > my regular page ?
> > >
> > > Any ideas/solutions are more than welcomed.
> > > Thanks

Sorry, My username is "ttt458"

Thanks
Michel

"PA Bear" wrote:

> Username?
>
> Did you comply with the preliminaries listed on this page?
> http://castlecops.com/t102301-Hijack...e_Posting.html
> --
> ~PA Bear
>
>
> Michel wrote:
> > Hi PA Bear,
> >
> > I've posted my log on http://castlecops.com/forum67.html
> >
> > Michel
> >
> > "PA Bear" wrote:
> >
> > > Checking for/Help with Hijackware
> > > http://aumha.org/a/parasite.htm
> > > http://aumha.org/a/quickfix.htm
> > > http://aumha.net/viewtopic.php?t=5878
> > > http://mvps.org/winhelp2002/unwanted.htm
> > > http://inetexplorer.mvps.org/data/prevention.htm
> > > http://inetexplorer.mvps.org/archive/tshoot.html
> > > http://www.mvps.org/sramesh2k/Malware_Defence.htm
> > > http://defendingyourmachine.blogspot.com/
> > >
> > > When all else fails, HijackThis v1.99.1
> > > (http://aumha.net/downloads/hijackthis.zip) is the preferred tool to
> > > use. It will help you to both identify and remove any
> > > hijackware/spyware. **Post your log to http://forums.spywareinfo.com/,
> > > http://castlecops.com/forum67.html or
> > > http://aumha.net/viewforum.php?f=30 for expert analysis, not here.**
> > >
> > > --
> > > ~Robear Dyer (PA Bear)
> > > MS MVP-Windows (IE/OE, Security, Shell/User)
> > >
> > > Michel wrote:
> > > > I got infected by a worm (and cleaned it via Norton) but since then,
> > > > I'm not
> > > > able to get to my usual home page in Internet Explorer
> > > > (www.google.com). Instead I'm getting www.securityerrors.com page and
> > > > I cannot access the google page even typing it. How Can I get rid of
> > > > it for good and get back to
> > > > my regular page ?
> > > >
> > > > Any ideas/solutions are more than welcomed.
> > > > Thanks
>
>

From: "Michel" <>

| Sorry, My username is "ttt458"
|
| Thanks
| Michel

I saw that thread. 0Byte attached Michel log.txt file.
But also indicated downloaded twice ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Hi Dave,

I've just re-posted my log file

Michel

"David H. Lipman" wrote:

> From: "Michel" <>
>
> | Sorry, My username is "ttt458"
> |
> | Thanks
> | Michel
>
> I saw that thread. 0Byte attached Michel log.txt file.
> But also indicated downloaded twice ?
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
>

From: "Michel" <>

| Hi Dave,
|
| I've just re-posted my log file
|
| Michel


You have both McAfee and Norton AV installed. Choose your pick one or the other NOT both !

You also have the Winfixer 2005 installed. Please perform the following...

Perform Part 1 the perform part 2

Part 1
------------
Download Adware-Virtumundo Removal Tool v1.5 --
http://secured2k.home.comcast.net/to...undoBeGone.exe

Information on the Adware-Virtumundo Removal Tool:
http://forums.mcafeehelp.com/viewtopic.php?t=57049

Part 2
------------
Download WinFixerFix.exe from the URL --
http://www.ik-cs.com/programs/virtools/WinFixerFix.exe

Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.
It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.

Please Copy and Paste the contents of the HTML Log file; C:\mcafee\ScanReport.HTML in your
reply.

* * * Please report back your results * * *



--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

1. Delete your first post: http://castlecops.com/pstp684869-.html#684869.
(You could have Edited it to repost your log.)

2. Instead of attaching the log (which I can't & won't read due to its
formatting:
http://castlecops.com/modules.php?na...wnload&id=7950), Copy
it from Notepad and Paste it into your first post in the new thread:
http://castlecops.com/pstp685000-.html#685000

3. Have you scanned with the tools (e.g., Ad-aware) recommended at
http://wiki.castlecops.com/Malware_R...:_Introduction ??
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Shell/User, Security), Aumha.org VSOP, DTS-L.org


Michel wrote:
> Hi Dave,
>
> I've just re-posted my log file
>
> Michel
>
> "David H. Lipman" wrote:
>
> > From: "Michel" <>
> >
> > > Sorry, My username is "ttt458"
> > >
> > > Thanks
> > > Michel
> >
> > I saw that thread. 0Byte attached Michel log.txt file.
> > But also indicated downloaded twice ?
> >
> > --
> > Dave
> > http://www.claymania.com/removal-trojan-adware.html
> > http://www.ik-cs.com/got-a-virus.htm