Hi James - Check and see if you've selected to "protect" your home page in
the Immunize section of SpyBot S&D. If so, uncheck it and see if you can
then change it. If not, perhaps the following will help.
Startpage - For the general hijack case, the best way to start is to get
Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. Update and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.
Another excellent program for this purpose is SpyBot Search and Destroy
available here:
http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After fixing things with SpyBot S&D, be sure to
re-boot and rerun SpyBot again and repeat this cycle until you get a clean
"no red" scan. The reason is that SpyBot sometimes has to remove things
which are currently "in use" before it can then clean up others.
See this Microsoft article:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q323869
There's good information about hijacking and fixes available here:
http://www.mvps.org/inetexplorer/answers.htm#home_page
http://www.spywareinfo.com/hijacked.html
http://gmpservicesinc.com/Articles/hijack.asp (links here for .reg files to
lock and unlock your homepage, BTW) and,
Courtesy of Mike Burgess - To Unlock your HomePage go to:
http://www.mvps.org/winhelp2002/ietips.htm#Protecting
and download: HKLM-HKCU_Undo_HomePage.reg
or see below for manual instructions.
Then, from
http://www.fjsmjs.com/IE/homepage.htm (Courtesy of Frank
Saunders MS-MVP IE/OE)
"Some ISP's provide a customized version of IE. Some Web pages will also
reset your home page and do this. One of the customizations they might make
is to disable the ability to change the home page, so that you are forced to
use their home page. You can re-enable this by making a small change in the
Windows registry.
In Regedit, navigate to this key:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel
In the right-hand pane, right-click the "HomePage" value, then select
Modify. Change it to: 00 00 00 00
Also change either or these to zero 0 instead of 1 if present:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explo
rer] - DWORD "NoSetHomePage"=dword:00000001
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet
Explorer\Restrictions] - DWORD "NoSetHomePage"=dword:00000001
If you don't have this key, browse to:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
and in the right hand pane, double click "Local Page" and set equal to
"C:\WINDOWS\System\blank.htm" (no quotes) which will hopefully set your Home
Page to blank and then allow you to subsequently modify it using Internet
Options.
Exit regedit and reboot.
When you reboot, you should be able to change the home page again.
Some pages will also download a program which keeps changing the home page
back. Go to Start | Run and type: msconfig and press <Enter> or click OK.
Go to the Startup tab. See if you can identify any suspicious programs. If
you can, uncheck it, If you can't, change the home page to what you want and
then uncheck one and then reboot. Try IE. If the Web page changed, change it
back and then try msconfig again, rechecking the last one and unchecking the
next. Keep doing this until you find the culprit.
You might also want to look at this little program. I haven't tried it, but
I've read encouraging reports:
http://www.pjwalczak.com/spguard/"
also check out:
Home Page Hijacking
Courtesy of Kelly's Korner, here:
http://www.kellys-korner-xp.com/xp_abc.htm
"Check your settings here for the malware address: Start/Run/Regedit
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel\HomePage
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
IE/Tools/Internet Options/General/Home Page/Address.
If the feature is disabled (greyed out), see here for a script to toggle it:
http://www.dougknox.com/security/scripts_desc/nosethomepage.htm
and/or use these reg files to set the secific condition you want
Lock Home Page:
http://www.kellys-korner-xp.com/regs_edits/HomePageLock.reg
Unlock Home Page:
http://www.kellys-korner-xp.com/regs_edits/HomePageUnlock.reg "
Also, in IE6 you can go to Tools|Internet Options|Programs and click on
Reset Web Settings. BE AWARE though that this will reset your homepage and
search settings to the IE6 defaults.
Lastly, if you didn't go the Reset Web Settings route and ONLY if your
search settings were also hijacked, download and run this .reg file from
Kelly's site:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG
Be sure and clear your Temporary Internet Files (TIF) after implementing any
of these fixes.
Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:
http://www.wilderssecurity.com/spywareblaster.html
(Prevents malware Active X installs) (BTW, SpyWare Blaster is not memory
resident ... no CPU or memory load - but keep it updated) The latest
version as of this writing will prevent installation or prevent the malware
from running if it is already installed for 325 parasites/tracking cookies,
and provides information and fixit-links for a variety of parasites.
http://www.wilderssecurity.net/spywareguard.html (Monitors for attempts to
install malware)
Both Very Highly Recommended.
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
In
JAMES BROOKS said:
Greetings.
I cannot change my home page in I.E. 6. It is "grayed-
out".
I did a complete uninstall of this browser. When I
downloaded I. E. again (from Microsoft's site), it
stopped at about 2% of the browser installation process
and gave the message, "THE SOFTWARE THAT YOU ARE
INSTALLING HAS NOT PASSED WINDOWS LOGO TESTING TO VERIFY
ITS COMPATIBILITY WITH WINDOWS XP. THE SOFTWARE WILL NOT
BE INSTALLED. CONTACT YOU SYSTEM ADMINISTRATOR."
I am logged on as Administrator.
The installation of the browser will at that time stop.
Successive attempts illicit the same response, no matter
which option I select. The current home page is
[ft.com/isap/redir.dll?prd=ie&pver=6&ar=msnhome]. This is
only a partial address, since it is grayed-out.
All updates for XP are installed.
The programs that I run to protect my system are: SPYBOT
SEARCH AND DESTROY (FREEWARE), NORTON INTERNET SECURITY,
NORTON SYSTEMWORKS, NORTON ANTIVIRUS, and AVG ANTIVIRUS
(GRISOFT). I had no previous problems changing my home
page. My system is uninfected by the recent worms.
Thank you for your time!
