PC Pals Forum

Technical Help & Discussion => Windows PCs & Software: Help, News & Discussion => Topic started by: TOFFEEMAN1878 on December 09, 2005, 13:13

Title: Home page Hijacked!
Post by: TOFFEEMAN1878 on December 09, 2005, 13:13

A friend of mine (in this case it is not me)  has had his homepage hijacked ,I know there is a way to fix this through the registery but I cant remember ,can anyone help ?......Jim

Title: Home page Hijacked!
Post by: Clive on December 09, 2005, 13:37

A good start is to download and run AD-AWARE (http://www.lavasoftusa.com/software/adaware/)

and then SPYBOT SD (http://www.download.com/Spybot-Search-Destroy/3000-8022_4-10122137.html)

If it's still there after that come back and let us know.

Title: Home page Hijacked!
Post by: Scotty_CFC on December 09, 2005, 13:41

I don't know if its the way you're talking about, but I fixed my hijack by editing the following iereset file with notpad. C:\windows\inf\iereset.inf

Title: Home page Hijacked!
Post by: TOFFEEMAN1878 on December 09, 2005, 13:49

It was something like :   Current User > Sofyware>Mircosoft >Windows>Run
then after that I can't remember !!!
                         :x  :x  :x  :x

Title: Home page Hijacked!
Post by: Sandra on December 09, 2005, 16:26

Does resetting it in Tools/Inernet Options not work ?

CWS Shredder is quite good at removing the cool web home page hijacker, if not.

Title: Home page Hijacked!
Post by: Clive on December 09, 2005, 18:16

Resetting it in Tools/Inernet Options usually only works until the next reboot.  CW Shredder is a good idea but also try http://www.x-raypc.com/
which is a registry scanner that will alert you to malware and help to remove it.  If that doesn't work then there are other options available.

Title: Home page Hijacked!
Post by: Hiatus on December 09, 2005, 20:21

HijackThis usually works quite well for those kinds of things...It lists all the current programs/registry values running, you can then select individual parts and delete them. You can also save a log and post it here if need be.

There should be a section like this:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mdg.ca
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico

Which is where the problem will most likely be...

Title: Home page Hijacked!
Post by: TOFFEEMAN1878 on December 10, 2005, 00:20

Hiatus,Thanks for the info........Jim