SOLVED My PC has been hijacked by Imageplus.com

[aintnorock]

My Internet Explorer spontaneously opens periodically and goes to imageplus.com.

This is curious because I don't even use Internet Explorer. I've tried changing the internet options/settings to clear the home page, but it fills up again. This is very annoying. Anyone know how to stop it?

thanks,
Carl

 

[Norton]

You said "I've tried changing the internet options/settings to clear the home page"
Is that within the Browser using Tools > Options?

Have you tried setting your default browser using Windows 10 default app settings.
Open Win 10 settings > System > Default Apps > Web Browser. Select your current browser as default.

 

[aintnorock]

I've done that. My default browser is Chrome, that's why I'm confused that IExplorer opens.

 

[Norton]

I run Firefox and on rare occasions when I'm searching the net it automatically opens Edge, can't say for sure if my search terms were MS related or not. I haven't had a problem in months.
When I first installed Windows 10 my browser (Firefox) was hi-jacked by malware "WinYahoo" it's a malicious website. WinYahoo would always open Chrome Browser (not the version your running) and redirect me to unwanted sites, in the main "liveadexchange.com. Malwarebytes would block "liveadexchange.com and flagged it as a malicous web site. I contacted Malwarebytes Help Team who were very accommodating. To make a long story short Mambam had me perform the following:
1. Update Mambam. Then click on settings > Detection and Protection, you will see a heading "Non Malware Protection" PUP & PUM. From the drop down box (PUP & PUM) select each to "Treat detections as malware"
Next run Malwarebytes

2. Next download FRST64.exe (Farbar Recovery San Tool) and save it to my desktop.
http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
Download link for 32-bit version
Download link for 64-bit version
When FRST.exe is run it saves a log file to the same folder on the desktop (It identified WinYahoo).
If the tool warns you the version is outdated, please download and run the updated version.
• Click the Fix button just once, and wait.

3. Next Download Junkware Removal Tool to my desktop and run the program.
http://downloads.malwarebytes.org/file/jrt
NOTE:
Download Junkware Removal Tool to your desktop.
http://downloads.malwarebytes.org/file/jrt
Note: Don’t run it if you have Wondershare, ParetoLogic or MyPCBackup products, it will delete them! *
Shutdown your antivirus to avoid any conflicts.
Right-mouse click JRT.exe and select Run as administrator
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.

4. Next Download AdwCleaner, save it to your desktop and run it.

https://toolslib.net/downloads/viewdownload/1-adwcleaner/

Following the above identified, cleaned and deleted WinYahoo successfully.

Caution I would create a manual restore point and perform a system image before proceeding with the above. Read the JRT Log carefully to be sure what it actually wants to delete has your approval before hitting the delete button. It will delete .exe files should they be in libraries (My Docs) or wrong locations foe .exe files.
Good luck! If you have any doubts about performing the above contact the Malwarebytes help team. They are very helpfull and will assign a tech to walk you through the removal process.

 

[aintnorock]

I have purchased and loaded Malwarebytes. Then I ran it, and it found a bunch of junk. I have not experienced any problems since. When I have a bit more time, I may run the rest of what you suggested.


thanks very much for your help.

Carl

 

[Norton]

Carl Good for you.
Malwarebytes is a powerful and very effective tool. As far as running the other programs, I would put a hold on that unless imageplus.com. resurfaces or you run into problems down the road. I doubt that it will have any (Malware) more problems now your running Mambam Premium.
I'm curious, did you by chance change your Mambam settings as mentioned above? "click on settings > Detection and Protection, you will see a heading "Non Malware Protection" PUP & PUM. From the drop down box (PUP & PUM) select each to "Treat detection's as malware"

@Norton

 

[Blue2day]

My Chrome browser was hijacked by this URL before. And I fixed it by changing something in the properties of Chrome browser shortcut that has been affected. Make sure the Target line should have this
Internet Explorer “C:\Program Files\Internet Explorer\iexplore.exe”
Chrome “C:\Program Files\Google\Chrome\Application\chrome.exe” for Windows 32 bit
OR “C:\Program Files (x86)\Google\Chrome\Application\chrome.exe” for Windows 64-bit
Firefox “C:\Program Files\Mozilla Firefox\firefox.exe” for Windows 32-bit
OR “C:\Program Files (x86)\Mozilla Firefox\firefox.exe” for Windows 64-bit.

I found the manual methods in this post tell how to deal with such malware. But not sure the security software mentioned in it is useful or not. I believe Malwarebytes should have fixed your problem.
Hope this info do the trick.

 

[aintnorock]

I have purchased and loaded Malwarebytes. Then I ran it, and it found a bunch of junk. I have not experienced any problems since. When I have a bit more time, I may run the rest of what you suggested.


thanks very much for your help.

Carl

Done and Done. I have not had additional problems, thanks for the help.

 

[acme]

My Internet Explorer spontaneously opens periodically and goes to imageplus.com.

This is curious because I don't even use Internet Explorer. I've tried changing the internet options/settings to clear the home page, but it fills up again. This is very annoying. Anyone know how to stop it?

thanks,
Carl

-----------------------

I had the same problem, just use 'Hit Man Pro' paid. You can set it up to scan anytime and it will find all the bad annoying mess. It doesn't do real time, just scans what ever time you want.... it works!