Clon.biz IE highjack

[DougMack]

I have tried the reboot into safe mode and everything
else, but nothing has worked. I checked each process
running while in safe mode and all seemed ok.

MS antispy detects the highjack and removes the entry.
However, using regedit the start page is still set to
clon.biz/search... I n run MS AP as many times as I like,
each time removing the entry, but it always comes back,
right after removing it.

I have manually changed the start page to about:blank,
but if I refresh the editor, it is already back to the
clon.biz.

I really need to get rid of this but everything people
have suggested has NOT worked. I followed the response by
JohnF. under the previous thread and nothing worked.

 

[plun]

DougMack used his keyboard to write :

MS antispy detects the highjack and removes the entry.
However, using regedit the start page is still set to
clon.biz/search...

Hi

Also tried About:Buster ?

http://www.besttechie.net/forums/index.php?showtopic=1488

Then I think its time for HijackThis to solve this and
go to a forum specialized in these logs.

http://www.aumha.org/a/quickfix.htm (step 7)

or one of these.

http://www.merijn.org/forums.html


HijackThis can be downloaded from:

http://www.merijn.org/files/hijackthis.zip

About HijackThis:

http://www.bleepingcomputer.com/forums/index.php?showtutorial=42

 

[Engel]

If you have SpyBot S&D installed, go to the "Immunize"
section.
Is "Lock IE Start Page Settings" ticked?
If so, uncheck it.

If that is not the problem, get and run these programs (if
you test after each one you can stop when the problem is
gone):
Ad-Aware:
http://www.lavasoftusa.com
Once installed make sure to update via online before
scanning!
and
Spybot - Search & Destroy -
http://security.kolla.de/
http://security.kolla.de/index.php?lang=en&page=download
http://spybot.eon.net.au/
http://www.tomcoyote.org/SPYBOT/
Once installed make sure to update via online before
scanning!
and
BHO Demon: http://www.spywareinfo.com/downloads/bhod/

Until the problem is solved.

If you still have problems, some ISP's provide a
customized version of IE. Some Web pages will also reset
your home page and do this. One of the customizations
they might make is to disable the ability to change the
home page, so that you are forced to use their home page.
You can re-enable this by making a small change in the
Windows registry.

In Regedit, navigate to this key:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet
Explorer\Control Panel

In the right-hand pane, right-click the "HomePage" value,
then select Modify. Change it to: 00 00 00 00

Also change either or these to zero 0 instead of 1 if
present:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Policies\Explorer] -
DWORD "NoSetHomePage"=dword:00000001

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet
Explorer\Restrictions] -
DWORD "NoSetHomePage"=dword:00000001

If you don't have this key, browse to:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

and in the right hand pane, double click "Local Page" and
set equal to "C:\WINDOWS\System\blank.htm" (no quotes)
which will hopefully set your Home Page to blank and then
allow you to subsequently modify it using Internet Options.

Exit regedit and reboot.

When you reboot, you should be able to change the home
page again.

Some pages will also download a program which keeps
changing it back. Go to Start | Run and type:
msconfig
and press <Enter> or click OK. Go to the Startup tab.
See if you can identify any suspicious programs. If you
can, uncheck it, If you can't, change the home page to
what you want and then uncheck one and then reboot. Try
IE. If the Web page changed, change it back and then try
msconfig again, rechecking the last one and unchecking the
next. Keep doing this until you find the culprit.

 

[JohnF.]

If you followed my response you would be waiting for a response from Ron
Kinner right now - go back and run Hijackthis and send your logfile to
Ron Kinner.