25

If you need to manually reset the registry values, here’s the procedure:

First create a System Restore point in case anything goes wrong:

http://www.bleepingcomputer.com/tutorials/tutorial56.html#manual

From Start>Run enter regedit and click OK.

Expand HKEY_CLASSES_ROOT, scroll down to PROTOCOLS (1) and expand.

Expand handler (2).

Click on each key which HijackThis! mentions as hijacked, for example:

O18 - Protocol hijack: file (3)

http://donaldbroatch.users.btopenworld.com/protocol.png

View the CLSID value. If it has been hijacked, change the value back to the default value:

Double click on CLSID (4) and edit the value in the window which opens (5).

cdo:

http://www.castlecops.com/o18list-68.html

file, ftp, gopher, http, https, local, mk:

http://www.castlecops.com/o18list-58.html

its:

http://www.castlecops.com/o18list-60.html

lid:

http://www.castlecops.com/o18list-69.html

tv

http://www.castlecops.com/o18list-65.html

Can’t find castlecops.com listings for the following but on my computer…

res:

{3050F3BC-98B5-11CF-BB82-00AA00BDCE0B}

And a Google search suggests…

mctp

{d7b95390-b1c5-11d0-b111-0080c712fe82}

I think that should sort you out. Pay attention to the curly brackets when changing the CLSID’s.

EDIT: Corrected links.