home page hijack

[bushpilot]

the home page in my Internet Explorer has been hijacked.
I am running XP with Service Pack 1. My homepage address
has been changed to http://www.fastlook.net/ and when I
try to reset it, it automatically changes back. When I
click on the "Use Blank" button, "about:blank" shows up
in the address field. I have Ad-aware 6.0, Spybot Search
& Destroy and Spyware Blaster on this machine. They seem
to be able to find and remove other ad-ware and even
notify me when an active x file is about to run or when a
registry value is about to change. But they can't fix the
problem I'm having with my home page.

 

[KAS]

Disconnect your compter from the net if you have a
high-speed connection such as cable or dsl.

1) Go to Add/Remove Programs and look for programs that
shouldn't be there. Things such as Hotbar Toolbar, Gator,
etc. These programs should stand out in your mind as ones
that you did not install.

Write down the names of these programs then go ahead and
use Add/Remove to remove them. This WILL NOT completely
remove the program but begins the process.

2) Go onto your hard drive and look for folders which have
the same or similar names to the programs you just wrote
down. Look under C:\Program Files for these folders.

Delete these folders. In some cases you may not be able to
remove the entire folder or parts of their contents. That
is ok. Just be sure that what you are removing is what you
want to remove. If in doubt, leave it in.

3) Go to Start | Run and type in 'regedit' (no quotes).
When your registry comes up do Ctrl-F (Find) and type in
part of the name of one of the programs you are looking
for. For instance, if you have the Hotbar Toolbar you
could simply type in 'hotbar' (no quotes). Click Find Next
and the search begins. When it stops on an entry look at
it closely. Does it have the name of one of the programs
you are looking for? If so, delete that key. Hit F3 to
continue the search.

When you get the message that you are at the end of the
registry do Ctrl-F and repeat the process for the next
piece of spyware/malware. Repeat as necessary.

4) Reboot your machine. When you come back in see if you
can reset your homepage or access the net. Hopefully at
this point you can. If your homepage still won't reset you
need to go back into the registry and search for whatever
page you are being redirected to. Again, just part of the
name is fine. Also recheck your C: to see if there are any
leftover folders which you can remove. If so remove them
and reboot again.

 

[LuckyStrike]

Bushpilot -

Along with the advice offered by KAS, you might wish to look here:
http://computercops.biz/postp257475.html

If you've not yet installed Hijack This, you should. It is the program to
deal with pests of this type.
Hijack this is a very powerful, last resort type of program which is
generally best used in conjunction with help from those who deal with the
findings of the log created by the HijackThis scan. It does nothing in the
scan itself; it merely says what is present and/or running on your PC. The
items must be checked-marked to be "cleaned". You must know *exactly* what
you are checking-off before you proceed. If you don't, you can quite
possibly disable many useful and vital functions of your PC. Remember; read
the Tutorials, and seek help at SpywareInfo Forums, Net-Integration, or
TomCoyote forums for safety's sake.

HijackThis
http://www.spywareinfo.com/~merijn/downloads.html
If the preceding site is down, you may get HijackThis from other sites
Hijack This (from Major Geeks)
http://www.majorgeeks.com/download3155.html
http://www.spychecker.com/program/hijackthis.html
http://computercops.biz/downloads-cat-14.html

HijackThis Tutorials **(MUST READ)**
http://www.spywareinfo.com/~merijn/htlogtutorial.html
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42
http://hjt.wizardsofwebsites.com/
http://s89223352.onlinehome.us/mirror/hjt/

Where to seek help with your HijackThis scan log
SpywareInfo Forums
http://forums.spywareinfo.com/
other help forums for HijackThis:
Net-Integration
http://forums.net-integration.net/index.php?c=19
TomCoyote
http://forums.tomcoyote.com/index.php?showforum=27
--

LuckyStrike
(e-mail address removed)

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm