Okay. I have had this problem for the past 4 months. With the address http://81.222.131.49/index.php. I think they call it a hi-jack or something. I delete it over and over. First it was saved under my computer folder as a women's face or something. Then I deleted it. Now it's showing up in my program files under the folder "tscr" or "tcsr" It's one of those. But in the task manager window it comes up as Bett. When I search for it nothing comes up. How do I get rid of it. I've deleted it over and over. But it finds it's way back. I never let the site load up {http://81.222.131.49/index.php} when I first log online. I close the window before it finishes. hELP PLEASE! "truth is beauty"

trubeauty, find a tutorial on homepage highjacking @: http://forum.worldstart.com/showthread.php?t=43513 HTH. Ed in Texas.

Removal instructions below. Remove_the_CWS_Paytimeexe

Ok. Eye've removed the CWS Paytime.exe. and all other files that were on the list. But as soon as Eye log online, it still returns. HOWEVER, Eye am now able to change my homepage address and it doesn't change back, until I log off and log back on again. When Eye run Hijack this file still shows up: O15 - Trusted IP range: 81.222.131.59 (HKLM) Eye've deleted it from the trusted Ip range, but it still comes up. So it's still on my computer. Eye have four other files with HKLM as well. R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id= And they can not be deleted either. Is HKLM a bad thing. Any more suggestions and Thanks for the help! "truth is beauty"

Ok, ignore that last post. Everything is working fine, now. The file O15 - Trusted IP range: 81.222.131.59 (HKLM) is still in the Hijack list though as well as the others. But Eye'm not being redirected anymore. And Eye'm not getting any pop-ups ads anymore! THANK YOU SO MUCH! "truth is beauty"

Download: DelDomains.inf - Right-click and select: Save Target As To use: right-click and select: Install (no need to restart) Note: This will remove all entries in the "Trusted Zone" and "Ranges" also. Info and download below, plus other help that will keep you safe. Good luck and thanks for posting back. http://www.mvps.org/winhelp2002/restricted.htm Hijack prevention tips