home page hijacked

[sarahm]

Hello. I am working on a customers pc that their home page has been hijacked by www.safetydefender.com. I have run a spysweeper scan it found some items and removed them. I have run a scan since then and it finds nothing but the home page is still hijacked and its not set to be www.safetydefender.com. I cant seem to find where this is stuck in the pc, if anyone else has run across this and knows how to remove this safety defender I would appreciate some help. Thanks.

 

[sturm]

Run more than one anti-spyware program. Ad-aware, spybot, and even the microsoft one.

 

[sarahm]

i ran just a quick scan on the microsoft one, am doing full scan now, as quick scan didnt come up with anything. Talk about anoying. I have seen this before, but didnt make any notes on where this is hidden in the pc. I will do so know.

 

[sturm]

Also might look thru the add/remove programs and see if there is anything out of the ordinary in there.
Question: What is the hompage set to in the internet tools window?
So when web page first launches it starts out going to their normal hompage and then gets changed to safetydefender.com right?

 

[sarahm]

the home page under internet options is set to www.twincities.com. When I open my internet explorer it tells me its going to that page but then changes before it comes up to the safetydefender page. There is really nothing out of the ordinary under control panel. I am removing a program called NickesandMore

 

[Oberon]

Did you try running an online scanner like http://www.trendmicro.com they can find and remove most problems. Sometimes you need to boot into safe mode with networking to get rid of the most trouble some ones.