Home Page Hijacking

[Guest]

I know this problem has been posted numerous times but I am not having any luck solving it. I run Windows XP with all of the critical updates. My Internet Explorer 6.0 Home Page has been forced to something that I do not want and am not sure how it got to be that way. So I set IE to the home page that I want (www.google.com in my case) and go “Tools†“Internet Options†“General†“Use Current†to save it. I can surf around the internet just fine but I get pop-up ads trying to sell me some kind of spy ware-type software nearly constantly. In one earlier posting from Shilpa Singh, he suggests that a restart of the computer while IE is actually accessing the homepage of choice (www.google.com in my case) may be helpful to this problem. So while IE is pointing to google, I restart the computer. Then after the restart is over and before I go on line again I run three programs in this order: CW Shredder (it says “not present†and “not infected†to everything); then Ad Aware 6.0 in Smart Scan mode (it comes up with 14 “new objects†many of which are HKEY files and I delete all 14 of these objects); and finally Spybot Search & Destroy 1.2 and it gives me a clean bill of health (“Congratulations no threats were foundâ€). So now it is time to go back online with IE 6.0 again. But then – you guessed it – I go back to this hijacked Home Page. When I click “Tools†“Internet Options†“General†I see that my www.google.com home page has been overwritten with this strange new home page. Since this home page hijacking behavior and these nearly constant pop-up ads began at the same time yesterday I think that they are related. But I do not know how to get rid of them.

 

[Jan Il]

Hi Gordillo6

You have a hijacker and the programs that you have tried will not get rid of
the hijackware on your system. Do Step 1 first, then go to Step 2. Reboot
and, even if you have already run the programs in Step 2, run the again, as
sometimes they can find items that were 'in use' the first scan. By
rebooting, you will release any 'in use' scumware still lingering now.

Step 1

HiJackThis: - Free

Go to
http://computercops.biz/downloads-cat-14.html ,
or
http://tinyurl.com/2oce8
and download HiJackThis. Unzip to a folder other than your Desktop or the
Temp folder, doubleclick HiJackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button. Press that, save the log some place you remember where it is.
Most of what it lists will be harmless or even required, so DO NOT fix
anything yet.

Open a the copy of your log in NotePad and made a copy. Then you can go here
to post you log:
http://forum.aumha.org/ or http://forums.spywareinfo.com/

<<DO NOT POST YOUR LOG FILE TO THIS NEWSGROUP>>

You will need to register to open a new thread to post you log. It is free,
and no one will Spam you, it is one of many that provides this service. Once
registered, go to the HiJackThis section on the forum list and click to
open. Then start a new post and post your log. The experts there will
analyze the log and report back the results. Please allow at least a few
hours or a days time for a response, depending on when you post the log

Remember, you must return to the HJT site to get your answer. It is a good
idea to click the "Notify" box so that you will get an electronic
notification by e-mail to let you know when a response has been posted.
But, you must still return to the site of your answer

Step 2

It is likely you may still have parasites, spyware, adware, or malware on
your system, which your antivirus will not detect, as it does not have the
same definitions. Download and install, then you *MUST* update the programs
prior to running to be sure they have the latest definitions, then run the
programs below. They are free and very effective. Be sure to run both
SpyBot and Adaware, as what one does not detect the other may. It is
important that you do all the steps and follow all directions carefully:

You can go to the links below to check your system for parasites
http://aumha.org/a/noads.htm
http://inetexplorer.mvps.org/parasite.htm

IMPORTANT:
Before trying to remove spyware, download a copy of LSPFIX from
the URL below - some malware may kill your internet connection when it is
removed, this program will enable you to regain your connection.
http://www.cexx.org/lspfix.htm

It is important that you run the programs in the order that they are listed
here. The first three programs will clear your machine of all other items so
that you can have a clear HiJackThis Log for the experts to read and analyze
for you.

(NOTE: If you can not download these programs from the Internet, if your PC
has CD read capabilities, go to another computer with CD-ROM burning
capabilities. Create a folder on the hard drive of the other computer called
HOLD, download the programs to that folder, then burn that folder to a CD.
Copy the HOLD folder to your HD and then install the programs from there
and run them. After you have IE access again, update all programs where
possible to get the latest definitions and run them again to be sure there
are no lingering items on the system.

CWShredder: Free
http://tinyurl.com/2l9kl
or
http://www.majorgeeks.com/download4086.html

SpyBot Search & Destroy: Free
http://download.com.com/3000-8022-10289035.html?tag=lst-0-2
or
http://majorgeeks.com/download2471.html

AdAware: Free
http://www.lavasoftusa.com/support/download/
or
http://www.majorgeeks.com/downloads31.html

(If needed: AdAware Manual updates only):
Scroll down to Updates Available -
http://lavasoft.element5.com/support/download

Here is information on how to help protect your system:

Practice Safe Hex
http://www.claymania.com/safe-hex.html

"So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051

This program helps control parasites, spyware, adware, and malware that may
get on your system:

SpywareBlaster: Free
http://www.javacoolsoftware.com/spywareblaster.html

Hope this helps.

Jan