Hello Furkan The Tech Loving Kid,
Welcome to Microsoft Q&A forum.
The website you see (dongdonger.org) as I checked is a website known for being a browser hijacker. So unfortunately, your computer is probably infected. On the bright side, it seems like it is not yet turn into ransomware.
The program could be using Task Scheduler to operate, that can explain why it come back after you removed the registry entry. In this case, please try to follow these steps:
- Remove from the task scheduler.
- Type "Task scheduler" in the search bar and press Enter.
- Go to Task Scheduler Library.
- Try to find all entries regarding the website name, explorer, cmd.exe or powershell.exe.
- Use Autoruns.
- Download Autoruns from the official website.
- Open the apps and go to Logon tabs and Scheduled tasks tabs.
- Look for any entries referencing.
- The website.
- Weird EXE files in AppData.
- cmd.exe or powershell.exe.
- Uncheck them to disable.
- Clear Startup folder.
- Press Win + R to open the run dialog.
- Type shell:startup and press Enter.
- Delete anything seems suspicious.
- Go and checl C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup as well.
- Clear registry deeply. Disclaimer: Generally, modifying registry subkeys or work group is intended for advanced users, administrators, and IT Professionals. It can help fix some problems, however, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For further protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click How to back up and restore the registry in Windows - Microsoft Support to view the article.
- While the directory you check is correct, it might not be the only one with that entry. In this case, please also check and remove the key from those entries.
- Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
- Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce.
- While the directory you check is correct, it might not be the only one with that entry. In this case, please also check and remove the key from those entries.
- Restart your computer when it is done.
Please note that malware can still have hidden components somewhere that we might not aware of. So I would still suggest that you should backup your files and data and then clean install the computer to make sure that everything is alright.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.