Did Your Homepage Change and It Says You Have Spyware?

I see several people complaining about their home page being changed and having a warning about being infected with spyware. There are many different web addresses that you will see these pages on, such as perfectedsecurity.com or securityfeature.com. All of them have the same look and style, like the example below. You will be told that spyware is detected on your computer along with some info about your IP address, Internet browser, and current time. This is information that any web site can see, so it is not anything to be worried about.

Usually, you have one of the fake warning pages set as your home page after being infected with what is called SmitFraud. SmitFraud is the general name given to what is more commonly known as SpyAxe, SpyFalcon, SpywareStrike, SpywareQuake, and several other rogue programs. SpyAxe infected many people back in November of 2005 and is probably the best known.

After the spyware gets onto your computer, a pop up warning appears just above your clock in the lower right corner of your desktop. At this point, you have been infected and you will be directed to one of the fake pages if you click it. Your home page will also be changed to one of these pages as well. Below is an example of what they all look like. All of the warnings are false because I took this from my test computer, which had no spyware or virus, or trojans on it. Click the image for the full size version.


There are several ways to fix this problem. Most of the reliable antispyware programs will remove this infection. Spyware Doctor, Sunbelt Counterspy, and Spy Sweeper will target and remove this threat. You can also try using a removal tool developed by one of the antispyware experts S!ri called Smitfraudfix. You can see an example of this free program in a help topic at Spyware Warrior. In the next day or two, I will write a more detailed explanation here in this blog.

This is a list of some of the web addresses that these sites are at. I wouldn't go to these sites. I'm listing them for those people who are trying to find out information on them because their homepage has been changed.

perfectedsecurity.com
securityfeature.com
updatecenter.com
bestsecurityguide.com
necessaryupdates.com