Home Page hijacked!!!

[stevie"stan"]

When I open my internet explorer, no matter what home page I use, I get redirected to "Bestsafetyguide.com" (Packard Bell). I can then open up any of my Favourites (ie NTL Homepage) and use their search engine to access any websites I wish. When I try to use some sites (ie bmibaby) to check flights or car hire prices, a message box pops up saying "you are about to view information over a secure website" etc, and I then get redirected to "404dns.com" (also Packard Bell).

I'd love to know WTF is going on. I would never book/buy over the net at home (proper high security at work), but my f***ing PC won't even let me look at prices and timetables. Any ideas anyone, how this problem arose and how to get rid????? Thanx.

[zimzam]

I would have thought that symantec may have a removal tool for this. I have found some instructions (down towards the bottom of the page on this link) http://forums.tomcoyote.org/index.php?showtopi c=64125 I'll have another browse in the morning and see if I can find a removal tool anywhere.

[stevie"stan"]

Muchos Gracias. I await your further instructions.

[RATTER15]

Try deleting your history and all your cookies.

[zimzam]

Ok - I've looked and all I can find anywhere is the suggestion to clear it using HijackThis - (this seems to be an easier link) http://www.geekstogo.com/forum/lofiversion/ind ex.php/t113204.html If you compare both links it seems to be affecting 3 or 4 entries. My advice really would be to install HijackThis and then post the log on one of those forums and get advice because if you check the wrong thing you are likely to trash your system. So download and run the program, save to file and paste and post onto a forum that deals with HJT advice. I don't think you'll have enough posting room to put a log here and I use the program but only after getting help from very clever people!

[stevie"stan"]

Thanx once again.

[RATTER15]

you could also try downloading winpatrol from www.majorgeeks.com, this will also block it and prevent it from starting.

[neg213]

I've experienced a similair problem in the past, it seems you may have been infected by a parasite, try www.aumha.org/secure.htm, and click on the 'online Parasite Scanner'. This will tell you if you have been infected and the site offers ways in which to remove it, and also lots of info regarding security.