Hijacked Homepage in Internet Explorer

Discussion in 'Computer Support' started by Ian Henderson, Apr 14, 2004.

  1. Hi

    I think I have picked something up along the way that keeps changing my
    homepage to http://www.wholeworldmarket.com/search/top/ after a reboot.

    I have run a full scan for viruses (MaAfee) and a scan for spyware using
    AdAware.

    Does anyone have any ideas how I can get rid of this please?

    Thanks, Ian.
     
    Ian Henderson, Apr 14, 2004
    #1
    1. Advertisements

  2. Have you tried Spybot yet?
     
    Shane Matthews, Apr 14, 2004
    #2
    1. Advertisements

  3. No I haven't. It's running now though. Thanks.
     
    Ian Henderson, Apr 14, 2004
    #3
  4. Ian Henderson

    °Mike° Guest

  5. SpyBot has finished its check and I have removed the items it recommended.
    After a reboot, I checked the Home Page, and it has been changed to
    wholeworldmarket.com again. I run SpyBot again, and it found 3 things (it
    found them the first time and I removed them) again.

    These 3 items are listed as "Possible hijacker: User settings" and 2
    "Possible hijacker: Global settings". They then go on to list registry
    entries in Local Machine and Users, which are \Software\Microsoft\Internet
    Explorer\Styles and then
    \User Stylesheet=
    \Use My Style sheet=W=0
    and \User Stylesheet=

    These registry entries may be completely unrelated, but any help in removing
    this annoying thing that keeps changing my homepage is appreciated.
     
    Ian Henderson, Apr 14, 2004
    #5
  6. Ian Henderson

    °Mike° Guest

    On Wed, 14 Apr 2004 20:56:47 GMT, in
    <jAhfc.3791$>
    Ian Henderson scrawleE:

    Install HijackThis and post the FULL contents of your
    log here.

    HijackThis
    http://www.tomcoyote.org/hjt/
    http://mjc1.com/mirror/hjt/
    http://www.spywareinfo.com/~merijn/files/hijackthis.zip
     
    °Mike°, Apr 14, 2004
    #6
  7. <snip>


    Thanks for your help guys. It's gone! CW Shredder did it. Thanks for the
    tip °Mike°.
     
    Ian Henderson, Apr 14, 2004
    #7
  8. Ian Henderson

    °Mike° Guest

    You're welcome.
     
    °Mike°, Apr 14, 2004
    #8
  9. Ian Henderson

    gangle Guest

    gangle, Apr 15, 2004
    #9
  10. Ian Henderson

    °Mike° Guest

    You must have downloaded the extra fibre version, you
    foolish person, you.
     
    °Mike°, Apr 15, 2004
    #10
  11. Ian Henderson

    Santa Guest


    Delete \winnt\system\sysdll32.exe

    Delete \winnt\sstyle.css

    Delete: SOFTWARE\Microsoft\Windows\Current Version\Run\sysdll32

    Delete or clean:

    Software\Microsoft\Internet Explorer\Styles\

    Open Internet Options->Programs->Reset Web Settings or you can open regedit
    and search for www.wholeworldmarket.com

    Check "Favorities" for unwanted items.

    You may also need to re-install Windows Media Player since apparently
    it infects it also.

    Also, administrative contact for www.wholeworldmarket.com is
    Roman, Roman
    Wholeworldmarket.Com
    Central Street 7
    Baku 370001
    Azerbaijan
    +994562120045 Fax --

    You can sign him up for you favorite "penis enlargment" mailing list.
     
    Santa, Apr 16, 2004
    #11
  12. Ian Henderson

    Tim Sargent Guest

    Yes... Simplist is to download Ad-Aware from www.download.com

    Very easy to use and it scans ur system for spyware... im pretty sure you
    will be amazed at what it picks up!
     
    Tim Sargent, Apr 16, 2004
    #12
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.