IE homepage hijacked

[mickmc]

My homepage has been hijacked and now redirects to a porn site - have tried to fix with Ad-Aware, Spybot, McAfee etc - still no good - any ideas guys

[Less]

Originally Posted by mickmc

My homepage has been hijacked and now redirects to a porn site - have tried to fix with Ad-Aware, Spybot, McAfee etc - still no good - any ideas guys

Sit back & Enjoy!

Seriously though, if you want for example accyweb as your home page, then go to that page, then press tools, then internet options, click use current it should then change the address, then click apply & ok

hope that helps

[WillowTheWhisp]

Won't it let you reset to the default homepage?

[Mick]

Accyweb SHOULD be the default homepage hehe

[steveo]

stop looking at dodgy porn sites is allways a good starting point

[Weary Tourist]

The above answers make an assumption that you can re-point your browser to to the page of your choice using the menu options in the browser.

Whilst this is a possibility for a simple hijack, this will never work in the more malicious and persistant browser hijacks. The comment "have tried to fix with Ad-Aware, Spybot, McAfee etc - still no good " is the clue here.

The more malicious hijacks are very good at putting things back the way they were. So simple fixes will not work.

So how do you solve your problem ?
Well I am not going to tell you, as I do not know your skill level.
If I had a brain tumour I wouldn't let you near me, even if you had some skill with a knife and a turkey.<grin>

What I will do, is point you in a direction so you can understand the problem first, and then you can decide whether you feel comfortable to proceed.

Here is the low down on your problem.
Proceed with caution....
http://www.pcstats.com/articleview.cfm?articleID=1579

[Less]

Originally Posted by Weary Tourist

So how do you solve your problem ?
Well I am not going to tell you, as I do not know your skill level.
If I had a brain tumour I wouldn't let you near me, even if you had some skill with a knife and a turkey.<grin>

What I will do, is point you in a direction so you can understand the problem first, and then you can decide whether you feel comfortable to proceed.

The guy asked for help why, because he is stuck, those of us that want to help will help if we can & the best way is to start off with the simplest solutions to begin with not the most technical & obscure because if you start like that you have more chance of confusing some-one if the simple doesn't fix it he can come back & we can try again eventually some helpful soul or even you might be able to assist once you get your big head out of your fat a**e!

[Weary Tourist]

Forgot to mention I use different browsers depending on my needs.

There is no reason why you should just have the one browser on your PC.
You may wish to consider having a second browser as a backup, in case your preferred browser misbehaves. This will enable you to browse the internet whilst you fix your preferred browser that has been maliciously hijacked.

Consider Opera, or Firefox browsers.....

Firefox
=====
What the BBC said about Firefox:-
http://news.bbc.co.uk/1/hi/technology/3993959.stm

Where to down load it
http://www.mozilla.org/products/firefox/

Opera
=====
A couple of articles about Opera :-
http://networks.silicon.com/webwatch...0005469,00.htm
http://www.theregister.co.uk/2004/03...ognise_speech/
http://uk.builder.com/webdevelopment...9224776,00.htm

Pretty exciting stuff and a glimpse of the future if you use mobile phones, eh?
Makes the IE browser look rather tame, and slow and well due an overhaul.

The trouble is that people like to stick with the familiar, rather than try something new.

You can get rid of the adverts that are present on the free version by buying the full version.

Download Opera here :-
http://www.opera.com/

[Weary Tourist]

Originally Posted by Weary Tourist

If I had a brain tumour I wouldn't let you near me, even if you had some skill with a knife and a turkey.<grin>

I am happy to apologise if the above caused offence. It was an advisory to stay safe within the skills you have. If only computers were simple things.

It will either be a case of "It's all greek to me" or "knockout, I've now got all the information I need to sort it out myself".

The information provided is the right direction to fix your problem, and you may find the forum gives you the right type of support to ask questions and answers.

Good Luck.

[WillowTheWhisp]

Originally Posted by Weary Tourist

The above answers make an assumption that you can re-point your browser to to the page of your choice using the menu options in the browser.

Actually my answer didn't make any such assumption at all.

My answer asked a very basic question, the answer to which would have then led to a further response from me, depending on what the answer was.

As I, like you, didn't know anything about the skill or knowledge level of the person with the problem my initial response was to ask a very basic question.

Sometimes it's easy to fall into the trap of assuming that others we communicate with know what we're talking about but we are all at different levels. I appreciate it when someone more knowledgeable is willing to share information with me and equally I am always happy to try to help others out when and where I can.

I don't want to "talk down" to anyone, on the other hand I don't want to blind somebody with science either. (not much chance of that really where I'm concerned but it has been known to happen)

[WillowTheWhisp]

If you're still having trouble mickmc - PM me and I'll try to help.

[Bazf]

Step-by-step: Reclaiming a hijacked Internet Explorer

Note: These instructions involve editing the registry and other advanced techniques. Do not attempt these procedures without making proper backups (read Backing Up and Restoring the Windows Registry to learn how) and don’t attempt them at all if you’re not familiar with registry editing.

1. If you’ve been hijacked, you can reclaim your browser with a bit of work.

If your Control Panel’s Internet Options have been disabled, get them back by locating the file control.ini (use Start -> Find/Search to locate it). Open control.ini in Notepad and look for the lines:


[don’t load]
inetcpl.cpl=yes

Delete the second of these two lines, close and save the file and reboot your computer. (Click the image below to see a full-sized image.)

1. Close any open Internet Explorer windows.

a. Click Start -> Run, type regedit and click OK to open the Registry Editor.


b. Navigate to:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Inte rnet Explorer

If you find sub-folders called restricted or control panel, delete them. Check for the same sub-folders in:

HKEY_LOCAL_MACHINE\ Software\Policies\Microsoft\Internet Explorer

and delete them, too, if they exist. Then close Regedit.

1. If your search pages have been redirected, re-establish the defaults:

a. Open the Registry Editor and navigate to:


HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

Change the Search Page value to:

http://home.microsoft.com/access/allinone.asp

and, if it exists, change the Search Bar value to:

http://search.msn.com/spbasic.htm

b. Navigate to:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL

and change the default value to:

http://home.microsoft.com/access/autosearch.asp?p=%s

c. Navigate to:

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search

Change the SearchAssistant value to:

http://ie.search.msn.com/{SUB_RFC1766**/srchasst/srchasst.htm

and change the CustomizeSearch value to:

http://ie.search.msn.com/{SUB_RFC1766**/srchasst/srchcust.htm

1. Reset your home page to your chosen page:<LI type=a value=1>In Internet Explorer, choose Internet Options from the Tools Menu and, on the General tab, type in your preferred home page. <LI type=a>Do a search for any files with the extension HTA. If you find any such files, open each in turn in Notepad and see whether they contain a reference to the site which has hijacked your browser. Delete any HTA files which contain such a reference.
2. Locate the file HOSTS (it has no file extension) and open it in Notepad. Once again, look for any reference to the hijacking site. If you find any references, delete the lines containing those references.

1. Use BHODemon to control which Browser Helper Objects (BHOs) are loaded when you open your browser. When you run the program, it will let you know which BHOs are being loaded. Usually, you should see nothing more than Acrobat Reader (Acroiehelper.ocx) and perhaps an anti-virus helper, such as Norton’s NavShExt.dll. If BHODemon reports any other BHOs, click the Details button and then More Details to check the source. If you’re suspicious of any BHO, disable it.

1. a. Click Start -> Run -> msconfig and check the programs under the Startup tab. If you find an entry which contains regedit.exe /s disable it, and disable other programs you know to be suspicious.

b. Still in msconfig, click the System.Ini tab and click the + beside [boot] to expand the section. Look for a line reading shell=explorer.exe. The line should read exactly that; delete any following commands, but make sure you leave shell=explorer.exe intact.


Note: If you’re using Windows NT, 2000 or XP, this information is contained in the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

which should contain the value explorer.exe.

c. Click OK to exit from msconfig and reboot your system.

[mickmc]

Thanks for all that guys, and no fighting in the playground please !!!

I have tried all the basic stuff but it still keeps goin back there !!! - darn naughty computer !!! - will print out the stuff and try some more tech stuff - my skill level is abt that of the operating room sister !!! can do most things if shown where to cut>>>>> !!!

[WillowTheWhisp]

Good luck!

Hope you manage to sort it out successfully and sew it back up again once you've completed the operation.

[Weary Tourist]

Hi mickmc,
Lets start with the basics..
1. What operating system are you using e.g. Windows 95, 98, ME, 2000 XP and what version of IE browser are you using (Click on Help in the menu and About).

2. I guess from your initial post you use McAfee. Can you confirm that your anti-virus definitions are up to date, please.

3. Do you use a software firewall ? Is it McAfee Personal Firewall Plus, or another one, or none at all ?

Why all these questions ?
Well the steps to follow may vary according to what you are using. It will help the guys and girls trying to help you.

There will be other questions after this, and specific tasks you need to do, but let's take it one step at a time.