IE Home page

[Antoniov.]

Hello folk,
I hope somebody can help me.
My customer has a IE V6 running on windows xp and his home page point to an erotic list of sites.
I was sure it was simple to remove but I cannot restore right home page.
I've done:
1) Using regedit removed SearchPage and HomePage in \HK_CurrentUser\Software\Microsoft\InternetExplorer\Main
2) Again with regedit checked \HK_LocalMachine\Software\Microsoft\Windows\CurrentVersion\Run and removed a suspected entry; other entry are right.
However, home page still remain the dirty web.
I suspect there's some external intrusion because network seem weird activity but using netstat I can see nothing.
Please tell me something about this.
Cheers

Antonio Vigliotti

[Joseph Loo]

hi,

try downloading and installing Ad-aware from lavasoft.

http://www.lavasoftusa.com/support/download/

Ad-aware is the award winning, free*, multicomponent detection and removal utility that has consistently lead the industry in safety, user satisfaction, support and reliability.

With its ability to comprehensively scan your memory, registry, hard, removable and optical drives for known datamining, aggressive advertising, and tracking components, Ad-aware will provide the user with the confidence to surf the Internet knowing that their privacy will remain intact. Let Ad-aware protect your privacy.


hope this helps.

[Antoniov.]

Joseph,
thanks for your response. My customer already installed ad-ware but doesn't solved. However, today, he's installed Norton AV and he's solved.

Antonio Vigliotti

[Ernesto Cappello · Accepted solution]

Hi Antoniov,

"to prevent is better than to cure"

you can prevent these annoying modifications ... disabling Home Page.

It is necessary modify the registry, in this way:


1) Create a new key in HKEY_CURRENT_USERS\Software\Policies\Microsoft calling it "Internet Explorer".

2) Now in "HKEY_CURRENT_USERS\Software\Policies\Microsoft\Internet Explorer repeat the operation creating to its inside an ulterior key, calling it "Control Panel",
3) In it must create a new value of type DWORD with name" homepage " and put equal value to 1.

Regards, Ernesto.

[Ron Kinner]

Following is my standard recommendation based on direct experience.

In order to fix this easily you need to download a few programs.

Hijack This:

http://tomcoyote.com/hjt/

CWshredder

http://www.majorgeeks.com/download4086.html

Adaware 6.181

http://www.majorgeeks.com/download506.html


and Spybot Search and Destroy 1.3.

http://www.majorgeeks.com/download2471.html

The first two are small and will fit on a floppy if you can't use your PC. Before running either, close all windows, right click on the Explorer Icon on your desktop and select Properties then select Delete Cookies and tell it OK. When that finishes hit Delete Files (check the box in front of Delete Off-line Content and tell it OK). This one can take a while to finish be patient.

Now run install the CWShredder and let it check your system. If it asks you if a file name is random, write down the file name and tell it NO then ask us. You can always run the program again and say Yes if need be.

Now run Hijack this and copy the output and post it here and we will tell you which ones to check.

Once you do this you should be able to download the other two programs. Install AdAware first and make sure you get the updates. Run it and tell it ro remove anything it finds.

Now do Spyware S&D 1.3 and let it run. It shouldn't find much but you want to tell it to remove the junk it finds.

Go to windowsupdate.microsoft.com and let it check your system for needed updates. You don't need the .net updates nor the multiple language stuff but you should get all of the critical updates.

Finally get Zone Alarm (the free version) from www.zonelabs.com and install it so you are protected from some attacks and will be notified if something odd starts running on your PC.

A good virus scan is always a good idea.

If you need help with any of the programs come back and ask or you can visit some of the forums on http://tomcoyote.com/

Ron

PS The popup killer EMS freesurfer has an option to lock your homepage. I've tested it and it works quite well in most situations plus it really does a good job on popups.

http://www.kolumbus.fi/eero.muhonen/FS/

[Paul Sperry]

Ron is right on. I had the same problem and used the programs he mentions to fix it.
Here is some more advice:

This advice covers three types of home page locking - hijacking (by web
sites), hijacking (by viruses) and locking (by ISPs when you install their
software, and computer manufacturers)

Hijacking

First, update to Internet Explorer 6. Most sites that try to hijack your
home page will now trigger a 'do you want to do this' warning message that
lets you stop the hijacking. The sneaky background activex downloads that
are often used by hijack sites to install spyware will also trigger a 'do
you want to do this' install window.

Some web sites try to change your home page or search engine options if you
visit them. Some that have been mentioned in the newsgroups include gohip,
sureseeker, webcombo, cybersearch and passthison.

Microsoft links to problems with the above sites are as follows:

PassThisOn.com Home Page Appears When You Start Computer [Q309313]
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q309313

Cannot Change Default Home Page Setting from Webcombo Site [Q302459]
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q302459

More general advice can be found at the next link:

Home Page Setting Changes Unexpectedly, or You Cannot Change Your Home Page
Setting
http://support.microsoft.com/default.aspx?scid=kb;EN-US;320159

In addition, you may discover that browser.secondpower.com is being added to
your homepage URL. This link has an Uninstaller:
http://www.secondpower.com/customer.html

Please see this link for advice on security fixes that can help prevent such
hijackings.

http://www.mvps.org/inetexplorer/Darnit.htm#hijackings

Also, there are some viruses that can reset your home page - so make sure
that your antivirus is completely up to date.

There is a clever little shareware programme that can help stop your home
page being changed; it seems to work well but tends to trigger when you
change your home page manually the next time that you start IE - the
programme makes it much easier to take back control of your home page
settings:

http://www.pjwalczak.com/spguard/

Locking

Some computer manufacturers and suppliers of internet access set IE to their
home page and lock this setting via the registry. Hijackers use exactly the
same trick. The locking is done using registry settings as per the
following:

Home Page Setting Changes Unexpectedly, or You Cannot Change Your Home Page
Setting (Q320159)
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q320159

Specific registry settings affected are:

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel] - DWORD "HomePage"=dword:00000001 (grays out the whole section)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
- DWORD "NoSetHomePage"=dword:00000001

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet
Explorer\Restrictions] - DWORD "NoSetHomePage"=dword:00000001

[Ron Kinner]

The CWShredder program also recommends that you remove the microsoft version of java (no longer supported and said to be a big security risk) and replace it with Sun's latest version.

It is really a smart program and among many other things will check the registry and restore it to the default state for such things as page not found, default home page etc. Once it runs then hijack this doesn't have much to do.

Ron

[Jon Finley]

I LOVE succinct howto pages!!

The only thing I could possibly add to this is, a personal preference on pop-up stoppers.

The Google toolbar. If you install it without the advanced features, It works as described, and gives you easy access to a great search engine!

Jon