Question

Locked

Default IE Page changing by itself continously

By anilkool ·
I have a strange phenomena on 4-5 pcs on network. 2 things happen
1. The default homepage of IE goes to http://talk2namratha.googlepages.com
2. This IE window popsup every few minutes also.

Yes, have done many checks ..using spyare scanning, registry checks,,manually changing home page in registry.. tried to make the user normal user instead of admin..tried some IE Lock software ..none are working..hijackthis was run etc etc..tried to change hosts file to point towww.google.com (whew) ..and could not do anything than blockthis webpage in proxy.

I found a file called winscheduler.exe in somepcs and delete it to solve it. few pcs dont have this file at all and still popup with this hijacked homepage.

If i google the website talk2namratha.googlepages.com for spyware etc.., it goes to i do not see anything anywhere..and the website looks genuine..but why is it buggin my homepage and even popping everynow and then..

Friends..looking for a solution desperately..

Thanks
anilkool

This conversation is currently closed to new comments.

4 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

Spyware can be so educational.....

by robo_dev In reply to Default IE Page changing ...

the 'big hammer' approach is to re-image the PC or use system restore to go back in time.

the more subtle approach is to dig thru your HJT logs very carefully, and install the 'Process Explorer' utility (from Winternals, now part of Microsoft). Also, run FileMon and RegMon to watch for file creation and registry changes.

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx


another crazy approach would be to install SandBoxie and run the hijacked browser in a sandbox...it will show you very quickly what registry hives and files are getting created/modified.

With some digging, you will spot the subdirectory the file is getting written to....

do a dir /OD to see what files got modified last in each directory...that will help you to find where the app is hiding.

Collapse -

Does the name "ibibo.com" mean anything to you ? ...

by OldER Mycroft In reply to Default IE Page changing ...

Your problem page comes up like a rash, whenever anyone accesses IBIBO which appears to be some form of social networking site for the Indian Continent.

If you frequent this site, this may be the source of your troubles.

Collapse -

Download this

by Snuffy09 In reply to Default IE Page changing ...

superantispyware

Not only does it do a good job of cleaning up your spyware but it also contains a feature that allows you to lock your homepage.

Good luck

mike

Back to Networks Forum
4 total posts (Page 1 of 1)  

Related Discussions

Related Forums