this sight is set as my home page and if i set another sight and reset my computer it comes back. i cant find it in my hard drive and it wont go away can someone help? the sight that comes up on internet explore is www.quick-search.ws

Your Browser has been Hijacked. Do a system restore to an earlier date to get rid of it. Click on Start/Programs/Accessories/System Tools/System Restore.

Once you get your homepage back, lock it in by doing thr following. Click on Start/Run and type: regedit and click OK. Navigate to: HKEY_USER > .DEFAULT > software > policies > microsoft > internet explorer. Right click on internet explorer key and choose " New key", name it control panel. Right click on control panel, choose new DWORD value, name this "homepage". Right click on "homepage" and choose modify and type in the number 1. This should lock your homepage so no other site can change it. Now navigate to HKEY_CURRENT_USER\software\microsoft\internet explorer\main and look for the start page entry. Check that it is the one u want it to be.

I had the same problem and the system restore worked fine. I tried to prevent jerks like this from doing this again (because I know they will) but there is no Internet Explorer key under Microsoft. Can I just add the IE key along with the control panel key? What can I do? Thanks, Patrick

Here's what I just got done with: (And it works well!) Search Win directory for sys****.exe Check properties of all results The only file the search found which had no MS, author, "cute" icon, or info other than a date created was syschup.exe. After changing IE start page back to blank and removing the maxxxhosters "Quick Search You Can Trust" from IE favorites, I double-clicked syschup.exe. Sure enough, the maxxxhosters junk was re-installed every time I ran syschup.exe. (NOTE: From what I read on this forum in another post, syschup.exe will probably be a different file name on every PC. Hence a search for sys****.exe should find it). Rename suspect sys****.exe file to .doc or ??. Run RegEdit - Search for same original file name. Delete keys containing sys????.exe - Again, may be different on other infected PCs. As I found 4 - 5 syschup.exe registry entries, some were associated with "Ulubione". Net search results said ulubione is a start-up application which changes home & search pages to www.maxxxhosters.com. Searched Reg for ulubione for good measure and canned a whole string with the title ulubione. No more BS and several restarts : ) Not a registry pro but I also suggest locking start page as explained above. Good Luck.

I found 7 files of the form sys????.exe, all formed on the same date, and erased them. this solved the screen hijacking problem, but I found no reference to them in the registry. Am I doing something wrong?

Whoa... Seven? Do not blast systray, sysedit, or anything else that says MicroSoft in its properties. It was late when I posted the last one so I'll run through everything again. The maxxxhosts sys file will be in WINDOWS/SYSTEM32. The worst thing is the purported random filename it creates when it installs. Can alternately do a manual search in WINDOWS/SYSTEM32 folder and right-click all unknown sysXXXX.exe files to check properties. My problem file had no info entered in its properties. Again, MicroSoft sys files are not the culpret (this time). Also, VERY important to test anything suspect before canning it... Change your IE start page to blank and double-click the suspect file(s). Do this for every unknown sysXXXX.exe found. When the IE start page changes to maxxxhosters.com you know you have the right files to rename or delete. Search registry for the suspect file names you found after proving the one(s) that change your settings. Then search registry for " ulubione " If MS RegClean is compatible with your version of Windows it should? (Might) find these keys after the files they point to have been deleted. Alternately, one may run MSCONFIG from START / RUN. The far right tab is StartUp programs. Can un-check anything suspect to see if it cures the problem upon Win restart. Change IE start page to your liking and delete maxxxhosters search from IE favoites. Reboot and check the above. I tried a program called "HijackThis" ( http://mjc1.com/mirror/hjt/ ) which automatically found the problem syschup.exe file. I left it alone at first because it looked like a valid Win file and there wans't enough info returned from HijackThis to make a decision. One could use HijackThis to find files, then test any sysXXXX.exe files as explained above. The author has a good fourum here: http://tomcoyote.org/forums/ipdl.php Since, I have installed "Browser Hijack Blaster" from http://www.wilderssecurity.com/bhblaster.html as well. So far, it has alerted me of two attemts to change IE start and search pages and foiled them. Good Luck! I am hesitant to post email address in any forum (get enough junk-mail already) but I will continue to check this board.