Help! Nasty hijacker-related problem

[Matthew Mucklo]

Hi,

Just cleaned a computer of spyware using Spybot S&D, Spy Sweeper, and
Hijack This. Problem is this. Every time I type in "www.hotmail.com"
in the address bar it sends me to "http://www.yahoo.com/"

If I type http://www.hotmail.com/ it works.

If I use netscape 7.1 it works.

But if I type "www.hotmail.com" it doesn't work at all.

Startups are all disabled. Norton Antivirus installed, up-to-date and
scanned latest with no viruses found.

Oh, and the Hosts file is clean, 0 bytes
(c:\winnt\system32\drivers\etc\hosts)

This computer is clean of BHOs and Toolbar buttons according to Hijack
this and ToolBarCop. The only tool bars left listed in ToolBarCop are
"&Links" "&Address" and "&Radio" all of which I'm afraid to delete
should I delete some official part of IE. (For example &Address is
handled by %SystemRoot%\system32\browseui.dll, &Links is handled by
%SystemRoot%\system32\SHELL32.dll, and &Radio is handled by
C:\WINNT\System32\msdxm.ocx.

O/S is Windows XP, IE 6.0.2600.0000.xpclnt_qfe.021108-2107

I'm stumped, puzzeled and need the help of God on this one,

Any of you moved to help, please respond, public or private,

--Matt

 

[Jim Byrd]

Hi Mathew - Check in the Registry here:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix]

The (Default) entry should be:

http://

If not, here's what you need. Copy everything between (but not including)
the ______________ lines. save as, say, URLDefault.reg, and then double
click on it to merge it to the Registry:

________________________

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix]
@="http://"


_________________________



--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Matthew Mucklo]

Hi Jim,

Just checked, DefaultPrefix appears to be "http://" in the registry.

The strange phenomenon is when I type "www.google.com" it goes to
google, however when I type "www.hotmail.com" it goes to
"www.yahoo.com" I mean the address bar just changes the thing I've
typed.

I've even packet sniffed and it never even hits DNS for
www.hotmail.com as far as I can tell. It just rewrites the url,

need help with this one, hope to God someone posts the answer soon,

--Matt

Hi Mathew - Check in the Registry here:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix]

The (Default) entry should be:

http://

If not, here's what you need. Copy everything between (but not including)
the ______________ lines. save as, say, URLDefault.reg, and then double
click on it to merge it to the Registry:

________________________

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix]
@="http://"


_________________________



--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

Hi,

Just cleaned a computer of spyware using Spybot S&D, Spy Sweeper, and
Hijack This. Problem is this. Every time I type in "www.hotmail.com"
in the address bar it sends me to "http://www.yahoo.com/"

If I type http://www.hotmail.com/ it works.

If I use netscape 7.1 it works.

But if I type "www.hotmail.com" it doesn't work at all.

Startups are all disabled. Norton Antivirus installed, up-to-date and
scanned latest with no viruses found.

Oh, and the Hosts file is clean, 0 bytes
(c:\winnt\system32\drivers\etc\hosts)

This computer is clean of BHOs and Toolbar buttons according to Hijack
this and ToolBarCop. The only tool bars left listed in ToolBarCop are
"&Links" "&Address" and "&Radio" all of which I'm afraid to delete
should I delete some official part of IE. (For example &Address is
handled by %SystemRoot%\system32\browseui.dll, &Links is handled by
%SystemRoot%\system32\SHELL32.dll, and &Radio is handled by
C:\WINNT\System32\msdxm.ocx.

O/S is Windows XP, IE 6.0.2600.0000.xpclnt_qfe.021108-2107

I'm stumped, puzzeled and need the help of God on this one,

Any of you moved to help, please respond, public or private,

--Matt

 

[Matthew Mucklo]

Oh My God,

Just stumbled into the answer!

Was lead to look at the Favorites. Lo and Behold, there's a Favorite
called "www.hotmail.com"

Lo and Behold, the properties of that favorite say
"http://www.yahoo.com/"

That is I have a favorite entitled "www.hotmail.com" that points to
"http://www.yahoo.com/"

Autocomplete assumes I'm referencing the favorite when I type
"www.hotmail.com" and sends me to "http://www.yahoo.com/"

Whew, Thank god for that revelation,

--Matt