Homepage Hijack

[stuleg]

It feels cheeky registering here just to try to get my problem sorted out, so I apologise for that. Hopefully I can become a more giving member in time.

My problem is that my homepage keeps being hijacked.
I have it set to google.co.uk - but after a restart or after running ccleaner it goes to a site called lookanddiscover.com.

I go into Control Panel/Internet Options and change it back but it just goes back to lookanddiscover.com after a restart.

So far I have run - Spybot S&D, Lavasoft Ad-Aware, Trojan Hunter and Trojan Remover. As well as a full scan with fully updated versions of both AVG and Avast.

Any help would be gratefully recieved, and thankyou to anyone in advance for any time they spend trying to help me.

Stuart

*edit* just to add that I installed an app called Startpage Guard yesterday to try and stop the page from being hijacked, even that doesn't seem to work after a reboot.

[747simpilot]

Related: I am being redirected HELP PLEEESE!!

[stuleg]

Many thanks for your prompt reply and help 747simpilot.

I read the thread you directed me too, and followed some of the advice given.
A boot scan with Avast! didn't turn up anything. Interestingly when I looked at the log file for the scan it said "scanning aborted" - this wasn't the case as I let it do it's thing then start up normally (took a little over an hour to complete)

I opened to host file in System32/drivers/etc as a text file - it had the 127.0.0.1 localhost line but also another line underneath it with just a few 0's.

Should I delete the line under the 127.0.0.1 one?

[747simpilot]

Does it say 127.0.0.1 0.0.0.0 or something?


That must be an error because it dosn't mean anything. Infact, the only line you should see is 127.0.0.1 localhost. You could delete that line underneath and see what happens. Remember to mark that host file read only when your done by right clicking the icon there. Do this after editing the text first. Rename the file to not have a .txt extension.

You might need to scan the computer with a bootable CD. That way the OS is not on.

Avira AntiVir Rescue System Was talked about here: Hidden files

How to Set BIOS to Boot from CDROM - www.hiren.info Del, F12 or F2 are the keys.


Internet Explorer is updated?


I'm curious, have you ran a hijackthis scan? I'd like to see it.

[stuleg]

Thanks again 747simpilot.

I deleted the line under the 127. one.
And have also set the file to read only (and changed it back from the .txt format)

So far it seems to be working, fingers crossed.

[747simpilot]

Still working?