Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

go. microsoft.com/Link......


  • Please log in to reply
1 reply to this topic

#1 BitsEnd

BitsEnd

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:12:24 PM

Posted 06 February 2009 - 05:15 PM

Greetings,
Two days ago IE 7 began to not connect to any URL I disabled the link scanner in my antivirus and all was well for awhile, then IE 7 craashed and I followed the error reporting link to the KB article on resetting IE so we reset it and now my home page has been hijacked to <http://www.microsoft.com/windows/downloads/ie/getitnow.mspx> which is linked to the following registry key : HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = <http://go.microsoft.com/fwlink/?LinkId=69157> this key appears twice both are identical except for the following key 2 starts HKCU\ and ends with ends with /?Linkid= 54896 I have deleted the keys both with Hijackthis and by a manual registry edit with a re boot and the key(s) keeps appearing in the registry as does the hijacked paged in IE 7. Does anyone have a clue where else this thing is hidden as no matter how you kill it, it comes back like zombie. Yes my original home page is there but you must click the home icon to reach it; home page tabs are not enabled.
AtBitsEnd,
Phil

Edited by Orange Blossom, 06 February 2009 - 10:44 PM.
Deactivate links. ~ OB


BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,046 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:12:24 PM

Posted 06 February 2009 - 10:44 PM

As there are no logs, I am moving this from the HiJack This forum to the Am I Infected forum. ~ OB
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Internet Security, NoScript Firefox ext.


animinionsmalltext.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users