Please read this entire post carefully before doing anything else. Pay particular attention to the rules in bold.
These instructions apply to browser hijack victims as well as anyone trying to get rid of a stubborn piece of spyware. The instructions are basically the same for each circumstance.
The first thing you should do if your browser has been hijacked is to read my Hijacked article. 99% of all hijacks can be fixed by following the instructions in that article. We have a lot of experience here dealing with these things, and everything we've learned here that can be printed is there.
[Link removed] [That page was last updated on Jan 12, 2005] [The spywareinfo.com domain has now expired so that page is unavailable. See Access to www.spywareinfo.com is lost. If you put the entry in your hosts file as instructed there, then you can read http://www.spywarein...jacked/#removal
For the brand new hijacks that are not covered by Spybot, Ad-aware and the rest, we can walk you through getting it fixed and getting the files responsible targeted by these programs.
You should already have a copy of Ad-Adware or Spybot S&D that is up-to-date and have scanned with it to try to remove your hijacker. Here is a short tutorial on using Spybot written by one of our members.
Do not post a Spybot or Ad-aware log file unless someone has asked you to do so for some reason. They are large, hard to read, and have no useful information. We prefer HijackThis logs and have no use for Ad-aware or Spybot's log files.
You should also have a copy of HijackThis that is up-to-date. When you post, please paste in your HijackThis log after describing the problem that you are having. Someone may also request a StartupList log, so go ahead and make one, but don't paste it in unless someone asks for it as it tends to clutter up the thread. Here is a short tutorial on using HijackThis written by one of our members.
When you post your HijackThis or StartupList log, do not remove anything from it. That specifically includes the top of the log that lists version information. WE NEED THAT INFORMATION!
You may be asked to submit a file or files. You will be given the address to submit those files. Include a link to the forum thread here where you are being helped, otherwise we may not know what to do with what you've sent me. Please do not rename the files. Please zip the files.
Do not send logs or questions in email or via private messenger unless you have been specifically asked to do so. If I receive an unwanted log file in my email or in a private message, you are not going to like my reply.
Now that you have scanned with Spybot or Ad-aware and found nothing and have your HijackThis and StartupList logs, start a post, describe your problem, and paste in your logs.
Please mention that you have already read this FAQ and followed the directions, or else someone is likely to tell you to come back here.
Do not, under any conceivable circumstance, post a hijackthis log without having first scanned with Ad-Aware or Spybot with all updates installed.
Do not post your log file in a thread started by someone else, even if you are having the same problem as the original poster. It is confusing and it is irritating.
Do not post a reply to your question saying something to the effect of "there have been 30 views of this topic and no one's answered me?".
Thousands of people visit these forums every day. If someone knows how to answer your question, they'll answer it. If they don't, they'll leave it for someone who does. We may or may not be able to fix the problem, but no posts are ignored here. Unless of course you irritate us by asking why 30 people viewed the topic and didn't answer.
Please do not post a new topic titled "HijackThis log" or "log from HijackThis" or anything similar. Please give your post a title relevent to your problem and not with the name of the troubleshooting tool.
If you have been hijacked by xupiter.com, put that in the title. If you get redirected to lop.com when you try to load a site that doesnt' exist, put lop.com in the title. If a purple monkey sits on top of your browser when you open it and tries to sell you a firewall, "hijackthis log" should not be the title of the post.
Please be patient. Your post may be answered immediately or may take several days. This is an extremely busy message board and only specially-trained volunteers can answer most of the questions. If your post has not had a reply after three days, post a reply to this topic to draw attention to it. It may simply have been overlooked among all the other hundreds of posts made here every day.
Finally, once you have fixed your problem, PLEASE POST BACK SAYING SO. We need to move your topic elsewhere once it has been resolved. It also makes our helpers nervous when the person doesn't post back.
DO NOT USE THE "Subscribe to this forum" LINK ON ANY SUBFORUM HERE! You will begin receiving several hundred emails a day if you do.
Thank you in advance for not doing the things I've just asked you not to do. Click the button to begin your post.
(If you have not yet registered, please do so now before attempting to post).
Edited by cnm, 16 November 2008 - 02:56 PM.
fixed broken links - and added some notes