My search button has been hijacked
Tony
web site that somehow installed exit exchange software on
my computer. When I first start up Internet Explorer,
this program opens my search bar and then slaps a pop-up
window on my screen. I think the company is called
(exitexchange.com), and I seemed to have picked this up at
web site called jethomepage.com. I can switch the
preferences to a different search engine, but Explorer
doesn't remember my change. When I open Explorer again,
low and behold, there is the jethomepage.com search engine
accompanied by an exitexchange pop-up window. Please e-
mail responses. Any help is appreciated.
Arjan
>low and behold, there is the jethomepage.com search
engine
Have you already run regedit and search for the keyword
jethomepage.
I believe you should get to the registerkey where this
settings is stored. There you should enter another
searchengine....
For example, look at how google can alter you register on
your request:
http://www.google.com/options/defaults.html#default
Grtz. Arjan
greg
>I am having the same problem. The site I am redirected to
is Best Search. I tried the resets and all that but
nothing works. When these lowlifes hijacked my search
engine before, all I had to do was change the prefrences
back the way I wanted them, now I cannot do that.
Ive also had my homepage hijacked but could easily change
it back. I bet its a just a matter of time before hijacked
homepages will give us this same problem.
I hope someone can help me with this
Jim Byrd
go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an
analysis of a number of possible parasites on your machine will be made
to help you identify and remove them. NOTE: You will need to disable
Ad Blocking in Zone Alarm 3.x, if present or any other Ad Blocking
software which interferes with Java Scripting for this scan to work.
You should get a message between the two lines of **** giving the
results of the scan.
For the general hijack case, the best way to start is to get Ad-Aware
6.0 here: http://lavasoft3.element5.com/. Update and run this
regularly to get rid of most "spyware/hijackware" on your machine.
Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ I recommend using both
normally.
Lastly, a very useful utility for examining your system and correcting
problems is Hijack This, which you can download here:
http://www.spywareinfo.com/~merijn/files/hijackthis.zip (Recommended)
This site has a number of useful references and information also:
http://www.spywareinfo.com/articles/hijacked/ and here
http://www.spywareinfo.com/downloads.php
Next, download and install StartUp CPL here:
http://www.mlin.net/StartupCPL.shtml
This will allow you to easily examine from your Control Panel which
programs are being started automatically when you boot. Look for
programs that don't seem like they belong. There are further
explanations of the StartUp process here:
http://www.forrestandassociates.co.uk/pcforrest/startups.html and here:
http://www.pacs-portal.co.uk/startup_index.htm. You may have to try
disabling things one-at-a time and re-booting to find the culprit. A
somewhat more difficult to use but more extensive program to do the same
thing is StartupList from here:
http://www.lurkhere.com/~nicefiles/index.html. Be very careful about
doing any Registry modifications directly unless you're comfortable with
this, and be sure that you BACKUP your Registry before making any
changes, so that you can recover if something goes wrong. Changes made
with StartUpCPL are less likely to cause problems, and are usually a
matter of just re-enabling the particular program. You can look up and
investigate suspect programs in your StartUp lists here:
http://www.pacs-portal.co.uk/startup_pages/startup_full.htm
(Recommended) and here:
http://www.forrestandassociates.co.uk/pcforrest/startups.html
Some hijackers install themselves as Browser Helper Objects. Get BHOCop
here: BHO Cop http://www.pcmag.com/article2/0,4149,270,00.asp (You may
have to register first, but it's free and no spam) and take a look at
what BHO's are currently installed. Some things like AdShield and
Acrobat are normal, but if you see something that doesn't make any
sense, try disabling it and see if that helps. Another excellent
program for this same purpose is BHODemon, here:
http://www.definitivesolutions.com/ I would recommend using both.
There's good information about hijacking and fixes available here:
Andrew Clover's parasite page: http://www.doxdesk.com/parasite/
(Highly recommended)
Robert Allen's parasite page: http://allentech.net/parasite/index.phtml
(Highly recommended)
http://www.spywareinfo.com/hijacked.html
http://gmpservicesinc.com/Articles/hijack.asp (links here for .reg files
to lock and unlock your homepage, BTW)
http://www.mvps.org/inetexplorer/answers.htm#home_page
Also, there's a new class of hijacker using Window's Messenger Service
(not Instant Messaging, BTW). Unless you have very good reasons to
keep this active, it should be turned off in Win2k and XP. Go here and
do what it says: http://www.itc.virginia.edu/desktop/docs/messagepopup/
or, even better, get MessageSubtract, free, here, which will give you
flexible control of the service and viewing of these messages:
http://www.intermute.com/messagesubtract/help.html Recommended. Also,
see: Messenger Service Window That Contains an Internet Advertisement
Appears http://support.microsoft.com/?id=330904
Once you get this cleaned up, you might want to consider installing the
Browser Hijack Blaster and SpywareBlaster here to help prevent this kind
of thing from happening in the future:
http://www.wilderssecurity.com/bhblaster.html (Prevents malware BHO's)
http://www.wilderssecurity.com/spywareblaster.html (Prevents malware
Active X installs) (BTW, SpyWare Blaster is not memory resident ... no
CPU or memory load - but keep it updated) The latest version as of this
writing will prevent installation or prevent the malware from running if
it is already installed, and it provides information and fixit-links for
a variety of parasites. Both Very Highly Recommended.
See if any of this helps and post back with your results. Regards, Jim
Byrd
In 004d01c2d3ed$75b65a30$3001...@phx.gbl, Tony typed:
Erik Rode
is to do a search in find,for the text >
(exitexchange.com), open the file,search the file for >
(exitexchange.com), chnge the text to whatever you want as
a search engine or delete this link.>(exitexchange.com),
close and save.
Next use regedit remove checkmark at anything refering to
Next use msconfig to check and remove any referal to >
(exitexchange.com), close and save.
reboot computer and procede like normal.
Erik
>-----Original Message-----
>I am having a problem with Internet Explorer. I visited
a
>web site that somehow installed exit exchange software on
>my computer. When I first start up Internet Explorer,
>this program opens my search bar and then slaps a pop-up
>window on my screen. I think the company is called
>(exitexchange.com), and I seemed to hav>
(exitexchange.com), e picked this up at
>web site called jethomepage.com. I can switch the
>preferences to a different search engine, but Explorer
>doesn't remember my change. When I open Explorer again,
>low and behold, there is the jethomepage.com search
engine
>accompanied by an exitexchange pop-up window. Please e-
>mail responses. Any help is appreciated.
>
>
>
>.
>