Author Topic: Hijacked! (Read 1143 times)

jon w · « **on:** February 23, 2005, 15:58 »

Help desperately required. I can't even get into my home PC at the moment. My homepage was recently hijacked and a list of pornographic-sounding titles appeared in my Favourites list. Now, when I start it up, I get a window which reads: 'the EREE.EXE file is linked to missing export SHELL32.DLL: StrStrlA'. This lingers for a long time before another window opens, which reads: 'Thank you for being on our website'. The more I try to click these windows to close them, the more windows open, most of them being pop-ups advertising anti-spyware software. This is even happening when I'm not looking at the internet. If I do manage to struggle through as far as running Internet Explorer, the homepage appears for a short time before crashing. I've run Spybot several times, but to no avail. The computer is running Windows ME, and I have a broadband internet connection. I can't run System Restore because I'd disabled it after a virus problem. Does anybody have any suggestions? (Please keep them as simple as possible, I'm no techie!)

Clive · « **Reply #1 on:** February 23, 2005, 16:11 »

Hi Jon and

While you are waiting for a real techie to come along, can I suggest that you download http://www.x-raypc.com/ which will analyse your registry point out what's good and what's bad. Double clicking on the bad stuff will allow you to deactivate it. Let us kow how you get on with that.

jon w · « **Reply #2 on:** February 24, 2005, 11:42 »

Clive, thank you for your quick reply. You may have noticed that I also posted my message in the General Software Help section too, and have had a couple of suggestions from other forum users. As I explained in reponse to them, I'm away from home until next Monday (28 Feb) so I shan't be able to try any of your suggested remedies until then. But thanks for the advice, please check back next week and I'll let you know how I got on. Cheers!

jon w · « **Reply #3 on:** February 25, 2005, 14:15 »

Okay, I've had a chance to look at that link (on my work PC), it looks interesting although I'm a little apprehensive that the findings are going to be beyond my technical understanding. Will it be possible for me to download and run this software with my computer in Safe Mode (I think that's going to be the only way I can boot)?

Sandra · « **Reply #4 on:** February 25, 2005, 14:19 »

Unfortunately Jon you cant get online in safe mode.
The best way would be to download it on another pc and use a floppy if it small enough or a cd as both the floppy and the cd drive will work in safe mode.
Some programs wont install in safe mode whereas some will but some are designed to run from a floppy or a cd, I dont know about that particular one though :?

Sandra · « **Reply #5 on:** February 25, 2005, 14:24 »

One thing that you could try if you cant get the program and run it in safe mode is :
Go into safe mode, go to start then run and type msconfig in the run box.
Open the startup tab and untick anything in there that looks like it may be telling the hijacking prog and popups to load. Click apply and then reboot into normal windows and see if it will allow you to get on line and download the program that Clive suggested or install it if you have managed to download it on another pc

jon w · « **Reply #6 on:** March 04, 2005, 16:47 »

Cheers! Will try this. As you can see, I posted this (original) message in general software advice too. Will report back hopefully next week.

Sandra · « **Reply #7 on:** March 04, 2005, 16:56 »

Cant have too much of a good thing Jon

I will merge the treads later when I get chance