My Internet Explorer Home Page has been Hijacked!!! 1

[prworld]

Hi

My PC runs Win2K and IE v6. I use Ad-Aware pro and NAV 2005. Last week my babysitter used my PC and entered chat rooms etc. Now everytime I open Internet Explorer the following page opens:

http://runonce.msn.com/en/runonce.asp

If I re-set my home page to google in IE settings it works. However when I restart IE the msn page opens again AND SETS ITSELF AS MY DEFAULT HOME PAGE!

My Ad-Aware blocker doesn't appear to record a registry change for this to happen and I don't appear to be infected with spyware or a virus.

Also I have manually modified the registry as per:

Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Internet Explorer\Main
Value:Start Page
Data:

http://runonce.msn.com/

New Data:

http://www.google.co.uk/

Again this works initially, but when I restart IE it then sets itself back to runonce.msn.

Also, if I select "keep my current home page" in the runonce.msn page, it doesn't accept my choice. It will only clear if I accept MSN as my home page. If I then set it back to google, the runonce.msn page re-appears the next time!

I have tried various options of trying to clear this problem both with Ad-Aware/NAV turned off and on, nothing seems to work.

Any help would be greatly appreciated!
This has got me scratching my head and I don't like being forced to have MSN as my home page!

 

[baltman]

You need -Virus/Spyware discussion Forum forum760 and FAQs.

Try updating adaware and try spybot too.

Brian

 

[smah]

There are a number of FAQ's around this site that should help with this problem.

FAQ608-4650 Before Posting a Hijack log file - Best Practices
FAQ608-3482 How to beat your advertising popups & other browser nasties
FAQ760-4866 Beginners General Cleanup
FAQ779-5240 What are Good Virus/Spyware?Update/Firewall Practices?

 

[prworld]

Thank you for your helpful suggestions.

After trying spybot and Xoffspy without success I noticed that my Ad-Aware Adwatch was set to auto. I set this to manual, then restarted the PC.

When the 'hijack' next tried to run, the Ad-aware intecepted the programme and identified the registry Key that it was trying to change!

I then deleted the registry key and the problem is fixed!

Well done Ad-Aware, I can recommend this programme.

Many thanks again.