?
Solved

Title of all webpages I open is www.safyway.blogspot.com, I think IE has been hijacked. Kindly advice.

Posted on 2008-01-29
5
Medium Priority
?
3,101 Views
Last Modified: 2013-11-16
All my IE pages have default title : www.safyway.blogspot.com. How can I remove it?
0
Comment
Question by:CRISIL
  • 3
  • 2
5 Comments
 
LVL 3

Expert Comment

by:mcclellanfsu
ID: 20767712
First I would try running Spybot Search and Destroy. You can download it from www.download.com. If that doesn't work, download HijackThis (also from download.com) and post the log file results. We should be able to pick out the program causing the issue from your log results.
0
 

Author Comment

by:CRISIL
ID: 20767818
Hi, I ran spybot but didn't find anything there. Attached is hijackthis log file.


hijackthis.log
0
 
LVL 3

Expert Comment

by:mcclellanfsu
ID: 20767918
Remove these two entries:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.safyway.blogspot.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = www.safyway.blogspot.com

There are a couple more that make me suspicious, but lets start out by deleting those two and see if that fixes your problem.

A couple of other questions. Are you getting your internet connection through a proxy server? If you're not sure then another question would be, how are you connected to the internet?
0
 

Author Comment

by:CRISIL
ID: 20768372
I tried deleting them but they reappear after some time. As for my internet connectivity is concerned, I it get through IP NAT from my H/W Firewall.
0
 

Accepted Solution

by:
CRISIL earned 0 total points
ID: 20784802
I got the solution myself. Here are the steps:-

First
Open task manager and kill process wscript.exe.

Then
Delete VirusRemoval.vbs and Autorun.inf files from all usb drives.

Then
Go to c:\Windows\System32 and delete the file VirusRemoval.vbs. It is super hidden so first go to Folder Options and check show hidden and super hidden check boxes. Also required for the above files.

Then
Go to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
On the right side look for Shell which should have value of just explorer.exe.
delete anything after explorer.exe.

Under same key Winlogon also look for Userinit which should have value of
c:\WINDOWS\system32\userinit.exe,
Delete all the crap after the comma.

Then
Go to HKCU\Software\Microsoft\Internet Explorer\Main
On the right side locate Window Title and delete its value


Under the same key locate Start Page and delete its value

0

Featured Post

The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There's never been a better time to become a computer scientist. Employment growth in the field is expected to reach 22% overall by 2020, and if you want to get in on the action, it’s a good idea to think about at least minoring in computer science …
A question that many companies need to answer until May 25th of 2018... Is your company ready for GDPR?
This Micro Tutorial will demonstrate how to add subdomains to your content reports. This can be very importing in having a site with multiple subdomains.
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…

589 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question