What To Do When Internet Explorer Is Hijacked Part II

When a program hijacks Internet Explorer by modifying the registry, the change often only affects the current user. This is because many users do not have local administrative privileges and can only modify the HKEY_CURRENT_USER portion of the registry, not the HKEY_LOCAL_MACHINE portion.

Log on as the user who is having the problem and open the Registry Editor (click Start and type Run in the Search field). Then, navigate through the registry tree to:

HKEY_CURRENT_USER \ Software \ Policies \ Microsoft \ Internet Explorer \ Control Panel.

Check for the existence of keys named ResetWebSettings or HomePage. If such keys exist, delete them.
Next, navigate to:

HKEY_CURRENT_USER \ Software \ Microsoft \ Internet Explorer \ Main.

Verify that the information stored in the Default_Page_URL key and Start Page key is correct. If these keys contain values that reflect an undesirable startup page, double-click on the key to open its dialog box and then replace the existing value with an appropriate one.

You should check two additional registry entries. However, you will need to ensure that you have the proper permissions before doing so. Navigate to the following registry key:

HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Internet Explorer \ Main.

As before, check the Default_Page_URL and the Start Page keys for inappropriate values and change the values if necessary. Next, navigate to:

HKEY_USERS \ Default \ Software \ Microsoft \ Internet Explorer \ Main.

Once again, check the Default_Page_URL and the Start Page keys for inappropriate values, and change them as necessary.