Discussion Locked

hijacked

0 helpful
5 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
i have been hijacked ( my homepage) i have purchased two spywares. even though they find it and remove the hijacks and spyware; my homepage will go right back to being hijacked. i do see under Task Manager about 3 different *.exe's running that seems to be tied with this hijacking. I cannot get rid of it. Any help would be greatly appreciated!

5 replies

by dmiles

Close Internet Explorer and Outlook Express.

Copy the bold to Notepad. Save as Homepage. reg, and doubleclick it.
Answer 'yes' to have it imported into the registry.

REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"Homepage"=dword:00000000

This should unlock your Home page.

Now go to Control Panel/Internet Options, and clear your temporary Internet files.
Click Settings/show files, and delete your cookies.
Or, if you're running IE 6.0, click 'delete cookies.
Empty your Recycle Bin, and delete everyting in your C:\Windows\Temp folder.

Now go to Control Panel/Internet (options)
Go to the 'Programs' tab, and click 'reset Web Settings'.
Go to the 'Security' tab, and set all ActiveX options that are now set to 'allow', to 'prompt'.
Also uncheck 'Enable install on demand' on the 'advanced' tab.

Now open Internet Explorer, and go to your favorite Start Page.
Go to Internet Options, General tab, and click 'Use current'.

That should do it.
It's important, however to make suree there's nothing in startup that could revert this situation:

Go to Start/run, and type Msconfig. On the Startup tab, look to see if you can find one or more of the following entries:
SWPortal, SWCaller, Sp.dll, winn32.html, runme.hta, reg.hta, adshow.exe , OPQfile, and/or MSKernel32 (Win32.hta).
If you should find one or more of these, uncheck them.
Also anything that has 'regedit.exe/s' in its path.

Now click OK, close Msconfig, and reboot.

Also have your computer virus scanned.
There are malicious scripts like JS.Exception.Exploit which can do that as well.

This discussion is closed to new replies.