How do I remove rogue website from IE?

wadewade

My son seems to have attracted some rogue website or virus and compounded this by clicking OK. I have done a virus scan and an Anti-Spyware scan without success although the virus check did eradicate two viruses. Now everytime we open Explorer a new website over-rides our default page with a message accompanied by lots of threats starting (in red) SYSTEM SECURITY STATUS WARNING.
How do I get rid of it? the address says it is:

http/eprotectpage. (followed by com but I won't print it in case someone clicks on it by mistake)

steveo3002

at the top of your screen.....select tools-internet options-general, there should be a place to selcet your home page

enter the url of whatever you want to be your home page in there

steveo3002

oh and look on google and download free zonealarm, and avg 7.5 antivirus, load those and run them

Browntoa

none of the above will do it, this a rogue spyware site, means your Pc is still infected (zonealrm is just a firewall ?? and the poster has already said he has run antivirus)

follow posts 1 to 4 of this thread

http://forums.moneysavingexpert.com/showthread.html?t=133269

if the problem still persists afterwards then follow the instructions for hijack this and post a log file back here for Alfonso, Pchelpman or me to look at

there may be the need to also run a standalone program to fix this

what is the name of the website it send you to ?

wadewade

Thanks, Steve, the strange thing is that I have already reset my home page as you suggest but this little blighter comes back and takes it over again.

wadewade

Browntoa,

Thanks for your advice, it looks a bit scary though!

The website is:

http/eprotectpage. (followed by com but I won't print it in case someone clicks on it by mistake)

Reluctant_spender

You may need something stronger for this. I would suggest visiting a hijack this analysis site such as https://www.bleepingcomputer.com and posting a hijack this log for someone to look at.

Chippy_Minton

Start by following the steps in the malware removal guide - http://forums.moneysavingexpert.com/showthread.html?t=133269. If it's still there and you need the HijackThis step in post 4, it will require someone with specialist knowledge to get rid of, so at that point I'd wait until Browntoa, Alfonso, or PChelpman come along to help you.

I can also point you to this Yahoo Best Answer which has a link to nosnoopware.com with removal instructions, however I don't know how reputable that site is.

Browntoa

STEP 1: Complete this procedure completely including attaching the requested log before doing the second procedure.

Download SmitfraudFix (by S!Ri) to your Desktop.

Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please attach that log in your next reply.

Browntoa

STEP 2: PLEASE READ ALL OF THESE INSTRUCTIONS FIRST BEFORE DOING ANYTHING. Ask any questions that you may have before starting.

Please print out or copy these instructions to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. Again, if there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer into Safe Mode : Starting your computer in Safe mode

Open the SmitfraudFix Folder of your Desktop, then double-click smitfraudfix.cmd file to start the tool.

Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

The tool will also check if wininet.dll is infected. If it is infected and a clean version is found, you will be prompted to replace the infected wininet.dll with the clean file. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. BUT Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed.

Now reboot into normal mode and attach this new rapport.txt log here.

Browntoa

from

http://forums.majorgeeks.com/showthread.php?t=107893

then follow that link I posted

looks scarey but it is worse than it looks and will do the honours