Go to http://www.bleepingcompute
Main Topics
Browse All TopicsI've been dealing with an malware assault of which I may be the winner; the only item left is a recurring redirect in IE 6 that is pointing to http://jl.chura.pl/rc/ and giving me an
HTTP 404 - File not found
Internet Explorer
I have not been able to find whatever is calling up the site.
My question is how do I locate the cause of the redirect and delete it?
Background:
While deleting other malware I ran HijackThis - and the redirect (as a url) is not present.
EDIT: i have included a HJT Report at the end of the background.
Searching around I found that .pl is not listed as a mainstream domain, nor can you buy a url with the domain .pl. Looking further I found this site:
http://www.robtex.com/dns/
I do not understand exactly what the purpose of the site is it does have notices of blacklisted domains and appears to host questionable web sites of many domains perhaps it has something to do with dns, however, they have this to say about themselves:
"zief.pl is a domain controlled by two nameservers at zief.pl themselves. They are on different IP networks. Incoming mail for zief.pl is handled by one mailserver also at zief.pl. zief.pl has one IP record. irc.zief.pl, ns2.zief.pl, ns1.zief.pl, www.zief.pl, dns2.zief.pl and at least five other hosts are subdomains to this hostname. pl is a domain controlled by eight nameservers at pl themselves. All of them are on different IP networks."
I thought the part "at least five other hosts are subdomains to this hostname. pl is a domain controlled by eight nameservers at pl themselves. All of them are on different IP networks" indicated the domain could be a sub-domain, so I attempted to go directly to http://www.zief.pl and AVG Gave me this:
__________________________
Danger: AVG Search-Shield has detected active threats on this page and has blocked access for your protection.
The page you are trying to access has been identified as a known exploit, phishing, or social engineering web site and therefore has been blocked for your safety. Without protection, such as that in the AVG Security Toolbar and AVG, your computer is at risk of being compromised, corrupted or having your identity stolen. Please follow one of the suggestions below to continue.
IP Address: 61.235.117.75
For additional information click here.
Suggestions:
§ Click the Back button on your browser to return to the previous page and choose another link (recommended).
§ If you would like to ignore the warning and continue to the page, click here (not recommended)
__________________________
Certainly would appear that someone from this site is connected with the redirect that IE continues trying to open. (http://jl.chura.pl/rc/)
The site lists the whois info but, I really don't want to go down that rabbit hole . .
I just want to get it off the computer.
My question is how do I locate the cause of the redirect and delete it?
__________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:12:40 PM, on 3/14/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\svchos
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spools
C:\Program Files\Common Files\Acronis\Schedule2\sc
C:\PROGRA~1\AVG\AVG8\avgwd
C:\WINDOWS\system32\CTSVCC
C:\Program Files\Citrix\GoToMyPC\g2sv
C:\Program Files\Google\Common\Google
C:\WINDOWS\System32\svchos
C:\Program Files\Citrix\GoToMyPC\g2co
C:\Program Files\Java\jre6\bin\jqs.ex
C:\Program Files\Citrix\GoToMyPC\g2pr
C:\Program Files\Citrix\GoToMyPC\g2tr
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\AVG\AVG8\avgam
C:\PROGRA~1\AVG\AVG8\avgrs
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\AVG\AVG8\avgns
C:\WINDOWS\system32\svchos
C:\WINDOWS\system32\nvsvc3
C:\Program Files\Photodex\ProShowGold
C:\PROGRA~1\NORTON~1\SPEED
C:\WINDOWS\system32\Tablet
C:\PROGRA~1\AVG\AVG8\avgem
C:\WINDOWS\system32\WTable
C:\WINDOWS\system32\Tablet
C:\Program Files\AVG\AVG8\avgcsrvx.ex
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\Common Files\Logitech\QCDriver\LV
C:\PROGRA~1\Logitech\MOUSE
C:\WINDOWS\system32\RUNDLL
C:\Program Files\Creative\SBAudigy\Su
C:\WINDOWS\system32\Rundll
C:\WINDOWS\system32\BacsTr
C:\Program Files\DU Meter\DUMeter.exe
C:\WINDOWS\system32\CTHELP
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\TWEAKM~1\TMTra
C:\Program Files\Acronis\TrueImageHom
C:\Program Files\Spamihilator\spamihi
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch
C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe
C:\Program Files\iTunes\iTunesHelper.
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Acronis\TrueImageHom
C:\Program Files\Common Files\Acronis\Schedule2\sc
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch
C:\WINDOWS\system32\ctfmon
C:\PROGRA~1\AVG\AVG8\avgtr
C:\Program Files\iPod\bin\iPodService
C:\Program Files\Java\jre6\bin\jusche
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\CPSHelpR
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Skype\Phone\Skype.ex
C:\Program Files\Citrix\GoToMeeting\3
C:\Program Files\Citrix\GoToAssist Express Expert\86\g2ax_start.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Citrix\GoToMeeting\3
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Citrix\GoToMeeting\3
C:\Program Files\Citrix\GoToAssist Express Expert\86\g2ax_comm.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Citrix\GoToAssist Express Expert\86\g2ax_launcherexp
C:\Program Files\Citrix\GoToAssist Express Expert\86\g2ax_uiexpert.ex
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\TechSmith\Snagit 9\Snagit32.exe
C:\Program Files\VCOM\PowerDesk\pddlg
C:\Program Files\TDK\TDKLauncher\TDKL
C:\Program Files\TechSmith\Snagit 9\TSCHelp.exe
C:\Program Files\TechSmith\Snagit 9\SnagPriv.exe
C:\Program Files\TechSmith\Snagit 9\snagiteditor.exe
C:\WINDOWS\System32\svchos
C:\Program Files\Citrix\GoToMyPC\g2ma
C:\Program Files\Citrix\GoToMyPC\g2ho
C:\Program Files\Citrix\GoToMyPC\g2pr
C:\Program Files\Citrix\GoToMyPC\g2au
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgscanx.ex
C:\Program Files\AVG\AVG8\avgcsrvx.ex
C:\Program Files\Trend Micro\HijackThis\HijackThi
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-F
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-F
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-2
O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1
O2 - BHO: TweakMASTER PRO Component - {7DAAC7DE-9EF0-4FF0-BFA5-A
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-E
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0
O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [MXO Auto Loader] C:\WINDOWS\MXOALDR.EXE
O4 - HKLM\..\Run: [LVCOMS] "C:\Program Files\Common Files\Logitech\QCDriver\LV
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSE
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "c:\Documents and Settings\John\Local Settings\Temp\NAV\Support\
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IM
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IME
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\System32\IME\P
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\System32\IME\T
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\System32\IME\T
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTr
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROG
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Su
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [bacstray] BacsTray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\Update
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\Update
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TweakMASTER] C:\PROGRA~1\TWEAKM~1\TMTra
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHom
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgd
O4 - HKLM\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihi
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.
O4 - HKLM\..\Run: [GoToMyPC] "C:\Program Files\Citrix\GoToMyPC\g2sv
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHom
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\sc
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtr
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusche
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.ex
O4 - HKCU\..\Run: [GoToMeeting] C:\Program Files\Citrix\GoToMeeting\3
O4 - HKCU\..\Run: [GoToAssist Express Expert] "C:\Program Files\Citrix\GoToAssist Express Expert\86\g2ax_start.exe" "/Trigger RunAtLogon"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\John\Application Data\mjusbsp\cdloader2.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICR
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICR
O4 - Startup: Dialog Helper.lnk = C:\Program Files\VCOM\PowerDesk\pddlg
O4 - Startup: TDK Launcher.lnk = C:\Program Files\TDK\TDKLauncher\TDKL
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: High Impact eMail 4.0 Professional.lnk = C:\Program Files\High Impact eMail 4.0\SendBatchMails.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Snagit 9.lnk = C:\Program Files\TechSmith\Snagit 9\Snagit32.exe
O6 - HKCU\Software\Policies\Mic
O8 - Extra context menu item: Add to &LinkFox - res://C:\PROGRA~1\TWEAKM~1
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-5
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-5
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprov
O15 - Trusted Zone: http://www.dmiteamtraining
O15 - Trusted Zone: http://www.glycosystem.com
O15 - Trusted Zone: http://www.myisagenixteam.
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9
O16 - DPF: {17492023-C23A-453E-A040-C
O16 - DPF: {230C3D02-DA27-11D2-8612-0
O16 - DPF: {5C86F808-EDD2-4E5D-9C4F-E
O16 - DPF: {6414512B-B978-451D-A0D8-F
O16 - DPF: {6E32070A-766D-4EE6-879C-D
O16 - DPF: {9B8D3E79-A732-4EC0-AEEE-8
O16 - DPF: {ED28050F-D713-43BA-A376-D
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-4
O16 - DPF: {FE5B9F54-7764-4C01-89F0-4
O17 - HKLM\System\CCS\Services\T
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-F
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrss
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\sc
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgem
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwd
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSVCC
O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2sv
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSpt
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.ex
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.e
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc3
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveS
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMedia
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEED
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet
--
End of file - 17168 bytes
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Go to http://www.bleepingcompute
Looks like a DNS hijacker , as well as a possible W32.Virut.h infection , the reason I am mentioning Virut is the site hxxp://jl.chura.pl/rc/
htt
https://ww
O17 - HKLM\System\CCS\Services\T
if this is not your name server, then Combofix should solve this
other tools that will certainly help in this issue.
SDfix (run in safe mode, option 2 will fix DNS hijack, option 1 is general scan)
download the files from a clean machine if possible, rename them first & transfer to the infected machines.
If the issue persists, and there is indeed a W32.Virut.h infection, please run your scans in safe mode, also be prepared to either reinstall any applications that gets corrupt, or resinstall your OS if a lot of damage was done, the reason this is a possibility is because this particular virus can detroy executables beyond repair in some cases.
the key with cleaning Viruses is to run the scan in safe mode and be prepared to either restore from backup if needed or reinstall any applications that are damaged.
First off I apologize for not getting back sooner; actually I did split points earlier and for some reason the question is still here. I also wrote a detailed explanation which I do not have a copy of, so here is my best recall.
PsychoFelix your was the first to be attempted. I did find the url (http://jl.chura.pl/rc/) in the directory: c:\windows\system32\driver
However, after removing those files the problem persisted (at least within my machine) in that EVERY html file in all of my web sites was appended with the instruction to go to that url.
I cleared out all the BHOs that were not obviously a problem and then had to get back to work on a late project.
Next I worked on Admin3ks instruction. After reading about virut on the two supplied links I purchased and ran malwarebytes as well as SuperAntiVirus (from dos) and this found both Trojans and malware. Some of them were in the Windows Restore folders and by turning off restore points they were finally gone from the system.
The info on virut certainly had me concerned if I would win this one.
I ran a global search and replace for all html files on my web site folders to remove the redirect over 1,800 occurrences! And while this did work (which I am grateful) the bad part is that ALL the file dates were changed to the modification date, so it is now harder to determine the files history.
Thanks you both for your information.
Business Accounts
Answer for Membership
by: PsychoFelixPosted on 2009-03-14 at 22:51:35ID: 23889934
check your c:\windows\system32\driver s\etc\host s file for any redirects and remove them..
then if thats clean run regedt32 and search entire registry for "chura" and you'll find it somewhere relating to your homepage etc.. clean that out and you'll be free of that issue at least..