Homepage Hijack

[Korky]

My homepage was taken over last night along with bargain buddy being ingraved in the system. Ive removed bargain buddy but CANNOT get this f**king www.i-lookup.com off my homepage, u change it - it changes it back, you change regedit values and lock them - it changes it, i used several programs including adaware - no help.

IS it possible to get rid of this scum?

[Swafe]

mine goes to indredifind

or some other rubbish site when i type in a wrong url - or get page ant be displayed, proper annoying

[Moby-Dick]

have you run a copy of spybot - search & destroy ?

its good at getting rid of browser hijacks.



http://security.kolla.de/

[Korky]

yep moby - adaware, spybot, pestpatrol, startpage guard nothing can stop it.

every second time i start iexplorer it resets it all to i-lookup, these programs are absolutely useless.

[G4Z]

consider a switch to opera perhaps..?

I used to deal with these calls all of the time when I worked on an ISP tech desk. Usually you can uninstall this stuff in add/remove programs. Im surprised ad-aware didnt crack it it usually is very good.

but if you run a quick search on google you will find....

http://www.doxdesk.com/parasite/ILookup.html

http://www.pchell.com/support/click2findnow.shtml

[Moby-Dick]

have you updated the spybot definitions - that sometimes helps

[pyro]

The way it works, those fu**ers save a webpage at your Windows directory, find that one and delete it, should work, did work for me.

[Korky]

can u gimme more specific directory roots plz pyro, thnx.

[johnyhy1]

is it the cookies folder your looking for?

or maybe the hidden temp file on c: try that

[5lab]

theres normally a process running from c:\documents and settings\all users\something - delete it

[Auron]

i had one of these buggers.. it was just displaying a file from the system32 directory (I think) in my browser.. it looked like a page cannot be displayed page but with advert links etc.. after looking in the address window it showed a filename like "thhtaopsd.htm"

so I searched for the file and deleted it.. I've had it once after that but it may have been from a site id visited.. not had any trouble recently.

[Jiff Lemon]

I'm with Moby - Update SpyBot, and run it again.

http://spybot.eon.net.au/

The updates are on the right hand side, about 3/4 of the way down.

[Riley]

try hijack this! http://mjc1.com/mirror/hjt/
works wonders

[Trickle]

Originally posted by pyro
The way it works, those fu**ers save a webpage at your Windows directory, find that one and delete it, should work, did work for me.

c:\program files\IE\Signup

The official place for putting isp signup pages that take over IE is in the signup folder.... no idea if you are likely to find it in there.

Edit: Just delete the whole signup folder and retry.

consider a switch to opera perhaps..?

Its a superb suggestion, but we all know we end up having to revert back to IE for 5% of web sites (secure bank sites etc - autotrader since their update 2 weeks ago )


Edit2: Lovely 'tar Auron