Re: HijackWare keeps writing different home page to registry

"Pete" <lansma@xxxxxxxxxxx> wrote:

>Hi, I have a very tricky problem that involves my ie6 home page
>continuing to default to http://www.search-paga.com/ . I keep changing
>it in ie6 to my true home page and it keeps reverting back to the site
>above. I am convinced this is some type of spyware and I have run every
>piece of antispam, spyware, etc. software I can find including the
>latest versions of Norton Antivirus, Ad-Aware SE, Spybot Search &
>Destroy and HijackThis. Nothing shows although the results for
>HijackThis report the problem as a registry string for the page above:
>
>R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
>http://www.dellnet.com
>R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
>http://www.search-paga.com/10079/
>R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
>http://www.users.bigpond.com/lansma/
>R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = My
>Internet Explorer
>
>If I change or delete the 2nd string above within HiJackThis or using
>RegEdit, my proper home page fires on the first and possibly the second
>opening of ie6 but beyond that it reverts to http://www.search-paga.com/
>once more.
>
>I have Googled and found this problem and this site is not uncommon but
>none of the solutions posed including those on the Microsoft website
>pertaining to hijacked home pages have helped with this problem.
>
>It seems clear that some application keeps writing
>http://www.search-paga.com/ to the registry but I don't know which one
>or how it is doing this. It is driving me bonkers.
>
>Any help appreciated.

Check for additional entries in your HiJackThis listing.

1. Remove any items that refer to c:\windows\inetdata or
c:\winnit\inetdata

2. Open the Process Manager in HiJackThis and kill any running
process that is from the items in (1).

Good luck


Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

In memory of a dear friend Alex Nichol MVP
http://aumha.org/alex.htm
.