IE hi-jacking.... again!!

  bamfiesler 20:23 08 Dec 03
Locked

My homepage has again been changed by a third party, except this time, when I type in known URLs I get 'click here?' followed by the site I want. I then get'this site has failed to load' with a page of stuff ranging from smut to first-aid (in non- alpha order).Did a sysrestore(XP)which sorted the issue, but I lost some game saves.

I tried looking for what's causing this in the Registry under hkey_current config -> internet settings, but there's nothing apparent.

Any ideas?

  LeadingMNMs 20:27 08 Dec 03

I'm not sure how to fix those problems but I suggest that you either install a firewall or if using XP turn on the Microsoft Firewall.

  bamfiesler 20:36 08 Dec 03

xp firewall turned on. This site has also deposited links into my facs folder in IE; how gallus!!

  muppetmark 20:43 08 Dec 03

you can download Hijack this from click here unzip it run it save the log and post the results click here where we can help with removing hijackers.

  Gaz 25 20:43 08 Dec 03
  bamfiesler 20:51 08 Dec 03

Ok, will attampt. I have Lavasoft earlier version, but will this erase this crap from boot?

  cycoze 20:58 08 Dec 03

Have a read of this page click here explains a lot , there is a link at the bottom of the page for cwshredder to help remove this .

Read the page first ! muppetmark`s suggestion for hijack this is a very good one ! as you may have more than one problem.

  muppetmark 21:01 08 Dec 03

click here for a quick tutorial on Hijackthis, don't try to fix everything a lot will be innocent.

  bamfiesler 22:44 08 Dec 03

wow, what heavy sh*t!

It would appear I have variant 16.

Ok, saved the log; now what? I saw a lot of click here, which is the site I get directed to, although there's so much stuff, I don't wanna go about deleting safe stuff. There are entries for that ehttp.cc address also.............

  Gaz 25 22:55 08 Dec 03

If you download and run the lavasoft adaware it should remove it.

If not we will have to try a manual removal.

  Gaz 25 22:57 08 Dec 03

Here is the removal inst:


Click Start > Run > type regedit and click OK.
Navigate to the following keys and edit any ehttp.cc/? reference back to http://



HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix



HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes

This thread is now locked and can not be replied to.

What is Amazon Go and will it come to the UK? The store without checkouts or queues

1995-2015: How technology has changed the world in 20 years

Why ecommerce hasn't taken off on social media

New MacBook Pro 2016 review | MacBook Pro with Touch Bar review: Apple's expensive and powerful…