Hijacked Homepage in Internet Explorer

Discussion in 'Computer Support' started by Ian Henderson, Apr 14, 2004.

  1. Hi

    I think I have picked something up along the way that keeps changing my
    homepage to http://www.wholeworldmarket.com/search/top/ after a reboot.

    I have run a full scan for viruses (MaAfee) and a scan for spyware using
    AdAware.

    Does anyone have any ideas how I can get rid of this please?

    Thanks, Ian.
     
    Ian Henderson, Apr 14, 2004
    #1
    1. Advertising

  2. On Wed, 14 Apr 2004 20:06:22 GMT, "Ian Henderson" <> wrote:

    >Hi
    >
    >I think I have picked something up along the way that keeps changing my
    >homepage to http://www.wholeworldmarket.com/search/top/ after a reboot.
    >
    >I have run a full scan for viruses (MaAfee) and a scan for spyware using
    >AdAware.
    >
    >Does anyone have any ideas how I can get rid of this please?
    >

    Have you tried Spybot yet?
     
    Shane Matthews, Apr 14, 2004
    #2
    1. Advertising

  3. "Shane Matthews" <> wrote in message
    news:...
    > On Wed, 14 Apr 2004 20:06:22 GMT, "Ian Henderson" <> wrote:
    >
    > >Hi
    > >
    > >I think I have picked something up along the way that keeps changing my
    > >homepage to http://www.wholeworldmarket.com/search/top/ after a reboot.
    > >
    > >I have run a full scan for viruses (MaAfee) and a scan for spyware using
    > >AdAware.
    > >
    > >Does anyone have any ideas how I can get rid of this please?
    > >

    > Have you tried Spybot yet?


    No I haven't. It's running now though. Thanks.
     
    Ian Henderson, Apr 14, 2004
    #3
  4. Ian Henderson

    °Mike° Guest

    Download, update and use *all* of the following:

    Spybot Search & Destroy
    http://spybot.eon.net.au/
    http://www.safer-networking.org/
    http://spybot.safer-networking.de/
    SpyBot S&D guide
    http://www.chem.wisc.edu/~network/spybot/

    Ad-Aware
    http://www.lavasoftusa.com/
    http://www.lavasoft.nu/

    Spyware Blaster
    http://www.wilderssecurity.net/spywareblaster.html
    http://www.javacoolsoftware.com/spywareblaster.html
    http://www.net-integration.net/tools/spywareblaster.html

    CWShredder (CoolWebSearch remover)
    http://www.spywareinfo.com/~merijn/cwschronicles.html
    http://www.spywareinfo.com/~merijn/files/cwshredder.zip


    On Wed, 14 Apr 2004 20:06:22 GMT, in
    <2Rgfc.3745$>
    Ian Henderson scrawleE:

    >Hi
    >
    >I think I have picked something up along the way that keeps changing my
    >homepage to http://www.wholeworldmarket.com/search/top/ after a reboot.
    >
    >I have run a full scan for viruses (MaAfee) and a scan for spyware using
    >AdAware.
    >
    >Does anyone have any ideas how I can get rid of this please?
    >
    >Thanks, Ian.
    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Apr 14, 2004
    #4
  5. "Ian Henderson" <> wrote in message
    news:u1hfc.3756$...
    >
    > "Shane Matthews" <> wrote in message
    > news:...
    > > On Wed, 14 Apr 2004 20:06:22 GMT, "Ian Henderson" <> wrote:
    > >
    > > >Hi
    > > >
    > > >I think I have picked something up along the way that keeps changing my
    > > >homepage to http://www.wholeworldmarket.com/search/top/ after a reboot.
    > > >
    > > >I have run a full scan for viruses (MaAfee) and a scan for spyware

    using
    > > >AdAware.
    > > >
    > > >Does anyone have any ideas how I can get rid of this please?
    > > >

    > > Have you tried Spybot yet?

    >
    > No I haven't. It's running now though. Thanks.
    >
    >


    SpyBot has finished its check and I have removed the items it recommended.
    After a reboot, I checked the Home Page, and it has been changed to
    wholeworldmarket.com again. I run SpyBot again, and it found 3 things (it
    found them the first time and I removed them) again.

    These 3 items are listed as "Possible hijacker: User settings" and 2
    "Possible hijacker: Global settings". They then go on to list registry
    entries in Local Machine and Users, which are \Software\Microsoft\Internet
    Explorer\Styles and then
    \User Stylesheet=
    \Use My Style sheet=W=0
    and \User Stylesheet=

    These registry entries may be completely unrelated, but any help in removing
    this annoying thing that keeps changing my homepage is appreciated.
     
    Ian Henderson, Apr 14, 2004
    #5
  6. Ian Henderson

    °Mike° Guest

    On Wed, 14 Apr 2004 20:56:47 GMT, in
    <jAhfc.3791$>
    Ian Henderson scrawleE:

    <snip>

    >SpyBot has finished its check and I have removed the items it recommended.
    >After a reboot, I checked the Home Page, and it has been changed to
    >wholeworldmarket.com again. I run SpyBot again, and it found 3 things (it
    >found them the first time and I removed them) again.
    >
    >These 3 items are listed as "Possible hijacker: User settings" and 2
    >"Possible hijacker: Global settings". They then go on to list registry
    >entries in Local Machine and Users, which are \Software\Microsoft\Internet
    >Explorer\Styles and then
    >\User Stylesheet=
    >\Use My Style sheet=W=0
    >and \User Stylesheet=
    >
    >These registry entries may be completely unrelated, but any help in removing
    >this annoying thing that keeps changing my homepage is appreciated.


    Install HijackThis and post the FULL contents of your
    log here.

    HijackThis
    http://www.tomcoyote.org/hjt/
    http://mjc1.com/mirror/hjt/
    http://www.spywareinfo.com/~merijn/files/hijackthis.zip


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Apr 14, 2004
    #6
  7. <snip>


    Thanks for your help guys. It's gone! CW Shredder did it. Thanks for the
    tip °Mike°.
     
    Ian Henderson, Apr 14, 2004
    #7
  8. Ian Henderson

    °Mike° Guest

    On Wed, 14 Apr 2004 21:25:04 GMT, in
    <Q_hfc.3812$>
    Ian Henderson scrawleE:

    ><snip>
    >
    >
    >Thanks for your help guys. It's gone! CW Shredder did it. Thanks for the
    >tip °Mike°.


    You're welcome.


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Apr 14, 2004
    #8
  9. Ian Henderson

    gangle Guest

    "°Mike°" wrote
    > Download, update and use *all* of the following:
    >
    > Spybot Search & Destroy
    > http://spybot.eon.net.au/
    > http://www.safer-networking.org/
    > http://spybot.safer-networking.de/
    > SpyBot S&D guide
    > http://www.chem.wisc.edu/~network/spybot/
    >
    > Ad-Aware
    > http://www.lavasoftusa.com/
    > http://www.lavasoft.nu/
    >
    > Spyware Blaster
    > http://www.wilderssecurity.net/spywareblaster.html
    > http://www.javacoolsoftware.com/spywareblaster.html
    > http://www.net-integration.net/tools/spywareblaster.html
    >
    > CWShredder (CoolWebSearch remover)
    > http://www.spywareinfo.com/~merijn/cwschronicles.html
    > http://www.spywareinfo.com/~merijn/files/cwshredder.zip


    I downloaded CWShredder. 5 minutes later, I shit my pants.
    Coincidence? I don't think so. Jesus H. Christ.
     
    gangle, Apr 15, 2004
    #9
  10. Ian Henderson

    °Mike° Guest

    On Thu, 15 Apr 2004 01:34:39 -0700, in
    <>
    gangle scrawled:

    >"°Mike°" wrote
    >> Download, update and use *all* of the following:


    <snip>

    >> CWShredder (CoolWebSearch remover)
    >> http://www.spywareinfo.com/~merijn/cwschronicles.html
    >> http://www.spywareinfo.com/~merijn/files/cwshredder.zip

    >
    >I downloaded CWShredder. 5 minutes later, I shit my pants.
    >Coincidence? I don't think so. Jesus H. Christ.


    You must have downloaded the extra fibre version, you
    foolish person, you.

    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Apr 15, 2004
    #10
  11. Ian Henderson

    Santa Guest

    "Ian Henderson" <> wrote in message
    news:2Rgfc.3745$...
    > Hi
    >
    > I think I have picked something up along the way that keeps changing my
    > homepage to http://www.wholeworldmarket.com/search/top/ after a reboot.
    >
    > I have run a full scan for viruses (MaAfee) and a scan for spyware using
    > AdAware.
    >
    > Does anyone have any ideas how I can get rid of this please?
    >



    Delete \winnt\system\sysdll32.exe

    Delete \winnt\sstyle.css

    Delete: SOFTWARE\Microsoft\Windows\Current Version\Run\sysdll32

    Delete or clean:

    Software\Microsoft\Internet Explorer\Styles\

    Open Internet Options->Programs->Reset Web Settings or you can open regedit
    and search for www.wholeworldmarket.com

    Check "Favorities" for unwanted items.

    You may also need to re-install Windows Media Player since apparently
    it infects it also.

    Also, administrative contact for www.wholeworldmarket.com is
    Roman, Roman
    Wholeworldmarket.Com
    Central Street 7
    Baku 370001
    Azerbaijan
    +994562120045 Fax --

    You can sign him up for you favorite "penis enlargment" mailing list.
     
    Santa, Apr 16, 2004
    #11
  12. Ian Henderson

    Tim Sargent Guest

    Yes... Simplist is to download Ad-Aware from www.download.com

    Very easy to use and it scans ur system for spyware... im pretty sure you
    will be amazed at what it picks up!


    "Santa" <> wrote in message
    news:zqKfc.51876$...
    >
    >
    > "Ian Henderson" <> wrote in message
    > news:2Rgfc.3745$...
    > > Hi
    > >
    > > I think I have picked something up along the way that keeps changing my
    > > homepage to http://www.wholeworldmarket.com/search/top/ after a reboot.
    > >
    > > I have run a full scan for viruses (MaAfee) and a scan for spyware using
    > > AdAware.
    > >
    > > Does anyone have any ideas how I can get rid of this please?
    > >

    >
    >
    > Delete \winnt\system\sysdll32.exe
    >
    > Delete \winnt\sstyle.css
    >
    > Delete: SOFTWARE\Microsoft\Windows\Current Version\Run\sysdll32
    >
    > Delete or clean:
    >
    > Software\Microsoft\Internet Explorer\Styles\
    >
    > Open Internet Options->Programs->Reset Web Settings or you can open

    regedit
    > and search for www.wholeworldmarket.com
    >
    > Check "Favorities" for unwanted items.
    >
    > You may also need to re-install Windows Media Player since apparently
    > it infects it also.
    >
    > Also, administrative contact for www.wholeworldmarket.com is
    > Roman, Roman
    > Wholeworldmarket.Com
    > Central Street 7
    > Baku 370001
    > Azerbaijan
    > +994562120045 Fax --
    >
    > You can sign him up for you favorite "penis enlargment" mailing list.
    >
    >
    >



    ---
    Outgoing mail is certified Virus Free.
    Checked by AVG anti-virus system (http://www.grisoft.com).
    Version: 6.0.648 / Virus Database: 415 - Release Date: 31/03/2004
     
    Tim Sargent, Apr 16, 2004
    #12
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Motorhead Lawyer

    Atolotl hijacked my Yahoo homepage?

    Motorhead Lawyer, Jan 7, 2005, in forum: Firefox
    Replies:
    8
    Views:
    756
    John Thompson
    Jan 13, 2005
  2. Puzzled

    hijacked homepage

    Puzzled, May 20, 2004, in forum: Computer Support
    Replies:
    1
    Views:
    438
    =?ISO-8859-1?Q?R=F4g=EAr?=
    May 21, 2004
  3. caroline

    Homepage Hijacked

    caroline, Nov 6, 2006, in forum: Computer Support
    Replies:
    5
    Views:
    700
    Richard
    Nov 6, 2006
  4. Jimi

    Hijacked Homepage

    Jimi, Dec 2, 2006, in forum: Computer Support
    Replies:
    7
    Views:
    417
    Leythos
    Dec 2, 2006
  5. fred

    Internet explorer, homepage hijacked

    fred, Oct 23, 2008, in forum: Computer Support
    Replies:
    0
    Views:
    440
Loading...

Share This Page