Computing.Net > Forums > Security and Virus > Highjacked home page''I Can Find It

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Highjacked home page''I Can Find It

Reply to Message Icon

Name: Wren
Date: July 3, 2004 at 13:36:08 Pacific
OS: Windows 2000
CPU/Ram: pentium 2
Comment:

My homepage was highjacked and it leads me to a website ''I Can Find It Search For Pleasure''. And the address reads: C:\WINNT\system32\IEsp.mht

I've tried everything. Nothing seems to work. Please...someone help me.



Sponsored Link
Ads by Google

Response Number 1
Name: JOE
Date: July 3, 2004 at 13:54:05 Pacific
Reply:

I posted this fix a few posts below..

1. Shutdown Internet-Explorer, go to your Taskmanager and kill all processes named IEXPLORE.exe

2. Delete this Files:
C:\WINDOWS\system32\IEsp.mht
C:\WINDOWS\system32\msadocm32.dll
C:\WINDOWS\system32\sqlpool.dll

3. Change the Following Registry-Key to "about:blank" (without quotes)
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

4. Run regedit.exe and delete the following Registry Keys,or Run Hijackthis and Scan and fix ONLY these entries if they exist:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF285}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF285}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF285}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF285}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF285}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0B519E07-7824-4adc-8890-93D5EABBF285}
or execute
reg.exe delete HKLM\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF285}

5. Delete the Value {0B519E07-7824-4adc-8890-93D5EABBF285} from HKEY_CLASSES_ROOT\ADODB.Comand\CLSID\

I recommend using an alternative web browser such as Mozilla firefox.There are more security issues with IE then with MFF.



0

Response Number 2
Name: Wren
Date: July 3, 2004 at 16:29:10 Pacific
Reply:

Wow! It worked! Thanks for the help.


0

Response Number 3
Name: JOE
Date: July 3, 2004 at 17:10:03 Pacific
Reply:

Glad to help.I highly recommend using Mozilla firefox,it will give you alot less headaches.Here is the link if you are interested....

MOZILLA BROWSER


0

Response Number 4
Name: Wren
Date: July 4, 2004 at 10:01:42 Pacific
Reply:

Okay it seems I still have a problem. My homepage is normal now. But everytime I turn on my computer, and when I log onto the internet a ''sex'' icon is created on my desktop. And it doesn't even log me in, it gives me a ''connection error''. It does allow me to get on the internet on the second attempt though.


0

Response Number 5
Name: JOE
Date: July 4, 2004 at 11:05:59 Pacific
Reply:

For the pest to be completly removed, all the files that i listed have to be removed from your system.You can go back and make sure that all the files were removed from your system,that includes your recycle bin,cookies,old files,etc.If all these files were indeed removed?It possible that you have other infections in your system....

First-Run spybot,and Ad-aware in safe mode by tapping the F8 key upon startup,and select SAFE MODE in the menu.Also run your Antivirus in safe mode while your in safe mode to eliminate any possible viruses.After you have completed this,reboot your system in normal mode,and see if you still have the problems.If you still have the icon on your desktop?post back with a hijackthis log and i will take a look at it for you,but make sure you have completed this advice first before posting your log.

Here is a link for hijackthis.Copy and paste your log back into the forum after you have completed the advice.


HIJACKTHIS


0

Related Posts

See More



Sponsored Link
Ads by Google
Reply to Message Icon

Hijacked homepage, can't ... are adaware and spybot sp...



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: Highjacked home page''I Can Find It

Adaware keeps finding IE home page www.computing.net/answers/security/adaware-keeps-finding-ie-home-page-/12544.html

What can i do next? www.computing.net/answers/security/what-can-i-do-next/9770.html

home page hijack - res://rcuib.dll/ www.computing.net/answers/security/home-page-hijack-resrcuibdll/12318.html