What's happened to my homepage?

[Lensman]

Whenever I try to go to my Yahoo homepage (http://uk.yahoo.com), I get a "Welcome to Nginx" message.
Anybody got any ideas?

 

[sophia8]

Your browser's been hijacked by a trojan virus. Download the free version of Malwarebytes and run a full scan.
You need to do this NOW. The virus is sending your browser history and login info to a remote server, so change all your passwords and other security info.

 

[Lensman]

I've already run Malwarebytes, it found & removed a few pups & I've rebooted, but that nginx is still there.

 

[Sam.I.Am]

Try deleting your hosts file after you've removed any nasty stuff. It might still be redirecting you even after you've removed any malware. Go here for the one that I like to use instead of the generic (as in blank) one Windows comes with.

 

[Lensman]

Thanks for that, I'll take a look at that.

 

[Lensman]

I've copied that host file - same result.
I've done a full scan with Malwarebytes & Microsoft Security Essentials - same result.
I've done 2 system restores, going back to 30th May & then the 22nd May - same result.

WHERE THE HELL HAS THIS NGINX (ENGINE X) COME FROM?????

 

[Moss]

Nginx is a lightweight highscaling webserver. Are you sure it isn't just yahoo having a problem? Because they might use that webserver to serve your homepage.

 

[Modified]

Try TDSSKiller and SUPERAntiSpyware (full scan).

If all else fails and if the problem is in only one browser, disable all add-ons in that browser, and if that fixes the problem, re-enable them until you find the culprit.

 

[Modified]

Nginx is a lightweight highscaling webserver. Are you sure it isn't just yahoo having a problem? Because they might use that webserver to serve your homepage.

I think by "homepage", he meant just http://uk.yahoo.com/.

 

[Wudang]

Or a DNS hijack? Check you DNS server setting (ipconfig /all from command line) and maybe reset to the google DNS servers 8.8.8.8 and 8.8.4.4 or the OpenDNS ones 208.67.222.222 (resolver1.opendns.com)
208.67.220.220 (resolver2.opendns.com)

 

[Lensman]

The navigation bar shows the correct web address (as you can see in the picture I attached).
By Homepage, I mean the web page that displays when I open Internet Explorer.
I've accessed the Yahoo front page using my Kindle web browser & that was OK.
I don't have many browser add-ons, so I'll try disabling them next - thanks for the help.

 

[Lensman]

I've disabled all browser add-ons, accelerators, etc. - same result.

 

[ohms]

Make sure your browser hasn't been set to use a proxy server.

 

[Lensman]

No proxy server.

 

[Sam.I.Am]

Well you can try using Hijack This and post the results here and maybe we will see where the problem might be.

 

[RecoveringYuppy]

Maybe too obvious but: Have you tried resetting your home page to yahoo?

 

[This is The End]

Where's David with his list of what exactly to do.

Perhaps run rkill.exe (from BleepingComputer) then FixTDSS.exe (from Symantic I think?) as well as tdsskiller.exe (from Kaspersky) ....


http://download.bleepingcomputer.co...security/security-utilities/r/rkill/rkill.exe

http://www.symantec.com/content/en/us/global/removal_tool/threat_writeups/FixTDSS.exe

http://support.kaspersky.com/downloads/utils/tdsskiller.exe

Then run kasperskys free virus removal tool:

http://devbuilds.kaspersky-labs.com...11/setup_11.0.0.1245.x01_2012_06_03_10_17.exe

Then maybe do all that again in Admin mode...

ETA: When I run Kaspersky Virus Removal tool I first go to settings tab (the little gear). On Security Scope side-tab check the box next to Local Disk (which is probably C: ) (leave the first 3 checked), and then on Security Level side-tab put the slider all the way up to High, and then on Actions side-tab check Select action: (and make sure both Disinfect and Delete if disinfection fails are checked).

After all that go back to Automatic Scan tab and hit Start Scanning.

Then find something else to do for about an hour.

ETA #2:

If that last link doesn't work you can always find the current version of kasperskys free virus removal tool at this link:

http://www.kaspersky.com/antivirus-removal-tool?form=1

Because they have kept the version number the same for almost a year now (11.0.0.1245.x01) you have to actually start the download and read the file name (Hit Download next to Version 11) to see if it's definitions have been updated.

For instance, as of typing this the file name ends with: 2012_06_03_10_17

 

[This is The End]

Maybe too obvious but: Have you tried resetting your home page to yahoo?

....and when you are all done you will probably have to do that.

 

[Wudang]

The navigation bar shows the correct web address (as you can see in the picture I attached).

Which it would do if your DNS requests were being sent to a rogue server. DNS is the mechanism by which t'interweb translates yahoo.co.uk to a numeric address like 67.215.77.132
C:\Users\rob>nslookup yahoo.co.uk
Server: resolver1.opendns.com
Address: 208.67.222.222

Non-authoritative answer:
Name: yahoo.co.uk.Home
Address: 67.215.77.132

 

[Dancing David]

Nginx is a lightweight highscaling webserver. Are you sure it isn't just yahoo having a problem? Because they might use that webserver to serve your homepage.

That looks like what I can find.