(Solved) Site moved using Internet Explorer

[VicTully]

Sorry for being a pain, since you guys just helped me with another problem, but I have another issue which just started late last week.

I receive e-mails from Publishers Clearing House (which is OK). Last week I started seeing something strange when I click on a button in their e-mail to go to another page on their site, the page goes elsewhere, which I never received before.

The next page comes up with a "Page Moved" message with a long series of characters. Plus I see that PCH.com has been replaced with spectrum.pch.com.

I have used Anvi Browser Repair Tool, JV16 Power Tools, Glary Utilities, Malwarebytes, & Shane's Tweaking Tool. I have also tried searching the registry for pch.com, spectrum.pch.com, & spectrum. When I found anything, I deleted it.

I also have tried searching the net for the error, but come up with only one site with a repair tool. I also saw that that tool is a scam.

I also did a check disk /R from the tweaking tool.

None of the above would get rid of the problem of the "Page Moved".

Any ideas?

[Boggin]

Hi Vic,

I suggest you contact Publishers Clearing House and ask for clarification.

If this had been a spam e-mail with a button to click, that could have led to Ransomware being installed on your computer, so I hope you are making regular system images which is the only way to counter and ensure you don't have to pay or lose your files.

Run AdwCleaner and Junkware Removal Tool to ensure PCH haven't put any adware onto your computer.

The link for JRT is lower down the AdwCleaner page http://www.bleepingcomputer.com/download/adwcleaner/

JRT runs itself and produces a report of what it has found and removed on completion, but AdwCleaner is a bit more manual.

Click on Scan and that may produce some items in the lower pane and you uncheck the boxes for any you want to keep of those.

When it has completed the scan, click on Report and that will show if it has found anything and which it will remove when you close the report and click on Cleaning.

It will produce another report after the reboot to show what it has removed.

[VicTully]

Boggin,

One of the two programs worked. I don't know which one did it, but the newer e-mails don't have the "move", while the older ones that I got yesterday still have the "move". So, it wasn't part of the e-mail from PCH, but the move apparently got added after I received it.

Thank you so much for your help, again!

I do appreciate everything I get from this site.

vic

[Boggin]

Glad they did the job for you.

I looked up PCH and it put me in mind of Readers Digest and all of the competitions they used to run in an attempt to get people to buy their publications.

I actually won a car vac !

PCH could still have added that link (although I don't know to what end) and that you had pch items in the registry which I wouldn't have thought necessary.

Edit - Although you are probably clear now, just as an added measure run MS's Fixit to reset the Hosts File https://support.microsoft.com/en-us/kb/972034

[VicTully]

Thanks again, my friend!   

[Shane]

ADWcleaner is one of the few tools I have seen that actually cleans out the add ons in firefox, IE and chrome.

And I have seen a wave of add ons getting installed on customer machines that hijack the browser. Redirecting you, injecting ads and so on. And malwarebytes and such never finds them because it doesnt scan the add ons.

Thankfully adwcleaner does and is most likely what was happening on your system, it wasnt an infection of windows, but instead an infection of the browser by an add on

Shane

[VicTully]

Shane,

Thank you for the explanation. That means a lot to me.

I appreciate everything you do here.

vic