Hi Sin - Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13
or here:
http://www.bleepingcomputer.com/files/spyware/hijackthis.zip
There's a good "How-to-Use" tutorial here:
http://computercops.biz/HijackThis.html
In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)
Place HijackThis.exe or unzip HijackThis.zip into its own dedicated folder
at the root level such as C:\HijackThis (NOT in a Temp folder or on your
Desktop), reboot to Safe mode, start HT (have ONLY HT running - IE MUST be
closed) then press Scan. Click on SaveLog when it's finished which will
create hijackthis.log. Now click the Config button, then Misc Tools and
click on Generate StartupList.log which will create Startuplist.txt
Then go to one of the following forums:
Spyware and Hijackware Removal Support, here:
http://forums.spywareinfo.com/
or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949
or Tom Coyote here:
http://forums.tomcoyote.org/index.php?act=idx
or Jim Eshelman's site here:
http://forum.aumha.org/
or Bleepingcomputer here:
http://www.bleepingcomputer.com/
or Computer Cops here:
http://www.computercops.biz/forums.html
Register if necessary, then sign in and READ THE DIRECTIONS at the beginning
of the particular site's HiJackThis forum, then copy and paste both files
into a message asking for assistance, Someone will answer with detailed
instructions for the removal of your parasite(s). Be sure you include at
the beginning of your post a description of "What specific
problem(s)/symptoms you're trying to solve" and "What steps you've already
taken."
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
In
The key are as follow:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersi
on\URL\DefaultPrefix] (Default) = "http://"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersi
on\URL\Prefixes]
(Default)= (value not set)
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Search]
(Default)= (value not set)
"SearchAssistant"="
http://ie.search.msn.com/
{SUB_RFC1766}/srchasst/srchasst.
htm"
"CustomizeSearch"="
http://ie.search.msn.com/
{SUB_RFC1766}/srchasst/srchcust.
htm"
"Default_Search_URL"="
http://www.microsoft.com/isapi/redir.
dll?prd=ie&ar=ies
earch"
[HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\SearchUrl]
(Default)="
http://home.microsoft.com/access/autosearch.asp?
p=%s"
= "+"
# = "%23"
& = "%26"
? = "%3F"
+ = "%2B"
= = "%3D"
provider = ""
[HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\main]
Search Page = "
http://www.microsoft.com/isapi/redir.dll?
prd=ie&ar=iesearch"
Search Bar = "
http://search.msn.com/spbasic.htm"
[HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\URLSearchHooks]
{CFBFAE00-17A6-11D0-99CB-00C04FD64497} = ""
{D7CD08F0-D691-11D8-9669-0800200C9A66} = ""
-----Original Message-----
Hi Sin - Go to Start|Run and enter regedit After it opens,
navigate (just as you would in Windows Explorer) to the following
key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersi
on\URL\DefaultPref ix
After you finally click on DefaultPrefix, please post back and tell
me EXACTLY what it shows in the right hand frame. It should be:
Name Type Data
(Default) REG_SZ http://
Let us know what it shows, please.
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
In
.