Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

windows 8 laptop - isp has changed home page


  • This topic is locked This topic is locked
12 replies to this topic

#1 DOPEY13

DOPEY13

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:54 AM

Posted 26 October 2015 - 11:47 AM

A friend of mine has a windows 8 laptop and his isp has changed his home page and shortcuts etc. I do not have physical access to the computer but he says he has tried the usual way to change home page in IE

 

Would hijack this show the problem. I ran hijack this on my computer to see what is shows and it shows my home page in the registry. Could his page be changed back in the registry


Edited by DOPEY13, 26 October 2015 - 12:17 PM.


BC AdBot (Login to Remove)

 


#2 satchfan

satchfan

  • Malware Response Team
  • 2,668 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:12:54 PM

Posted 26 October 2015 - 02:09 PM

Hello DOPEY13 and welcome to Bleeping Computer.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

  • please follow all instructions in the order posted
  • please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
  • all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
  • if you don't understand something, please don't hesitate to ask for clarification before proceeding
  • the fixes are specific to your problem and should only be used for this issue on this machine.
  • please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested.

 

===================================================

 

Is there some reason why your friend can't start their own topic? I'll supply some instructions assuming that that is the case.

 

 

I do not have physical access to the computer

The instructions are given for downloading to a computer directly: if possible, replace those instructions by downloading to a flash drive and transfer them to the infected computer, (to the desktop). Then, please do the following:

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.


  • run AdwCleaner
  • when it has finished, select Clean
  • if it asks to reboot, allow the reboot
  • on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run Junkware Removal Tool

thisisujrt.gif Please download Junkware Removal Tool to your desktop.

  • shut down your protection software now to avoid potential conflicts.
  • run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
  • the tool will open and start scanning your system
  • please be patient as this can take a while to complete depending on your system's specifications
  • on completion, a log (JRT.txt) is saved to your desktop and will automatically open
  • post the contents of JRT.txt into your next message.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

  • right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  • press Scan button
  • it will produce a log called Frst.txt in the same directory the tool is run from
  • please copy and paste log back here.
  • the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

AdwCleaner log
JRT.txt
Frst.txt
Addition.txt


Thanks

Satchfan

 


Edited by satchfan, 26 October 2015 - 02:29 PM.

My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.


#3 DOPEY13

DOPEY13
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:54 AM

Posted 26 October 2015 - 02:29 PM

I cannot do that as i said A friend of mine has a windows 8 laptop and his isp has changed his home page and shortcuts etc. I do not have physical access to the computer



#4 satchfan

satchfan

  • Malware Response Team
  • 2,668 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:12:54 PM

Posted 26 October 2015 - 02:32 PM

Sorry, I re-read and realised that so adjusted my response.

 

Please let me know if you can follow those.

 

Satchfan


My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.


#5 DOPEY13

DOPEY13
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:54 AM

Posted 26 October 2015 - 02:41 PM

Sorry, I re-read and realised that so adjusted my response.

 

Please let me know if you can follow those.

 

Satchfan

no i cannot i am not at his computer. i am searching for info to tell him. Would the hijacked home page be in the registry and could it be fixed there



#6 satchfan

satchfan

  • Malware Response Team
  • 2,668 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:12:54 PM

Posted 26 October 2015 - 03:11 PM

Would the hijacked home page be in the registry and could it be fixed there

 

There are many infections that can cause this, (some of them very nasty) so, without looking at the computer with our scans, it's not possible to give a solution and would be dangerous to do as it may make the situation worse.

 

I can't give instructions "third-party" as the forum doesn't work like that.

 

If you can contact your friend I suggest that (s)he starts a topic here because I'm afraid your friend's computer problem can't be diagnosed or fixed here unless one of you can supply those diagnostic logs.

 

Satchfan


My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.


#7 DOPEY13

DOPEY13
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:54 AM

Posted 26 October 2015 - 05:51 PM

 

Would the hijacked home page be in the registry and could it be fixed there

 

There are many infections that can cause this, (some of them very nasty) so, without looking at the computer with our scans, it's not possible to give a solution and would be dangerous to do as it may make the situation worse.

 

I can't give instructions "third-party" as the forum doesn't work like that.

 

If you can contact your friend I suggest that (s)he starts a topic here because I'm afraid your friend's computer problem can't be diagnosed or fixed here unless one of you can supply those diagnostic logs.

 

Satchfan

 

it is not an infection. the isp did it



#8 satchfan

satchfan

  • Malware Response Team
  • 2,668 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:12:54 PM

Posted 26 October 2015 - 06:06 PM

his isp has changed his home page

 

 

As far as I'm aware that is not a viable possibility.

 

it is not an infection. the isp did it

 

Sudden "home page" changes and shortcuts will be caused by adware, spyware or other malware and not by an ISP. I'm not an expert on things Internet-related but have dealt with enough infected computers to know this.

 

As I asked previously, can you access the computer at any time or is your friend capable of starting his own topic, because one or the other situation will have to arise before I can help.

 

Satchfan


Edited by satchfan, 26 October 2015 - 06:07 PM.

My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.


#9 DOPEY13

DOPEY13
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:54 AM

Posted 27 October 2015 - 12:27 PM

 

his isp has changed his home page

 

 

As far as I'm aware that is not a viable possibility.

 

it is not an infection. the isp did it

 

Sudden "home page" changes and shortcuts will be caused by adware, spyware or other malware and not by an ISP. I'm not an expert on things Internet-related but have dealt with enough infected computers to know this.

 

As I asked previously, can you access the computer at any time or is your friend capable of starting his own topic, because one or the other situation will have to arise before I can help.

 

Satchfan

 

you are wrong.it was changed by the isp to their page. Close this topic you do not seem to want to read it



#10 satchfan

satchfan

  • Malware Response Team
  • 2,668 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:12:54 PM

Posted 27 October 2015 - 05:13 PM

Close this topic you do not seem to want to read it

 

Rudeness is unneccesary. I don't know if you are aware of it but we are all volunteers here and do this for no reward - plus, we fit this in between real lives, ie family and full-time jobs.

 

you are wrong.it was changed by the isp to their page

On what do you base this? Also, can you tell me who the ISP is.


My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.


#11 DOPEY13

DOPEY13
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:54 AM

Posted 28 October 2015 - 06:40 AM

 

Close this topic you do not seem to want to read it

 

Rudeness is unneccesary. I don't know if you are aware of it but we are all volunteers here and do this for no reward - plus, we fit this in between real lives, ie family and full-time jobs.

 

you are wrong.it was changed by the isp to their page

On what do you base this? Also, can you tell me who the ISP is.

 

you are the one who was rude you did not even read my op when I said i did not have access to the pc yet you twice made suggestions as if i had. it was changed by the isp. they change to their home page just like when a new pc is bought it is often set to MS. That is not an infection. why would an infection change it to the home page of the isp. it would change it to the the infectors page

 

Also i do not believe it is necessary to download all the programms you say. i just asked for general suggestions. I know how to change it back but it does not work for him. Being a volunteer is irrelevant. I did not ask you to volunteer. So consider this closed. I will go to him and fix it when i have physical access



#12 satchfan

satchfan

  • Malware Response Team
  • 2,668 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:12:54 PM

Posted 28 October 2015 - 07:14 AM

May I suggest that should you visit this or any other top forum again that you express yourself a little better - and that you also take your topic to the relevant forum.

As you seem to be some kind of “expert” who is certain that it is not malware-related, I wonder why you started the topic in the “Virus, Trojan, Spyware and Malware Removal" forum where we would assume that you had a Virus, Trojan, Spyware or Malware-related problem. :unsure: 

As I don’t intend get into a “discussion” with somebody who is so rude and ungracious I am closing this topic.

I hope your friend resolves his problem.

Regards

Satchfan

 


My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.


#13 satchfan

satchfan

  • Malware Response Team
  • 2,668 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:12:54 PM

Posted 28 October 2015 - 07:14 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users