homepage hijacked - cannot edit registry !!

[P Whitney]

Some slimeball site has reset my IE home page to munky.com.
The registry setting HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
has been set to munky.com. When I try to edit the key in regedit, I get an
"Error writing the value's new contents". If I try to delete it, I also
get an error. Shareware like "HijackThis" and "StartPageGuard" also are
unable to modify the value. Any Ideas ????

 

[Lanwench [MVP - Exchange]]

Whenever I've seen anything about "munky.com" it's been when I've
accidentally mistyped a URL and been directed to some stupid link site - and
I'm then prompted to "select munky.com" as my homepage, which I immediately
decline. Perhaps you or someone else accidentally clicked Yes or hit Enter
(which defaults to Yes)?

Don't try to do this in the registry. Have you tried using AdAware from
www.lavasoft.de ? Update the reference files and do a full scan. If that
doesn't find it, try Spybot Search & Destroy. I personally prefer the
AdAware interface, and it doesn't detect so many not-very-dangerous things
as Spybot does, but one often catches what the other doesn't, and vice
versa.

 

[Will Denny]

Hi

Try any/all of the following programs to check for and delete any spyware
that may be on your system:

Ad-Aware - www.lavasoftusa.com
Spybot - http://www.safer-networking.org/
CWShredder - http://www.spywareinfo.com/~merijn/downloads.html

 

[Ian]

Definetly a case for CWShredder. I think you will find
that neither Spybot nor Adaware can remove this trogan.
That is because it loads itself in a boot process during
windows. Install CWshredder, run it, and i'll bet you
will regain control of your homepage.

 

[paul]

I would be interested if this does solve your problems, as I have a similiar
one. Alas, AdAware, Spybot, HIjackThis, CWShredder, Trojan Scan, and
editing the registry have all failed. My start page is still set to one
that I used several months back and I can not change it.

Please post the results of you attempt back to the newsgroup, so we can all
be educated.\

Paul.

 

[Guest]

Download Hijack This http://www.majorgeeks.com/downloads31.htm

Please’ post your Hijack This Logs, in any of the following “Expert Forumsâ€
http://forums.tomcoyote.org/index.php?showforum=2
http://forums.net-integration.net/index.php?s=853f186bf90302d57a6840f00475ff6b&showforum=3
http://forums.spywareinfo.com/index.php?s=1413794b9fe306155560c99576acc3a8&showforum=1
http://www.lavasoftsupport.com/index.php?s=c0d583c0e136d2133506ec492cb6bd40&showforum=4
http://www.cybertechhelp.com/forums/forumdisplay.php?f=1
http://boards.cexx.org/viewforum.php?f=1&sid=0b5c7c42dc70e12ffe32f4a0807ff6a
http://www.dslreports.com/forum/security,


----- P Whitney wrote: ----

Some slimeball site has reset my IE home page to munky.com
The registry setting HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
has been set to munky.com. When I try to edit the key in regedit, I get a
"Error writing the value's new contents". If I try to delete it, I als
get an error. Shareware like "HijackThis" and "StartPageGuard" also are
unable to modify the value. Any Ideas ???

 

[P Whitney]

Download Hijack This http://www.majorgeeks.com/downloads31.html

Please’ post your Hijack This Logs, in any of the following “Expert Forumsâ€
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.net-integration.net/index.php?s=853f186bf90302d57a6840f00475ff6b&showforum=32
http://forums.spywareinfo.com/index.php?s=1413794b9fe306155560c99576acc3a8&showforum=11
http://www.lavasoftsupport.com/index.php?s=c0d583c0e136d2133506ec492cb6bd40&showforum=44
http://www.cybertechhelp.com/forums/forumdisplay.php?f=19
http://boards.cexx.org/viewforum.php?f=1&sid=0b5c7c42dc70e12ffe32f4a0807ff6a3
http://www.dslreports.com/forum/security,1


----- P Whitney wrote: -----

Some slimeball site has reset my IE home page to munky.com.
The registry setting HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
has been set to munky.com. When I try to edit the key in regedit, I get an
"Error writing the value's new contents". If I try to delete it, I also
get an error. Shareware like "HijackThis" and "StartPageGuard" also are
unable to modify the value. Any Ideas ????

I've tried everything now. I tried CWShredder - it didn't help.
StartPage Guard looked promising - until I told it to set the Start Page to
blank. Then it returns with an error "RegCreateKeyEx Failed with: 5".
AdAware didn't work either. Neither did "Hijack This". They all fail for,
I believe, the same reason that I cannot delete the key with regedit.
Somehow that key is "locked" or write-protected. I will continue to search
for a solution, but I'm getting discouraged.....

 

[Guest]

I had the same problem. I first used SpyBot Search & Destroy and removed all spyware then I ran Hijack This and set my start page to the page I wanted. This worked.