Got it. It worked for me too. It wouldn't do the regsvr command though. But I have control over my home page again. Thanks man.

I had gotten hotoffers.info last night, and after 2 hours of running programs like hijack this, cwshredder, ad-aware, Norton, etc., etc., etc., and none of it working, I FINALLY came across a solution that worked.

:!: Warning: BIG SMACK ON HEAD AHEAD :!:

On the bottom of the page on http://www.hotoffers.info/179/index.html is a link labelled "uninstall info". I clicked it and it lead me to this page: http://www.hotoffers.info/uninstall/index.html. Here's what it said:
{
How to uninstall?

1. You need to save file uninstall.exe from our server.

2. You need to launch this file.

3. Then open regedit.exe in your Windows directory. And find HKEY_CURRENT_USER "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UninstallHP.

4. Now please delete UninstallHP folder.

5. Now please write in your command field: regsvr32 /u popup_bl.dll

6. Press OK. You're free of this trojan!
}

I downloaded the file (I uploaded it in thread "Another HotOffers Hijack (HJT log incl)" page 2, and it's not letting me upload it again) and ran the file. My Windows went blank, so I had to reboot. After I rebooted, it wasn't changing my homepage anymore. I didn't even need to follow the other steps (although I might, now that I think of it, just to make sure it's ALL gone). I only tried this once and it worked. I'm not interested in getting the trojan again to see if this works every time, so please reply to this post to let me know if it worked for you so that I can feel good about doing my good deed for the day. :cheesy:

Who would have known that actually paying attention to what was on these stupid ad pages would have been at all beneficial? ;)

PLEASE CONFIRM! Step #5 - write in command field - does that mean that I type that file name under start-run then hit ok or am i supposed to go under start-programs-msdos prompt ????? please please tell me.

Hi there!
After days of trying to get that crappy hotoffers off my nieces computer and trying all the programs you did, I finally got rid of it thanks to you! :)
So feel good about yourself, you have helped someone. Thanks again.

webrat

I had gotten hotoffers.info last night, and after 2 hours of running programs like hijack this, cwshredder, ad-aware, Norton, etc., etc., etc., and none of it working, I FINALLY came across a solution that worked.

:!: Warning: BIG SMACK ON HEAD AHEAD :!:

On the bottom of the page on http://www.hotoffers.info/179/index.html is a link labelled "uninstall info". I clicked it and it lead me to this page: http://www.hotoffers.info/uninstall/index.html. Here's what it said:
{
How to uninstall?

1. You need to save file uninstall.exe from our server.

2. You need to launch this file.

3. Then open regedit.exe in your Windows directory. And find HKEY_CURRENT_USER "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UninstallHP.

4. Now please delete UninstallHP folder.

5. Now please write in your command field: regsvr32 /u popup_bl.dll

6. Press OK. You're free of this trojan!
}

I downloaded the file (I uploaded it in thread "Another HotOffers Hijack (HJT log incl)" page 2, and it's not letting me upload it again) and ran the file. My Windows went blank, so I had to reboot. After I rebooted, it wasn't changing my homepage anymore. I didn't even need to follow the other steps (although I might, now that I think of it, just to make sure it's ALL gone). I only tried this once and it worked. I'm not interested in getting the trojan again to see if this works every time, so please reply to this post to let me know if it worked for you so that I can feel good about doing my good deed for the day. :cheesy:

Who would have known that actually paying attention to what was on these stupid ad pages would have been at all beneficial? ;)

OK guys, I've been following this thread as I am another unfortunate who has been taken over by Hotoffers! My problem with the uninstall is that when I click the link in their site to download the uninstall.exe file I get the usual 'downloading' box (the one with the globe and file and paper floating back and forth) but no progress bar for the download nor any estimated time to download complete or in fact any details about the download in progress!!

I have let the download run for 1 hour and gave up although I intend to try it again. Should it take this long to download the uninstall.exe file from their server?? (I am using dial up!)

Help please!!!!

Weeian. Please do the following then start your own thread and we will fix you up the old fashioned way :).

Download the Pocket KillBox
Unzip the file to your desktop.

Go offline until you have completed all the below.

Run Pocket Killbox and paste the full file path of the below file in the box and click on Standard File Kill and End Explorer Shell While Killing File. Click on the button with the red circle and an X in the middle after you enter the file.

C:\WINDOWS\System32\systr.dll

Reboot afterwards if the files are successfully deleted.

If the file is not deleted, do not reboot yet. Run Pocket Killbox again and paste the full file path in the box and click on Delete on Reboot. Next click on the button with the red circle and an X in the middle. You will get a message saying "File will be deleted on next reboot, Process and Reboot now?" Click "Yes" to reboot.

Download HijackThis selfextracting zip version from here. Once downloaded, double click on the file & it will install into it's own, permanent folder.
Start HJT & press the "Do a system scan and save a log file" button. When the scan is finished a window will pop up giving you the option of where to save it. Save it to desktop where it is easy to access. Open the log file and copy the entire contents of the file & paste it into the body of your post. DO NOT FIX ANYTHING YET. Most of what is there is necessary for the running of your system.

Remember to post your log in your own thread :).

Cheers Crunchie, I'll ginve this a go when I get home. On my work computer at the mo!! Must admit at this stage I'm a real no hoper on the technical side of things although your instructions seem pretty straight forward. I'll post my HJT log in a new thread but will post that I have done this in this thread so as to alert you to it. Cheers again.

i hate to be the stupid one but i have the ame problem i downloaded uninstaler now the problem starts i dont understand what to do next if you could tell me pretend your speaking to an 8 year old! i got lost from here

2. You need to launch this file.

3. Then open regedit.exe in your Windows directory. And find HKEY_CURRENT_USER "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UninstallHP.

???????????

thank you

Ok i did 1. i tried to launch the file when i double clicked or go to run nothing happens, i reinstalled it clicked on it nothing happend, so anywas i wen to 3. did that did 4 as well now number 5 where is the comand field??? thanks you


1. You need to save file uninstall.exe from our server.

2. You need to launch this file.

3. Then open regedit.exe in your Windows directory. And find HKEY_CURRENT_USER "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UninstallHP.

4. Now please delete UninstallHP folder.

5. Now please write in your command field: regsvr32 /u popup_bl.dll

6. Press OK. You're free of this trojan!

Try this to get rid of HotOffers:

Get the Pocket Killbox from here:
http://bleepingcomputer.com/files/spyware/KillBox.zip

Unzip the file to your desktop.

Go offline until this is completed (you may wish to print these instructions).

Boot into Safe Mode and do a search for these files and delete any instances found:

param32.dll
guninst.exe
popup_bl.dll
systr.dll
svrhost.exe

If any could not be deleted, (most likely param32.dll), run Pocket Killbox and paste the full file path of file in the box and click on Delete on Reboot. Click on the button with the red circle and an X in the middle; you will get a message saying File will be deleted on next reboot, Process and Reboot now?, Click Yes to reboot. (Note: the 'file path' will be something like C:\WINDOWS\System32\param32.dll)

Scan with hijackthis, and have it fix:

R0 (or R1) - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/this-part-may-vary

Reboot normally and delete any unwanted icons from your desktop.

Empty your Recycle Bin.

I had gotten hotoffers.info last night, and after 2 hours of running programs like hijack this, cwshredder, ad-aware, Norton, etc., etc., etc., and none of it working, I FINALLY came across a solution that worked.

:!: Warning: BIG SMACK ON HEAD AHEAD :!:

On the bottom of the page on http://www.hotoffers.info/179/index.html is a link labelled "uninstall info". I clicked it and it lead me to this page: http://www.hotoffers.info/uninstall/index.html. Here's what it said:
{
How to uninstall?

1. You need to save file uninstall.exe from our server.

2. You need to launch this file.

3. Then open regedit.exe in your Windows directory. And find HKEY_CURRENT_USER "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UninstallHP.

4. Now please delete UninstallHP folder.

5. Now please write in your command field: regsvr32 /u popup_bl.dll

6. Press OK. You're free of this trojan!
}

I downloaded the file (I uploaded it in thread "Another HotOffers Hijack (HJT log incl)" page 2, and it's not letting me upload it again) and ran the file. My Windows went blank, so I had to reboot. After I rebooted, it wasn't changing my homepage anymore. I didn't even need to follow the other steps (although I might, now that I think of it, just to make sure it's ALL gone). I only tried this once and it worked. I'm not interested in getting the trojan again to see if this works every time, so please reply to this post to let me know if it worked for you so that I can feel good about doing my good deed for the day. :cheesy:

Who would have known that actually paying attention to what was on these stupid ad pages would have been at all beneficial? ;)

i tried this and just got the message that the page is unavailable

i tried this and just got that the page is unavailable

i tried this and just got that the page is unavailable

Try the suggestion in post #41.

Does anyone have a copy of this uninstall file they can make available please, the site quoted is now unavailable.

I've had this virus for a week and its driving me nuts!!

Denboy,

Do yourself a favour me oul china plate, start your own thread on this one, thats what I had to do, you'll get some '1 on 1'help that way LOL

The procedure is long and boring, scan after scan after scan, removal after removal etc etc and must be honest, in the end I gave up and scrubbed my computer back to the factory settings! BUT, that was after like 6 weeks of posting and actioning (not just on this forum BTW) when I found out that I still had like 3 or 4 viruses at 24 different places on the computer!!

Anyway, get your own post going and very knowledgeable people will respond.

Good Luck, Weeian. LCC

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.