Hijacked Home Page

A neighbor lady asked me to check out her internet home page because it wasn't
the one she had been using. I went to 'Internet Properties' and under the
general tab found the 'Home page' section was grayed out and
'http://www.searchmircale.com/' was in the address box.

I ended up doing a search in regedit for searchmircale and replaced it with
her original home page. Now when opening IE her page is displayed but when
returning to the 'Home page' section of 'Internet Properties', it's stilled
grayed out.

I'm assuming that I need to remove one of the items I changed in the
registry but not sure which one.

Need help.

IE is v. 6.0 and O/S is XP.

Mike

sbmike

Try SpyBot Search and Destroy or any of the anti spyware programs at
www.download.com also run an antivirus program just in case, and look at
www.getfirefox.com great Web browser without the IE security flaws.

Good luck,

Jose
MCSA, Network+,

A+
"sbmike" <> wrote in message
news:5sWdnSOEc_Ay8FrcRVn-...
>A neighbor lady asked me to check out her internet home page because it
>wasn't the one she had been using. I went to 'Internet Properties' and
>under the general tab found the 'Home page' section was grayed out and
>'http://www.searchmircale.com/' was in the address box.
>
> I ended up doing a search in regedit for searchmircale and replaced it
> with her original home page. Now when opening IE her page is displayed but
> when returning to the 'Home page' section of 'Internet Properties', it's
> stilled grayed out.
>
> I'm assuming that I need to remove one of the items I changed in the
> registry but not sure which one.
>
> Need help.
>
> IE is v. 6.0 and O/S is XP.
>
> Mike
>
>

J Figueredo

HijackThis! should work for this situation. It knows where to look in the
registry for browser-hijacking garbage, and lets you remove it easily.
Hopefully, the combination of this, spybot, and ad-aware can solve the
problem. In my experience, it usually does the trick.

"sbmike" <> wrote in message
news:5sWdnSOEc_Ay8FrcRVn-...
>A neighbor lady asked me to check out her internet home page because it
>wasn't the one she had been using. I went to 'Internet Properties' and
>under the general tab found the 'Home page' section was grayed out and
>'http://www.searchmircale.com/' was in the address box.
>
> I ended up doing a search in regedit for searchmircale and replaced it
> with her original home page. Now when opening IE her page is displayed but
> when returning to the 'Home page' section of 'Internet Properties', it's
> stilled grayed out.
>
> I'm assuming that I need to remove one of the items I changed in the
> registry but not sure which one.
>
> Need help.
>
> IE is v. 6.0 and O/S is XP.
>
> Mike
>
>

Patrick Michael

>
> Its likely that fixing the homepage problem is the least of the issues.
> You'll need to first use at least AdAware and Spybot S&D to clean up the
> nasties in that computer.
>
> Concerning the homepage being greyed out, check your registry for an entry
> like this :
>
> HKEY_CURRENT_USER\Software\Policies\Microsoft\Inte rnet Explorer\
> Control Panel
>
> Or:
>
> HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Int ernet Explorer\
> Control Panel
>
> With a key called "homepage" Set to "1" prevents changes, set to "0"
> allows it. BUT, you don'e need this registry key at all, unless you want
> to add restrictions, just delete the whole Control Panel entry.
>
Another program that might help in this situation is BHO Deamon. The
install file is here:
http://www.pcworld.com/downloads/fil...3611&fileidx=1
Also a very interesting program for those that insist on using IE is
IESPYAD. It puts a bunch of the word offending spyware sites in the IE
restricted list so that all of the insecure activeX type programs just won't
run from those sites.
It can be downloaded from this page:
http://www.pcworld.com/downloads/fil...d,23332,00.asp



AG

AG

"ImhoTech" <> wrote in message
news:...
>
> "J Figueredo" <> wrote in message
> news:GRKxd.12094$. ..
> > Try SpyBot Search and Destroy or any of the anti spyware programs at
> > www.download.com also run an antivirus program just in case, and look at
> > www.getfirefox.com great Web browser without the IE security flaws.
> >
> > Good luck,
> >
> > Jose
> > MCSA, Network+,
> >
>
>
> Hmm..vague reply that hardly even addresses the problem...how original.
>
Hmmm... flame reply that doesn't even address the problem... how profound...

«bonehead;\)

No comment......

J


"ImhoTech" <> wrote in message
news:...
>
> "J Figueredo" <> wrote in message
> news:GRKxd.12094$. ..
>> Try SpyBot Search and Destroy or any of the anti spyware programs at
>> www.download.com also run an antivirus program just in case, and look at
>> www.getfirefox.com great Web browser without the IE security flaws.
>>
>> Good luck,
>>
>> Jose
>> MCSA, Network+,
>>
>
>
> Hmm..vague reply that hardly even addresses the problem...how original.
>

J Figueredo

On Mon, 20 Dec 2004 16:26:28 -0800, "sbmike" <>
wrote:

>A neighbor lady asked me to check out her internet home page because it wasn't
>the one she had been using. I went to 'Internet Properties' and under the
>general tab found the 'Home page' section was grayed out and
>'http://www.searchmircale.com/' was in the address box.
>
>I ended up doing a search in regedit for searchmircale and replaced it with
>her original home page. Now when opening IE her page is displayed but when
>returning to the 'Home page' section of 'Internet Properties', it's stilled
>grayed out.
>
>I'm assuming that I need to remove one of the items I changed in the
>registry but not sure which one.
>
>Need help.
>
>IE is v. 6.0 and O/S is XP.
>
>Mike
>
I have not been on this site but in similar circumstances I went to
the contact section on the help page of the site and sent an email
telling them how ****ed off I was and wanted to remove it. A bot sent
an email back directing me to click on a link that will remove the
software. I'll bet if you contact them they will respond within
minutes via a bot. They probably get thousands of ****ed off people a
day writing them.
Incidentally I have 4 spyware and bot checkers plus an anti virus
programs. None of them removed the hijacker from my system.
Thumper
To reply drop XYZ in address

Thumper

In my experience, adaware and spybot will not remove hijackers. they will
find one or two of the pieces and remove them, then the hijacker will
promptly restore them. problem is that hijackers dump dll's all over the
place, including users docs and settings folder. puts registry entries all
over the place to call the dlls. which then promptly restore everything
adaware and spybot have deleted.

the best automated solution is HjackThis! but it's output is esoteric, so
you have to read the instructions. You _may_ also have to spend a several
hours deleting stuff manually. First, search google and google groups for
your malware -that word shd be replaced with scumware. You will find tons
of references. go read them. some of them will include lists of all the
crap the scumware dumps into your system, and all the registry entries it
makes. keep reading till you feel you have a comprehensive list. then boot
into safe mode. search your hard drive for the dlls and exes and delete
them. search the registry for the for the entries and delete them.
anything you feel nervous about deleting, simply rename. then boot
normally. if behavior is back to normal, you've succeeded. if not, do it
again. if you are like me, by the time you are done, you will have
developed a monumental hatred for the purveyors of these things.

then try running some sort of protection. i'm running bho demon - but i
haven't been to any sleazebag sites in a while, so i don't know how well it
works. and BTW, you can get hijackers by relatively innocent activity, like
following a google link to a site that provides - or says it provides -
discographies.

good luck

Mike



"sbmike" <> wrote in message
news:5sWdnSOEc_Ay8FrcRVn-...
> A neighbor lady asked me to check out her internet home page because it
wasn't
> the one she had been using. I went to 'Internet Properties' and under the
> general tab found the 'Home page' section was grayed out and
> 'http://www.searchmircale.com/' was in the address box.
>
> I ended up doing a search in regedit for searchmircale and replaced it
with
> her original home page. Now when opening IE her page is displayed but when
> returning to the 'Home page' section of 'Internet Properties', it's
stilled
> grayed out.
>
> I'm assuming that I need to remove one of the items I changed in the
> registry but not sure which one.
>
> Need help.
>
> IE is v. 6.0 and O/S is XP.
>
> Mike
>
>

MF

"MF" <> wrote in
news:JvmdnWkaT78JAEzcRVn-:

> In my experience, adaware and spybot will not remove hijackers. they
> will find one or two of the pieces and remove them, then the hijacker
> will promptly restore them. problem is that hijackers dump dll's all
> over the place, including users docs and settings folder. puts
> registry entries all over the place to call the dlls. which then
> promptly restore everything adaware and spybot have deleted.

In Windows XP to correctly remove the spyware / adware and the other
pollution on the system it is advisable to take the following steps to
resolve the problem you point out:

1) Create a restore Point

2) Turn off the Automated System Restore for all partitions

3) Run Spybot and AdAware

4) Reboot

5) Repeat step 3 and 4 until the System is clean

6) Turn Automated System Restore back on for all partitions

Without turning the Automated System Restore off, XP will attempt to
restore those files and registry entries removed by the cleaning tools.

Bum

"Bum" <> wrote in message
news:Xns95CD8A64B4443Bumbummerorg@24.24.2.166...
> "MF" <> wrote in
> news:JvmdnWkaT78JAEzcRVn-:
>
>> In my experience, adaware and spybot will not remove hijackers. they
>> will find one or two of the pieces and remove them, then the hijacker
>> will promptly restore them. problem is that hijackers dump dll's all
>> over the place, including users docs and settings folder. puts
>> registry entries all over the place to call the dlls. which then
>> promptly restore everything adaware and spybot have deleted.
>
> In Windows XP to correctly remove the spyware / adware and the other
> pollution on the system it is advisable to take the following steps to
> resolve the problem you point out:
>
> 1) Create a restore Point
>
> 2) Turn off the Automated System Restore for all partitions
>
> 3) Run Spybot and AdAware
>
> 4) Reboot
>
> 5) Repeat step 3 and 4 until the System is clean
>
> 6) Turn Automated System Restore back on for all partitions
>
> Without turning the Automated System Restore off, XP will attempt to
> restore those files and registry entries removed by the cleaning tools.

Sometimes, I like to run spybot and ad-aware in "safe mode", or "safe mode
with networking" (the latter so I can update and scan all at once). This
ensures that none of the crap is loading in the background.

Patrick Michael