Coly Computer Help



Your Home page has been altered (Hijacked)




Remedies: If possible, scan the computer with SpyBot S&D and Ad-Aware or PC Tools Spyware Doctor. You may be able to do this in Safe mode. If SpyBot, Ad-Aware or PC Spyware Doctor does not find and kill the malware causing the hijacker, try this:-
Download the free program HijackThis from  www.spywareinfo.com/~merlin/files/hijackthis.zip. If the hijacker refuses to allow access to the internet, you could download the file using a friend's computer or at your local library. Copy the file to a floppy or a USB pen drive. Save the file to your C:\Downloads folder (or run it from the floppy drive or from the USB pen drive). Then double click the file to launch HiJackThis. The program will produce a log. Copy the log into a word processor or into Notepad and save it. To do this, with the log showing on the screen, select the whole log using Ctrl and A then hold down the Ctrl key and tap the C key. This will store it in the computer's memory. Now go on line and access www.hijackthis.de (again you may have to use a friend's computer, in which case, copy the log onto a floppy or USB pen drive and copy it to your friend's computer). With the hijackthis.de website open, paste the log into the appropriate box and submit the log for examination. After a minute, the robot at hijackthis.de will present you with a printable list of things which are safe or dodgy. Print the list and follow the instructions to remove the dodgy items.

If after doing this you are still hijacked, you will have to submit the log to experts rather than a robot. Access the website http://forums.tomcoyote.org an expert will eventually advise you by email.

Hijacked web browser.   One symptom may be that a new home page has suddenly replaced your usual home page. Other symptoms may be present such as problems connecting to the internet, line dropping, a dial-up dialog box is popping up unexpectedly, your anti-virus and anti-spyware programs may no longer be able to scan the computer. Your anti-virus and anti-spyware may not be able to update.

To prevent Hijackers entering your computer, make sure your firewall is enabled and that your anti-virus and anti-spyware are updated regularly and scan your computer weekly with the anti-spyware programs. Never download programs from unsolicited websites or emails offering free enhancements such as smilies, search bars, screen savers, cures for spies and viruses.

What the items on the HijackThis log mean: The O2 items are BHOs (Browser Helper Objects). BHOs are loaded when you launch Internet Explorer.
The items marked O4 are programs that are triggered from the registry and one or more of these might well be the hijacker.
The entries marked R0 and R1 concern your browser home page and your search engine's home page. If these are different from your preferred home and search page, you have proof that you have been hijacked.

Do not attempt to tinker with the registry unless you have expert knowledge. Play safe and  follow the instructions offered by the robot or by the experts at http://forums.tomcoyote.org.

Go to top of page Go to top of page
 

Adrian West  © 2007 computer help, computer problems solved

A West web design  click here for an example

Jargon    Troubleshoot    How To...    About this site     Suggestion    Donation    Home Page