What To Do When Internet Explorer Is Hijacked Part II
When a program hijacks Internet Explorer by modifying the registry, the change often only affects the current user. This is because many users do not have local administrative privileges and can only modify the HKEY_CURRENT_USER portion of the registry, not the HKEY_LOCAL_MACHINE portion.
Log on as the user who is having the problem and open the Registry Editor (click Start and type Run in the Search field). Then, navigate through the registry tree to:
HKEY_CURRENT_USER Software Policies Microsoft Internet Explorer Control Panel.
Check for the existence of keys named ResetWebSettings or HomePage. If such keys exist, delete them.
Next, navigate to:
HKEY_CURRENT_USER Software Microsoft Internet Explorer Main.
Verify that the information stored in the Default_Page_URL key and Start Page key is correct. If these keys contain values that reflect an undesirable startup page, double-click on the key to open its dialog box and then replace the existing value with an appropriate one.
You should check two additional registry entries. However, you will need to ensure that you have the proper permissions before doing so. Navigate to the following registry key:
HKEY_LOCAL_MACHINE Software Microsoft Internet Explorer Main.
As before, check the Default_Page_URL and the Start Page keys for inappropriate values and change the values if necessary. Next, navigate to:
HKEY_USERS Default Software Microsoft Internet Explorer Main.
Once again, check the Default_Page_URL and the Start Page keys for inappropriate values, and change them as necessary.





