MS Explorer hijacked

Have seen this critter before and am trying to remember fix. In the interim, here are some recommendations:

Install, update, and run Ad-Aware SE. Ad-Aware has been greatly improved.

Run Spybot in Advanced Mode and check BHOs under Tools. Then open BHOs and remove any that are suspicious. Won't keep them from being recreated.

Run Spybot and Ad-Aware with System Restore disabled.

If Spybot and Ad-Aware keep finding same files, check names and location and try to delete manually in safe mode.

Dalton

The mal-ware writers are getting craftier.

Many of them specifically block Ad-Aware and SpyBot from removing them.

Another tool is hijack this:

http://www.spychecker.com/program/hijackthis.html

and:

http://www.spywareinfo.com/~merijn/downloads.html

Fighting mal-ware is getting to be as bad as fighting viruses.

Once you clear out the mal-ware, check the ZoneAlarm settings and make sure that they are not listed as allowed programs.

Chas

Thanks guys, my zone alarm does not have any mal ware programs ticked off, and the problem is that spybot does not seem to be able to clean this stuff up. So now, it does not report it, much less clean it.

As suggested I will try advanced options, and I did not think to disable system restore, which I should have done.

If anyone has any specific help on the problem, much appreciated.

Try going to www.webroot.com They have a great spy remover program. They also let you do a free spyware search and distroy on your computer. It is the same company that makes window washer.

What you need is hijackthis, adaware won't remove some of the above because there in your system files and your registry.

You may need to use google and know your services list fairly well.

Try this link
http://forums.majorgeeks.com/forumdisplay.php?s=f30375f8ca323a3f9a6a343dc4bcf7ea&f=35

This will get you started properly and give you experience for next time.

Let us know how you go.

I've seen this before. It is a hijack attempt. Check your tasks for strange entries.

Use the housecall.trendmicro.com site. They will scan remotely for malware.

You are very lucky to not have any worms in your system.

of course you have scoured add/remove programs for unwanted search and toolbars. i say chas, this is way worse than viruses ever were. had recently your symptoms and posted them here. no help from the ususal suggestions so i googled the address i was being hijaaked to and gingerly examined some links (be all patched up first, ok 7?) in my case was malware nicknamed midaddle. google that and see write up of crafty white hat who figured out this program had many reinstallers so you had to root all out to destroy. plus great overview of registry entries that can hijaak you. i followed his instructions and it worked on my customer. he has paypal set up on his site and earns his bucks imho. so post more info.

Go through the registry, search and delete all instances of each. Then clear out your internet history along with Temporary Internet Folder. That should fix your computer.

Always turn off system restore after removing unwanted programs and files or your system may install them again when you reboot.

Hi, THank Chas, I have still not completely gotton rid of it, but Hijack was a great and www.spywareinfo.com have been of great help. I am being helped by the forum there, as this is taking a few more steps than usual!

At least I am on my way to fixing it, thanks

Try adaware:

http://www.lavasoftusa.com/software/adaware/

If it doesn't work, go: Start -> Run -> msconfig -> Start up
Uncheck everything, then reboot. Run adaware again, then go into msconfig and check everything again.

Hope this help,

Lop.com is installed as the Sponsor Program for Messenger Plus!

There's uninstallers online for it. http://lop.com/help.html

mysearch removal instructions:
http://tinyurl.com/52kqk

hijack this is good for finding this crap. But be careful what you remove.

http://www.spychecker.com/program/hijackthis.html

This question was closed by the author