Help - home page keeps changing back to www.topsecuritysite.com

Anic

Hi

Hopefully someone can help.

My friend's PC had some sort of virus which hopefully she thinks she has now managed to get rid off and the PC seems to be running okay except for when she opens Internet Explorer. Her homepage is www.topsecuritysite.com (which she has never heard of) She keeps trying to change it to google but every time she goes opens it up again this site is there again - anybody any idea why? or how to change it permanently?

HKP_2

Sounds like the virus is still active to me.....
Probably written itself into iexplore.exe.
Dosent sound good.......

HKP_2

Ah some more info........
Seems quite likely that spyware has hijacked internet explorer.
Download ad-aware from lavasoft and run. It will clean out spyware from the PC.

Browntoa

follow steps 1 to 4 on the anti malware thread on the forum

http://forums.moneysavingexpert.com/showthread.html?t=133269

Browntoa

also this thread on another forum tells you which software to download and run for this specific hijack

http://www.bleepingcomputer.com/forums/topic18610.html

Removal Steps:

Download VundoFix.exe and save it to your desktop.

• Double-click VundoFix.exe to run it.
• Place a check in the checkbox labeled Run VundoFix as a task. You will receive a message stating that VundoFix will close and re-open in a minute or less.
• When VundoFix reopens, click the OK button.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click the YES button.
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click the OK button.
• When the computer has shutdown, turn your computer back on.
• The Winfixer/Vundo infection should now be cleaned from your computer. If you are still having a problem then please proceed to Step 2.

This step should only be used if the instructions in Step 2 did not remove the infection.

Download VirtumundoBegone and save it to your desktop.

VirtumundoBegone

Reboot your computer into Safe Mode

Then double click VirtumundoBeGone.exe you just downloaded and follow the instructions.

Exit when it has finished

Alfonso_Skinarelli

Topsecuritysite.com attempts to foist a rogue anti-spyware program on a victim's machine by stealth installing it with what is commonly known as the Smitfraud trojan. In this case the rogue programs are either MalwareWipe or PestTrap.

Both can be removed by following the instructions here:

http://www.virusvault.co.uk/fusionbb/showtopic.php?tid/81/

Browntoa

that was the other one i could not remember last night !!!! lol

welcome to the forum

nice set of instructions on that site

Alfonso_Skinarelli

Thanks for the welcome Browntoa,

I'll give the site owner your feedback when I change personalities later tonight.

Anic

Thanks to you all for your help and sorry for not replying sooner.

I have forwarded all of your advise and a link to this thread to her and hopefully she will be able to clear it up.

I'll let you all know how gets on.