1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Charter keeps hijacking my browser, even after removing all options with Hijack This

Discussion in 'Malware Removal' started by whicky1978, Jan 31, 2006.

  1. whicky1978

    whicky1978 Staff Sergeant

    I ran HighJack this with my browser closed, mail programs, and so forth, and restart my laptop as it requested, but still I can't change my homepage. This started the same time I started using chater cable internet. I tried googling for answers, but no luck.

    I homepage won't change from chartermsn.com

    I will attach my HiJack This log. I also tried just removing R0 with "chartermsn main page" before I removed them all.
     

    Attached Files:

  2. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    This entry was added from Spybot or Ad-Aware most likely, this needs to be removed.

    Now scan with HijackThis and check the boxes for the following entries:
    ( Make sure ALL browser windows are closed when you click FIX )

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://charter.msn.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.1.1
    (Keep this if you need it)

    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O14 - IERESET.INF: START_PAGE_URL=http://mirs.peoplepc.com/?offername=PeoplePC Online Accelerated&userName=whicky2003&firstName=Joseph&qs=EGHBIDJMDDLFJNKJAMLBIGNAIEMN FDLMBCNIKEEIHECEFPFDPPEIHIGJKNHHFIPAKDEPIDLBDCKIJBLNPBPNPINDNKIFCMKFHAEJGJGDDIAC CGNBGKKIEMIJNIPGPKHG|OKHPJIBDDGNMCNOPADEEAAGOBA

    O18 - Filter: text/html - (no CLSID) - (no file)

    Again, make sure ALL browser windows are closed when you click FIX.

    Next, run CCleaner to clean up cookies and temp files.

    After you complete the above, procede with the below...

    Reset Web Settings & Default Security Settings:

    To Reset Web Settings:
    Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

    If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


    To Default Security Settings:
    Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


    After you complete this post, reboot and see if your problem remains.
     
  3. whicky1978

    whicky1978 Staff Sergeant

    Fixed! (About:Blank issue)

    I did everything you suggested bjgarrick, and it did not work. Then I realized that it was an about:blank issue :rolleyes: , so I ran AboutBuster and HSRemove in Safe Mode, and the problem was fixed.:)
     
  4. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Your log showed no sign of this infection. Attach one last HJT log to confirm your clean.
     
  5. whicky1978

    whicky1978 Staff Sergeant

    about:blank seems to be a part of my Avant browser.

    Here is a new log.
     

    Attached Files:

  6. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Have HJT fix the below entry:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm

    After you remove the above entry your log will be clean.

    Are you having any current problems?
     
  7. whicky1978

    whicky1978 Staff Sergeant

    No, I'm not currently having any problems
     
  8. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

  9. whicky1978

    whicky1978 Staff Sergeant

  10. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Your Welcome!:)
     

Share This Page

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds