Member Avatar for oldiescc

after trying everything from adaware to hijackthis i still can not remove hotoffers from taking over my home page....please help!

here is my HJT log

Logfile of HijackThis v1.99.1
Scan saved at 9:58:26 AM, on 5/5/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\ok here it goes\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

  • 2 Contributors
  • 3 Replies
  • 272 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by DMR

Dani AI

Generated

has the right idea pointing to community removal threads; this is a classic homepage‑hijack scenario and the fix is usually one of three things left behind by adware: modified IE shortcuts, Start Page values in the registry (per‑user or machine), or a proxy/hosts redirect. The safest approach is an ordered checklist: start with non‑destructive scans, then inspect shortcuts and network settings, and only edit the registry after exporting backups.

Practical checklist (do steps in order, back up first):

  • Reboot to Safe Mode (with Networking) and run up‑to‑date on‑demand scanners (Malwarebytes Anti‑Malware, AdwCleaner or similar).
  • Check all Internet Explorer shortcuts (Desktop, Start Menu, Quick Launch). The Target must end with iexplore.exe only; remove any appended URLs.
  • Verify proxy and LAN settings in Internet Options → Connections → LAN Settings (ensure no proxy is set).
  • Open the hosts file to check for redirects: 
    notepad %windir%\system32\drivers\etc\hosts
regedit
msconfig
  • Export the registry keys before editing, then check the Start Page values under both HKCU and HKLM at Software\Microsoft\Internet Explorer\Main and change them to the desired URL (or about:blank). Also inspect ...\CurrentVersion\Run and Scheduled Tasks for persistent updaters.
  • If comfortable with HijackThis, use it to fix only the specific start‑page entries that point to the ad site; otherwise avoid blindly deleting items. For persistent cases, use Autoruns (Sysinternals) to find services/startup entries that reapply the hijack.

Notes and cautions: always export registry keys and create a restore point before changes. If the homepage returns after removal, a small service or scheduled task is likely reinstalling it — a clean boot + Autoruns scan usually exposes the culprit. This complements ’s referenced threads and provides the targeted checks most often missed.

Recommended Answers

All 3 Replies

Member Avatar for DMR

Are you sure you posted the full contents of the HJT log? That one looks abnormally short...

Member Avatar for oldiescc

yes this is the whole thing

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.