Title of all webpages I open is www.safyway.blogspot.com, I think IE has been hijacked. Kindly advice.

All my IE pages have default title : www.safyway.blogspot.com. How can I remove it?
CRISILAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

mcclellanfsuCommented:
First I would try running Spybot Search and Destroy. You can download it from www.download.com. If that doesn't work, download HijackThis (also from download.com) and post the log file results. We should be able to pick out the program causing the issue from your log results.
0
CRISILAuthor Commented:
Hi, I ran spybot but didn't find anything there. Attached is hijackthis log file.


hijackthis.log
0
mcclellanfsuCommented:
Remove these two entries:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.safyway.blogspot.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = www.safyway.blogspot.com

There are a couple more that make me suspicious, but lets start out by deleting those two and see if that fixes your problem.

A couple of other questions. Are you getting your internet connection through a proxy server? If you're not sure then another question would be, how are you connected to the internet?
0
CRISILAuthor Commented:
I tried deleting them but they reappear after some time. As for my internet connectivity is concerned, I it get through IP NAT from my H/W Firewall.
0
CRISILAuthor Commented:
I got the solution myself. Here are the steps:-

First
Open task manager and kill process wscript.exe.

Then
Delete VirusRemoval.vbs and Autorun.inf files from all usb drives.

Then
Go to c:\Windows\System32 and delete the file VirusRemoval.vbs. It is super hidden so first go to Folder Options and check show hidden and super hidden check boxes. Also required for the above files.

Then
Go to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
On the right side look for Shell which should have value of just explorer.exe.
delete anything after explorer.exe.

Under same key Winlogon also look for Userinit which should have value of
c:\WINDOWS\system32\userinit.exe,
Delete all the crap after the comma.

Then
Go to HKCU\Software\Microsoft\Internet Explorer\Main
On the right side locate Window Title and delete its value


Under the same key locate Start Page and delete its value

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.