Help with homepage highjack please
 

Can anyone please help me. I went to a site and when I left it, I got a popup that is asking to change my homepage. I say no, and the popup wont go away. It has highjacked me to their site which is called about blank and it is a search page with spyware advertisements. I ran adaware and spybot, and it wont go away.
I have completey shut down and rebooted and the popup still comes up.
Anyone have a fix, I would certainly appreciate it.
Thanks in advance
Miranda

I used thisNo Spy Xtreme and it removed it.I tried all the others and they won't remove it permanantly.
Also I did this
Turn off your system restore.
You have to disable the active desktop, but it has to be done via the registry. That's the spyware porngraph uses.
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer
Add a DWORD value called NoActiveDesktop and set the data to 1.
Restart, you're set.

Go to http://www.spywareinfo.com/~merijn/cwschronicles.html
look for CWshredder download it and run it. It dosent install to the you computer but only works when you click on it after DL. Hope that does it :thumbsup

LOL what!?!?


It hijacked you and took you to about:blank?

:1orglaugh :1orglaugh

Thank you,
spunky1 and thumbsUP for the quick response and help.


thumbsUP,
I downloaded CWshredder and it removed the following:

Removed from your system:

- CWS.Searchx



It fixed the problem. I really appreciate your help and time. Thanks again.



Miranda

:)

CSW Shredder, kicks ass... glad you fixed the problem. Damn spyware :BangBang:

I found that norton actually removes these things pretty well if your program is up to date.

CSW shredder will not work on this - I got this fucking hijack this week, it is such a pain in the ass to get rid of..........

follow these steps:

The hidden culprit (using Windows XP Pro) that keeps reinfecting the machine is the registry key


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs


You need to remove it. Some folks say to change the registry key value to random characters using the free reglite utility (which may work as well) but I removed the key. The value of the key is hidden and causes Windows to load the trojan DLL every time any application is run.


The way to remove the registry key is not obvious. If you just delete it from regedit, the trojan DLL will undo your handy work. Here's what worked for me:


1. Rename the HLM\Software\Microsoft\Windows NT\CurrentVersion\Windows folder to Windows2.

2. delete the AppInit_DLLs key under the Windows2 folder.

3. Rename the Windows2 folder back to Windows.


Now that AppInit_DLLs is gone, run your favorite spyware/adware utilities such as Adaware 6, CWShredder, and Hijack This. I also run Norton Utilities, which helps if you don't trust your instincts for repairing registry files. Remember, I'm not a geek and just want to use computers & software rather than reinvent them from the ground up.


4. Reboot your machine. Your computer should be free at last.

Yes but about:blank isn't blank it has ad's and pop up's :)

Miranda sorry to tell you but it's going to come back unless you remove it from the registry :)

How do you get into the registry? I have never done that before...

I have XP Home on the machine that is infected.

start > run > type "regedit"

be careful in there, only delete the key mentioned above

then go here:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

look for AppInit_DLLs