Homepage hijack

[ruecom]

My home page is being hijacked to
res://hhmhe.dll/index.html and the internet options are
only available from the control panel.
An error states that this operation has been cancelled
due to restrictions in effect on this computer, when I
try to open the internet option fron the Tools Menu in an
open IE window.
A file is created in the "close program window" called
NTTW.exe or NTUY.exe . This program shows up even after
it is deleted, removed from the registry and the startup
items are not selected in msconfig.
Msconfig shows 10 different files in the startup list
that appear to be bogus.
Ad-aware and spybot failed to remove this.
Norton NAV is up to date and doesn't find anything.
HELP ????

 

[H Leboeuf]

Add this tool to your arsenal.

More: Complete list by variant with up-to-date information.
http://www.merijn.org/cwschronicles.html
More: Removal tool: http://www.merijn.org/files/cwshredder.zip


Make sure you have the latest version of AdAware and Spybot and run them
again.

If all fails
Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip the Download file in a NEW FOLDER that you can create before you start
the download.
DO NOT use any of the TEMP folders that are presently in your computer.
Double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html


= Strongly recommended.
Read this: "So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051
=