How I removed hotoffers.info

Reply

Join Date: Jul 2004
Posts: 2,964
Reputation: dlh6213 is on a distinguished road 
Solved Threads: 210
Team Colleague
dlh6213 dlh6213 is offline Offline
Posting Maven

Re: How I removed hotoffers.info

 
0
  #41
Apr 21st, 2005
Try this to get rid of HotOffers:

Get the Pocket Killbox from here:
http://bleepingcomputer.com/files/spyware/KillBox.zip

Unzip the file to your desktop.

Go offline until this is completed (you may wish to print these instructions).

Boot into Safe Mode and do a search for these files and delete any instances found:

param32.dll
guninst.exe
popup_bl.dll
systr.dll
svrhost.exe


If any could not be deleted, (most likely param32.dll), run Pocket Killbox and paste the full file path of file in the box and click on Delete on Reboot. Click on the button with the red circle and an X in the middle; you will get a message saying File will be deleted on next reboot, Process and Reboot now?, Click Yes to reboot. (Note: the 'file path' will be something like C:\WINDOWS\System32\param32.dll)

Scan with hijackthis, and have it fix:

R0 (or R1) - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/this-part-may-vary

Reboot normally and delete any unwanted icons from your desktop.

Empty your Recycle Bin.
Last edited by dlh6213; Jun 9th, 2005 at 3:27 am. Reason: Added killbox info
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 2
Reputation: drourke is an unknown quantity at this point 
Solved Threads: 0
drourke drourke is offline Offline
Newbie Poster

Re: How I removed hotoffers.info

 
0
  #42
May 6th, 2005
Originally Posted by ceomoses
I had gotten hotoffers.info last night, and after 2 hours of running programs like hijack this, cwshredder, ad-aware, Norton, etc., etc., etc., and none of it working, I FINALLY came across a solution that worked.

:!: Warning: BIG SMACK ON HEAD AHEAD :!:

On the bottom of the page on http://www.hotoffers.info/179/index.html is a link labelled "uninstall info". I clicked it and it lead me to this page: http://www.hotoffers.info/uninstall/index.html. Here's what it said:
{
How to uninstall?

1. You need to save file uninstall.exe from our server.

2. You need to launch this file.

3. Then open regedit.exe in your Windows directory. And find HKEY_CURRENT_USER "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UninstallHP.

4. Now please delete UninstallHP folder.

5. Now please write in your command field: regsvr32 /u popup_bl.dll

6. Press OK. You're free of this trojan!
}

I downloaded the file (I uploaded it in thread "Another HotOffers Hijack (HJT log incl)" page 2, and it's not letting me upload it again) and ran the file. My Windows went blank, so I had to reboot. After I rebooted, it wasn't changing my homepage anymore. I didn't even need to follow the other steps (although I might, now that I think of it, just to make sure it's ALL gone). I only tried this once and it worked. I'm not interested in getting the trojan again to see if this works every time, so please reply to this post to let me know if it worked for you so that I can feel good about doing my good deed for the day. :cheesy:

Who would have known that actually paying attention to what was on these stupid ad pages would have been at all beneficial?
i tried this and just got the message that the page is unavailable
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 2
Reputation: drourke is an unknown quantity at this point 
Solved Threads: 0
drourke drourke is offline Offline
Newbie Poster

Re: How I removed hotoffers.info

 
0
  #43
May 6th, 2005
i tried this and just got that the page is unavailable
Reply With Quote Quick reply to this message  
Join Date: Jul 2004
Posts: 2,964
Reputation: dlh6213 is on a distinguished road 
Solved Threads: 210
Team Colleague
dlh6213 dlh6213 is offline Offline
Posting Maven

Re: How I removed hotoffers.info

 
0
  #44
May 7th, 2005
Originally Posted by drourke
i tried this and just got that the page is unavailable
Try the suggestion in post #41.
Links to help you help yourself :

Protect Your PC & Avoid Infections -- http://www.daniweb.com/techtalkforums/thread27519.html

Cleanup Procedures & Tools -- http://www.daniweb.com/techtalkforums/thread27570.html

Infection Removal & HijackThis Use -- http://www.daniweb.com/techtalkforums/thread28196.html
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 1
Reputation: Denboy is an unknown quantity at this point 
Solved Threads: 0
Denboy Denboy is offline Offline
Newbie Poster

Re: How I removed hotoffers.info

 
0
  #45
May 8th, 2005
Does anyone have a copy of this uninstall file they can make available please, the site quoted is now unavailable.

I've had this virus for a week and its driving me nuts!!
Reply With Quote Quick reply to this message  
Join Date: Apr 2005
Posts: 19
Reputation: Weeian is an unknown quantity at this point 
Solved Threads: 0
Weeian Weeian is offline Offline
Newbie Poster

Re: How I removed hotoffers.info

 
0
  #46
Jun 1st, 2005
Denboy,

Do yourself a favour me oul china plate, start your own thread on this one, thats what I had to do, you'll get some '1 on 1'help that way LOL

The procedure is long and boring, scan after scan after scan, removal after removal etc etc and must be honest, in the end I gave up and scrubbed my computer back to the factory settings! BUT, that was after like 6 weeks of posting and actioning (not just on this forum BTW) when I found out that I still had like 3 or 4 viruses at 24 different places on the computer!!

Anyway, get your own post going and very knowledgeable people will respond.

Good Luck, Weeian. LCC
Reply With Quote Quick reply to this message  
Reply

This thread is more than three months old.
Perhaps start a new thread instead?
Message:



Other Threads in the Viruses, Spyware and other Nasties Forum
Thread Tools Search this Thread



Tag cloud for Viruses, Spyware and other Nasties
About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC