General discussion

Locked

hijacked

By PMidnite ·
i have been hijacked ( my homepage) i have purchased two spywares. even though they find it and remove the hijacks and spyware; my homepage will go right back to being hijacked. i do see under Task Manager about 3 different *.exe's running that seems to be tied with this hijacking. I cannot get rid of it. Any help would be greatly appreciated!

This conversation is currently closed to new comments.

5 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by Joseph Moore In reply to hijacked

Did you give CWShredder a try?
http://www.spywareinfo.com/~merijn/downloads.html

Collapse -

by PMidnite In reply to

Poster rated this answer.

Collapse -

by dmiles In reply to hijacked

Close Internet Explorer and Outlook Express.

Copy the bold to Notepad. Save as Homepage. reg, and doubleclick it.
Answer 'yes' to have it imported into the registry.

REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"Homepage"=dword:00000000

This should unlock your Home page.

Now go to Control Panel/Internet Options, and clear your temporary Internet files.
Click Settings/show files, and delete your cookies.
Or, if you're running IE 6.0, click 'delete cookies.
Empty your Recycle Bin, and delete everyting in your C:\Windows\Temp folder.

Now go to Control Panel/Internet (options)
Go to the 'Programs' tab, and click 'reset Web Settings'.
Go to the 'Security' tab, and set all ActiveX options that are now set to 'allow', to 'prompt'.
Also uncheck 'Enable install on demand' on the 'advanced' tab.

Now open Internet Explorer, and go to your favorite Start Page.
Go to Internet Options, General tab, and click 'Use current'.

That should do it.
It's important, however to make suree there's nothing in startup that could revert this situation:

Go to Start/run, and type Msconfig. On the Startup tab, look to see if you can find one or more of the following entries:
SWPortal, SWCaller, Sp.dll, winn32.html, runme.hta, reg.hta, adshow.exe , OPQfile, and/or MSKernel32 (Win32.hta).
If you should find one or more of these, uncheck them.
Also anything that has 'regedit.exe/s' in its path.

Now click OK, close Msconfig, and reboot.

Also have your computer virus scanned.
There are malicious scripts like JS.Exception.Exploit which can do that as well.

Collapse -

by PMidnite In reply to

Poster rated this answer.

Collapse -

by PMidnite In reply to hijacked

This question was closed by the author

Back to Windows Forum
5 total posts (Page 1 of 1)  

Related Discussions

Related Forums