Thanks for the help, but I wasn't able to find the right one, if that's where the problem lies...I did a search for all .xml files like you suggested, and came up with 403 of them. So I sorted by folder, and ignored the ones I figured would be safe, like the ones in my PCHEALTH/HELPCTR folder, and my HEWLITT PACKARD folder for my printer, and that sort of thing...and MUSICMATCH...do you think that WINAMP3 might be the culprit? There were a lot in that folder that I didn't check... So anyway, I opened close to 50 of the other ones up in notepad and did a "find" function looking for "http:", thinking that it must have that code in there if it's opening up a new browser window and going to that website on it's own, but couldn't find anything. I even did a few looking for "www", with no results that weren't something I recognized... Any other ideas where to look? I should have mentioned this: I am getting this at random...the "click here" box shows up, then a couple seconds later, my browser window opens, and goes to that
www.uslanmaz.com website, no matter how many times I reset my home page or the fact that I have an IE Home Page Shield working...very frustrating!! Thanks for all your help, by the way...
----- Dan wrote: -----
I too had this...
What it is, is this...a program has stuck an XML file somewhere on your
machine, this file contains lists of various websites. You need to locate
this file and delete it and your problem will go away. I doubt the file will
be called the same thing, however the best way to locate it is to do a
search for all XML (*.xml) files on your hard drive...look for the dates
they were modified and open them up in notepad and look for the web address
you keep getting sent to. If that address appears in the file...bingo your
problem is solved. As a guidence the file I removed was located in the
system32 directory...but if you search anywhere within the Windows directory
you're likely to find it...also check your user folder.
Good luck and let me know how you got on...or if you need further help.
Mike said:
I also have a similar situation. I have been hijacked by something that
sets my default homepage to "uslanmaz" which is a different language
altogether. I also get a popup box that lays on top of all my other open
windows that just says "click here". I must close these two windows
manually before I can see any other of my open windows. AdAware and Search
and Destroy are installed on my system and run fine, but do not recognize
the problem. I have done sweeps and defrags and emptied out my cookies and
everything seems clear, but the problem persists. I have more than one
person set up as logon I.D.s and they all get the same thing at the same
time. Any ideas?