Hi Lost - The reg keys you want are identified below:
Startpage - The best way to start is to get Ad-Aware 6.0, Build 162 or
later, here:
http://www.lavasoftusa.com/support/download/.
Update and run this regularly to get rid of most "spyware/hijackware" on
your machine.
Another excellent program for this purpose is SpyBot Search and Destroy
available here:
http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi I recommend
using both normally. After fixing things with SpyBot S&D, be sure to
re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan.
See this Microsoft article:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q323869
There's good information about hijacking and fixes available here:
http://www.mvps.org/inetexplorer/answers.htm#home_page
http://www.spywareinfo.com/hijacked.html
http://gmpservicesinc.com/Articles/hijack.asp (links here for .reg files
to lock and unlock your homepage, BTW) and,
Courtesy of Mike Burgess - To Unlock your HomePage go to:
http://www.mvps.org/winhelp2002/ietips.htm#Protecting
and download: HKLM-HKCU_Undo_HomePage.reg
or see below for manual instructions.
Then, from
http://www.fjsmjs.com/IE/homepage.htm (Courtesy of Frank
Saunders MS-MVP IE/OE)
"Some ISP's provide a customized version of IE. Some Web pages will
also reset your home page and do this. One of the customizations they
might make is to disable the ability to change the home page, so that
you are forced to use their home page. You can re-enable this by making
a small change in the Windows registry.
In Regedit, navigate to this key:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel
In the right-hand pane, right-click the "HomePage" value, then select
Modify. Change it to: 00 00 00 00
Also change either or these to zero 0 instead of 1 if present:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\E
xplorer] - DWORD "NoSetHomePage"=dword:00000001
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet
Explorer\Restrictions] - DWORD "NoSetHomePage"=dword:00000001
If you don't have this key, browse to:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
and in the right hand pane, double click "Local Page" and set equal to
"C:\WINDOWS\System\blank.htm" (no quotes) which will hopefully set your
Home Page to blank and then allow you to subsequently modify it using
Internet
Options.
Exit regedit and reboot.
When you reboot, you should be able to change the home page again.
Some pages will also download a program which keeps changing the home
page back. Go to Start | Run and type: msconfig and press <Enter> or
click OK. Go to the Startup tab. See if you can identify any suspicious
programs. If you can, uncheck it, If you can't, change the home page to
what you want and then uncheck one and then reboot. Try IE. If the Web
page changed, change it back and then try msconfig again, rechecking the
last one and unchecking the next. Keep doing this until you find the
culprit.
You might also want to look at this little program. I haven't tried it,
but I've read encouraging reports:
http://www.pjwalczak.com/spguard/"
also check out:
Home Page Hijacking
Courtesy of Kelly's Korner, here:
http://www.kellys-korner-xp.com/xp_abc.htm
"Check your settings here for the malware address: Start/Run/Regedit
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel\HomePage
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
IE/Tools/Internet Options/General/Home Page/Address.
If the feature is disabled (greyed out), see here for a script to toggle
it:
http://www.dougknox.com/security/scripts_desc/nosethomepage.htm
and/or use these reg files to set the secific condition you want
Lock Home Page:
http://www.kellys-korner-xp.com/regs_edits/HomePageLock.reg
Unlock Home Page:
http://www.kellys-korner-xp.com/regs_edits/HomePageUnlock.reg"
Also, in IE6 you can go to Tools|Internet Options|Programs and click on
Reset Web Settings. BE AWARE though that this will reset your homepage
and search settings to the IE6 defaults.
Lastly, if you didn't go the Reset Web Settings route and ONLY if your
search settings were also hijacked, enter the following (NOT including
the dashed lines) into Notepad and save as: RestoreSearch.reg, then
double click on the saved file to restore your default search settings.
----------------------------
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Do404Search"=hex:01,00,00,00
"Search
Page"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="
http://search.msn.com/intl/searchpane/en-au/prov2.htm"
"Use Custom Search URL"= dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"SearchAssistant"="
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srcha
sst.htm"
"CustomizeSearch"="
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchc
ust.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar
=iesearch"
"Search
Page"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="
http://home.microsoft.com/access/autosearch.asp?p=%s"
" "="+"
"&"="%26"
"+"="%2B"
"#"="%23"
"?"="%3F"
"="="%3D"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Search
Page"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="
http://search.msn.com/intl/searchpane/en-au/prov2.htm"
---------------------------
Be sure and clear your Temporary Internet Files (TIF) after implementing
any of these fixes.
Once you get this cleaned up, you might want to consider installing the
Browser Hijack Blaster, SpywareBlaster and SpywareGuard here to help
prevent this kind of thing from happening in the future:
http://www.wilderssecurity.com/bhblaster.html (Prevents malware BHO's)
http://www.wilderssecurity.com/spywareblaster.html (Prevents malware
Active X installs) (BTW, SpyWare Blaster is not memory resident ... no
CPU or memory load - but keep it updated) The latest version as of this
writing will prevent installation or prevent the malware from running if
it is already installed for 325 parasites/tracking cookies, and
provides information and fixit-links for a variety of parasites.
http://www.wilderssecurity.net/spywareguard.html (Monitors for attempts
to install malware)
All three Very Highly Recommended.
--
Regards, Jim Byrd, MS-MVP
Please respond in original thread in Newsgroup.
In
[email protected], Lost In The Ozone Again
typed:
