Unable to remove http://flex.host-care.com/suspended.page/ from home page

When I open every web page, on title bar it shows the name of fusion ace enterprises. Moreover, the homepage is set to www.fusionace.com. I have tried to remove all these, but no solution found. I am using AVG 8.5t Antivirus, but it fails to solve the problem.  My default homepage was "google.com" , and now it has been automatically changed to fusionace.com, even when I rechange the homepage website, it still automatically changes to http://flex.host-care.com/suspended.page/. How can I fix this??

mathur_sanjuAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

warturtleCommented:
Download SuperAntiSpyware (www.superantispyware.com) or MalwareBytes Anti-Malware (www.malwarebytes.org) and do a scan with either of those to finish the malware infection.
0
mathur_sanjuAuthor Commented:
I have downloaded and run MalwareBytes Anti- Malware but still the same problem . Default web page not changing and every page showing the same Fusion Ace Enterprises message
0
warturtleCommented:
Do you have Spybot installed with TeaTimer on your PC?
0
The Ultimate Tool Kit for Technolgy Solution Provi

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy for valuable how-to assets including sample agreements, checklists, flowcharts, and more!

mathur_sanjuAuthor Commented:
Now I have downloaded both MalwareBytes and Superantispyware but the result is same.
0
warturtleCommented:
Have you scanned in safe mode? or normal mode? Scanning in safe mode (without networking) wouid be more effective generally. Try that and let me know what you get.
0
mathur_sanjuAuthor Commented:
Dear watrturtle
I have 3 antivirus and spyware programmes now namely AVG 8.5, MalwareBytes & Superantispyware.Now you are suggesting me a fourth one from pctools.com.My system has become slow already with 3 programmes.If I will go for 4th one than I thnk my system will hang with so many antispam ware applications.Please help
0
warturtleCommented:
I was suggesting to boot in safe mode, which can be done by pressing F8 repeatedly while the computer is starting, that will show you the boot options, select 'Safe Mode' and then scan with the existing antivirus and anti-spyware utilities that you already have.

I wasn't referring to another spyware suite, by the way.
0
mathur_sanjuAuthor Commented:
Dear warturtle
I have scanned in safe mode now with both MalwareBytes and Superantispyware but the result is same.
0
ITHelpdeskPPSinCommented:
Look's like your hosting provider has suspended the account. You are getting re-directed to this page as the hosting fees might be due.

Speak to your hosting provider 3iX to un-suspend the account.
0
mathur_sanjuAuthor Commented:
This is for sure that this account page is a malware.This has nothing to do with hosting fees or any dues.Is there any way to get rid of?
0
warturtleCommented:
Open SuperAntiSpyware->Preferences->Repairs tab->Home Page reset->Perform Repair. Do that and let me know, if you still have the problem.
0
mathur_sanjuAuthor Commented:
Dear warturtle
I have performed the procedure you have writen -SuperAntiSpyware->Preferences->Repairs tab->Home Page reset->Perform Repair.

Still problem not resolved.

When I am opening any web page take example of experts exhange home page, it is displayed as

Experts Exchange-Fusion | Ace Enterprises-Internet Explorer
0
warturtleCommented:
Please send us a HijackThis log, it can be downloaded from:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

0
mathur_sanjuAuthor Commented:
Dear sir
Please find the log file of hijack This
hijackthislogfile.txt
0
warturtleCommented:
Aha, I see... Press Ctrl+Alt+Delete then click on the processes tab, then select wscript.exe and 'end process'. Then, open SuperAntiSpyware again ->Preferences-> Repairs->Reset Winlogon Shell->Perform Repairs.

Secondly, do you know anything about these IP's?? 202.56.215.54,202.56.215.55,203.122.63.154

The above IP's were taken from the HijackThis log entry:
O17 - HKLM\System\CCS\Services\Tcpip\..\{07825890-596B-443E-8C94-4143B6B03E46}: NameServer = 202.56.215.54,202.56.215.55,203.122.63.154
      
If you are unsure about it, then open HijackThis again and put a tick mark in front of the above entry and 'Fix selected items'. Then reboot your computer and see if you still have the problems.
0
mathur_sanjuAuthor Commented:
Dear sir
I follwed both these instructions but no use.
O17 - HKLM\System\CCS\Services\Tcpip\..\{07825890-596B-443E-8C94-4143B6B03E46}: NameServer = 202.56.215.54,202.56.215.55,203.122.63.154
The above is my settings for the internet, when i put a tick mark in front of above entry and' Fix selected items' after rebooting the system the net stops.
Hence I have to re install this back to run the internet.
I think there is no solution to this problem ? Do I have to format my C drive of the whole machine?
Please help
0
mathur_sanjuAuthor Commented:
While searching the net I came across the following link http://www.securitystronghold.com/gates/darker.html for my problem but I am not sure that this is a genuine link as this can again be a malware.
Dear warturtle thanks for your patience and help.
Hope to have a solution from you
0
warturtleCommented:
Yes, don't worry. Download ComboFix from: http://www.bleepingcomputer.com/combofix/how-to-use-combofix and read the instructions carefully before running ComboFix. I will summarize them below as well:

Disable your antivirus program and then run ComboFix, don't click on the ComboFix window while its running, otherwise it may stall. After ComboFix is finished, then you need to re-enable your antivirus protection and scan with SuperAntiSpyware and then with your own antivirus. Please send that ComboFix log to us as a file attachment for further investigation.

Do that and let us know, how it goes.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mathur_sanjuAuthor Commented:
Dear Warturtle
Thanks a Ton for your help.
After the above procedure of Combofix, I think now the browser is not showing any malware.Your help in removing this malware is highly commandable.You have saved my lot of time by providing the solution.
Please find the attached log file as you have asked for.
Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks,Thanks, ___________________________Sanjay Mathur
log.txt
0
mathur_sanjuAuthor Commented:
Thanks Dear warturtle. Your timely help in resolving the issue has saved a lot of my time and effort.You have provided me the appropriate solution and this is highly commendable.
0
warturtleCommented:
Glad to see that the problem has been resolved :).

You can uninstall ComboFix as follows >

Start > Run > then type "ComboFix /u" (with no quotes, and space between x and / )
Then hit enter.  This will uninstall ComboFix, reset your clock settings, re-hide system hidden files, re-hide the file extensions and reset System Restore.
0
mathur_sanjuAuthor Commented:
Dear Sir
I have uninstalled ComboFix as per your instructions.
Please guide me how to reset  clock settings, re-hide system hidden files, re-hide the file extensions and reset System Restore.
Thanks for your help
Regards
Sanjay Mathur
0
warturtleCommented:
The clock settings shouid have been reset automatically by the OS, I believe. If not, then you can double click on the time in the system tray and then set the appropriate time. You can re-hide the file extensions by opening Windows Explorer >Tools > Folder Options > View > Advanced
Settings->'Hide file extensions for known types'. Select that option.

And uncheck the other option: Show Hidden Files and Folders.

That should do it.

0
mathur_sanjuAuthor Commented:
Dear Sir
All these settings are already there when I opened
The Windows Explorer >Tools > Folder Options > View > Advanced
Settings->'Hide file extensions for known types'. Select that option.
And uncheck the other option: Show Hidden Files and Folders.

Since there is no change as per your instructions and as per System selected options, I think it should not be changed .

Thanks again

Sanjay Mathur
0
warturtleCommented:
Thats good then :).
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.