PDA

View Full Version : find4u hijack



wozz
26-02-2004, 06:35 PM
Help!!
My browser's (IE6 SP1) homepage has been hijacked by a web site called Find4u.net

How can I remove this and get back my own home page? I seems that anything I do in IE tools just doesn't work

Thanks in anticipation

Woz

Jen C
26-02-2004, 07:13 PM
You need to download, install and run Spybot Search & Destroy (http://www.safer-networking.org/index.php?lang=en&page=download) and/or Ad-aware 6 (free version) (http://www.lavasoftusa.com/support/download/). Make sure you keep them updated via the inbuild update function.

Susan B
26-02-2004, 07:39 PM
This one is a bit too tough for Adaware and Spybot. Go here (http://www.spywareinfo.com/~merijn/downloads.html) and download HijackThis (under the Official Downloads section), run it and put a tick next to the following lines if they are listed, "fix checked" and restart your system:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find4u.net/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://find4u.net/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://find4u.net/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://find4u.net/index.htm
O4 - HKCU\..\Run: [olehelp] C:\WINNT\System32\olehelp.exe
O4 - Global Startup: winlogon.exe
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297B} - http://web.net2phone.com/products/commcenter/download/bin/IXCommCenter.cab

Only tick these items, nothing else or your computer may stop working.


Reboot then download CWShredder (http://www.sherrylynn.us/privacypolicy.htm), run the program and let it do its thing. Make sure to click on "Fix" and not scan only.

Start your computer in safe mode, navigate to C:\Documents and Settings\All Users\Start Menu\Programs\Startup, and delete winlogon.exe
Find and delete this also: olehelp.exe

If you wish you can post your Startup log from HijackThis after cleaning to see what else might need deleting.