Re: HijackWare keeps writing different home page to registry
- From: "Pete" <lansma@xxxxxxxxxxx>
- Date: Fri, 06 May 2005 02:48:18 GMT
Hi and thanks for your responses.
I have followed all your advice (btw, there was no reference to
c:\windows\inetdata or c:\winnit\inetdata on my drive or in HijackThis).
I rescanned with Ad-Aware, Norton AntiVirus, Spybot S&D, and HijackThis
in safe mode and uncovered a number of seemingly minor problems that
were all fixed. Doing this removed the registry entry for
www.search-paga.com that showed up in HijackThis and I could open and
close my browser several times (while not connected to the internet) and
my true home page displayed. Next I rebooted and checked that the home
page was still mine - and it was. Finally, I connected to the net to do
the final test and much to my frustration up came www.search-paga.com
again. It has written itself back to the registry again.
I don't understand any of this because I have used the latest tools to
clean my system and I have Norton AntiVirus and Firewall installed.
Can you provide me any more clues before I literally go insane?
--
All the best,
Pete
------------------------------------------------
Home Page: http://users.bigpond.com/lansma
Location: 42°53'S; 147°19'E
Pete wrote:
> Hi, I have a very tricky problem that involves my ie6 home page
> continuing to default to http://www.search-paga.com/ . I keep changing
> it in ie6 to my true home page and it keeps reverting back to the site
> above. I am convinced this is some type of spyware and I have run
> every piece of antispam, spyware, etc. software I can find including
> the latest versions of Norton Antivirus, Ad-Aware SE, Spybot Search &
> Destroy and HijackThis. Nothing shows although the results for
> HijackThis report the problem as a registry string for the page above:
>
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
> http://www.dellnet.com
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
> http://www.search-paga.com/10079/
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
> http://www.users.bigpond.com/lansma/
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = My
> Internet Explorer
>
> If I change or delete the 2nd string above within HiJackThis or using
> RegEdit, my proper home page fires on the first and possibly the
> second opening of ie6 but beyond that it reverts to
> http://www.search-paga.com/ once more.
>
> I have Googled and found this problem and this site is not uncommon
> but none of the solutions posed including those on the Microsoft
> website pertaining to hijacked home pages have helped with this
> problem.
>
> It seems clear that some application keeps writing
> http://www.search-paga.com/ to the registry but I don't know which
> one or how it is doing this. It is driving me bonkers.
>
> Any help appreciated.
.
- Follow-Ups:
- References:
- Prev by Date: Re: Sound does not work even after system restore
- Next by Date: Re: Ask for help on backup for a third time!
- Previous by thread: Re: HijackWare keeps writing different home page to registry
- Next by thread: Re: HijackWare keeps writing different home page to registry
- Index(es):
Relevant Pages
|
