| | |
How I removed hotoffers.info
![]() |
•
•
Join Date: Jul 2004
Posts: 2,964
Reputation:
Solved Threads: 210
Try this to get rid of HotOffers:
Get the Pocket Killbox from here:
http://bleepingcomputer.com/files/spyware/KillBox.zip
Unzip the file to your desktop.
Go offline until this is completed (you may wish to print these instructions).
Boot into Safe Mode and do a search for these files and delete any instances found:
param32.dll
guninst.exe
popup_bl.dll
systr.dll
svrhost.exe
If any could not be deleted, (most likely param32.dll), run Pocket Killbox and paste the full file path of file in the box and click on Delete on Reboot. Click on the button with the red circle and an X in the middle; you will get a message saying File will be deleted on next reboot, Process and Reboot now?, Click Yes to reboot. (Note: the 'file path' will be something like C:\WINDOWS\System32\param32.dll)
Scan with hijackthis, and have it fix:
R0 (or R1) - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/this-part-may-vary
Reboot normally and delete any unwanted icons from your desktop.
Empty your Recycle Bin.
Get the Pocket Killbox from here:
http://bleepingcomputer.com/files/spyware/KillBox.zip
Unzip the file to your desktop.
Go offline until this is completed (you may wish to print these instructions).
Boot into Safe Mode and do a search for these files and delete any instances found:
param32.dll
guninst.exe
popup_bl.dll
systr.dll
svrhost.exe
If any could not be deleted, (most likely param32.dll), run Pocket Killbox and paste the full file path of file in the box and click on Delete on Reboot. Click on the button with the red circle and an X in the middle; you will get a message saying File will be deleted on next reboot, Process and Reboot now?, Click Yes to reboot. (Note: the 'file path' will be something like C:\WINDOWS\System32\param32.dll)
Scan with hijackthis, and have it fix:
R0 (or R1) - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/this-part-may-vary
Reboot normally and delete any unwanted icons from your desktop.
Empty your Recycle Bin.
Last edited by dlh6213; Jun 9th, 2005 at 3:27 am. Reason: Added killbox info
•
•
Join Date: May 2005
Posts: 2
Reputation:
Solved Threads: 0
•
•
•
•
Originally Posted by ceomoses
I had gotten hotoffers.info last night, and after 2 hours of running programs like hijack this, cwshredder, ad-aware, Norton, etc., etc., etc., and none of it working, I FINALLY came across a solution that worked.
:!: Warning: BIG SMACK ON HEAD AHEAD :!:
On the bottom of the page on http://www.hotoffers.info/179/index.html is a link labelled "uninstall info". I clicked it and it lead me to this page: http://www.hotoffers.info/uninstall/index.html. Here's what it said:
{
How to uninstall?
1. You need to save file uninstall.exe from our server.
2. You need to launch this file.
3. Then open regedit.exe in your Windows directory. And find HKEY_CURRENT_USER "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UninstallHP.
4. Now please delete UninstallHP folder.
5. Now please write in your command field: regsvr32 /u popup_bl.dll
6. Press OK. You're free of this trojan!
}
I downloaded the file (I uploaded it in thread "Another HotOffers Hijack (HJT log incl)" page 2, and it's not letting me upload it again) and ran the file. My Windows went blank, so I had to reboot. After I rebooted, it wasn't changing my homepage anymore. I didn't even need to follow the other steps (although I might, now that I think of it, just to make sure it's ALL gone). I only tried this once and it worked. I'm not interested in getting the trojan again to see if this works every time, so please reply to this post to let me know if it worked for you so that I can feel good about doing my good deed for the day. :cheesy:
Who would have known that actually paying attention to what was on these stupid ad pages would have been at all beneficial?
•
•
Join Date: Jul 2004
Posts: 2,964
Reputation:
Solved Threads: 210
•
•
•
•
Originally Posted by drourke
i tried this and just got that the page is unavailable
Links to help you help yourself :
Protect Your PC & Avoid Infections -- http://www.daniweb.com/techtalkforums/thread27519.html
Cleanup Procedures & Tools -- http://www.daniweb.com/techtalkforums/thread27570.html
Infection Removal & HijackThis Use -- http://www.daniweb.com/techtalkforums/thread28196.html
Protect Your PC & Avoid Infections -- http://www.daniweb.com/techtalkforums/thread27519.html
Cleanup Procedures & Tools -- http://www.daniweb.com/techtalkforums/thread27570.html
Infection Removal & HijackThis Use -- http://www.daniweb.com/techtalkforums/thread28196.html
•
•
Join Date: Apr 2005
Posts: 19
Reputation:
Solved Threads: 0
Denboy,
Do yourself a favour me oul china plate, start your own thread on this one, thats what I had to do, you'll get some '1 on 1'help that way LOL
The procedure is long and boring, scan after scan after scan, removal after removal etc etc and must be honest, in the end I gave up and scrubbed my computer back to the factory settings! BUT, that was after like 6 weeks of posting and actioning (not just on this forum BTW) when I found out that I still had like 3 or 4 viruses at 24 different places on the computer!!
Anyway, get your own post going and very knowledgeable people will respond.
Good Luck, Weeian. LCC
Do yourself a favour me oul china plate, start your own thread on this one, thats what I had to do, you'll get some '1 on 1'help that way LOL
The procedure is long and boring, scan after scan after scan, removal after removal etc etc and must be honest, in the end I gave up and scrubbed my computer back to the factory settings! BUT, that was after like 6 weeks of posting and actioning (not just on this forum BTW) when I found out that I still had like 3 or 4 viruses at 24 different places on the computer!!
Anyway, get your own post going and very knowledgeable people will respond.
Good Luck, Weeian. LCC
![]() |
Other Threads in the Viruses, Spyware and other Nasties Forum
- Previous Thread: How do I removed hotoffers?
- Next Thread: HELP Windows 98 Homepage Hijacked
| Thread Tools | Search this Thread |
Tag cloud for Viruses, Spyware and other Nasties
adobe adware anti-malware anti-virussitesaccessissue antivirus attack audio avg backtoschoolspeech bar blackhat botnet botnets censorship china combofix commercial commercials conficker connect control crosssitescripting cyber cybercrime ddos domains e-mafia education email europe exam exploit facebook fake fancheckvirus gaming gumblar halloween herss.exe hijack hosting internet kaspersky legal logfiles mail malware mcafee mega-d messagelabs microsoft mobile nazi news obama onlinethreats panel parents patch phishing police policeprovirusmba-mblockedinternetaccess president privacy pro problem redirect redirecting reliability report research risk rogueantivirus rootkit sans scareware school search security seopoisoning software spam spyware spywareexternalwindows7adminstratortrojans sqlinjection symantec threat trojan unwanted update usa virus viruses vista volume warning windows worm yahoo zero-day







