Hi Ray - Startpage - The best way to start is to get Ad-Aware 6.0, Build 162
or later (current is 181), here:
http://www.lavasoftusa.com/support/download/.
Update and run this regularly to get rid of most "spyware/hijackware" on
your machine.
Another excellent program for this purpose is SpyBot Search and Destroy
available here:
http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi I recommend
using both normally. After fixing things with SpyBot S&D, be sure to
re-boot and rerun SpyBot again and repeat this cycle until you get a clean
"no red" scan.
See this Microsoft article:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q323869
There's good information about hijacking and fixes available here:
http://www.mvps.org/inetexplorer/answers.htm#home_page
http://www.spywareinfo.com/hijacked.html
http://gmpservicesinc.com/Articles/hijack.asp (links here for .reg files to
lock and unlock your homepage, BTW) and,
Courtesy of Mike Burgess - To Unlock your HomePage go to:
http://www.mvps.org/winhelp2002/ietips.htm#Protecting
and download: HKLM-HKCU_Undo_HomePage.reg
or see below for manual instructions.
Then, from
http://www.fjsmjs.com/IE/homepage.htm (Courtesy of Frank
Saunders MS-MVP IE/OE)
"Some ISP's provide a customized version of IE. Some Web pages will also
reset your home page and do this. One of the customizations they might make
is to disable the ability to change the home page, so that you are forced to
use their home page. You can re-enable this by making a small change in the
Windows registry.
In Regedit, navigate to this key:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel
In the right-hand pane, right-click the "HomePage" value, then select
Modify. Change it to: 00 00 00 00
Also change either or these to zero 0 instead of 1 if present:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explo
rer] - DWORD "NoSetHomePage"=dword:00000001
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet
Explorer\Restrictions] - DWORD "NoSetHomePage"=dword:00000001
If you don't have this key, browse to:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
and in the right hand pane, double click "Local Page" and set equal to
"C:\WINDOWS\System\blank.htm" (no quotes) which will hopefully set your Home
Page to blank and then allow you to subsequently modify it using Internet
Options.
Exit regedit and reboot.
When you reboot, you should be able to change the home page again.
Some pages will also download a program which keeps changing the home page
back. Go to Start | Run and type: msconfig and press <Enter> or click OK.
Go to the Startup tab. See if you can identify any suspicious programs. If
you can, uncheck it, If you can't, change the home page to what you want and
then uncheck one and then reboot. Try IE. If the Web page changed, change it
back and then try msconfig again, rechecking the last one and unchecking the
next. Keep doing this until you find the culprit.
You might also want to look at this little program. I haven't tried it, but
I've read encouraging reports:
http://www.pjwalczak.com/spguard/"
also check out:
Home Page Hijacking
Courtesy of Kelly's Korner, here:
http://www.kellys-korner-xp.com/xp_abc.htm
"Check your settings here for the malware address: Start/Run/Regedit
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel\HomePage
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
IE/Tools/Internet Options/General/Home Page/Address.
If the feature is disabled (greyed out), see here for a script to toggle it:
http://www.dougknox.com/security/scripts_desc/nosethomepage.htm
and/or use these reg files to set the secific condition you want
Lock Home Page:
http://www.kellys-korner-xp.com/regs_edits/HomePageLock.reg
Unlock Home Page:
http://www.kellys-korner-xp.com/regs_edits/HomePageUnlock.reg "
Also, in IE6 you can go to Tools|Internet Options|Programs and click on
Reset Web Settings. BE AWARE though that this will reset your homepage and
search settings to the IE6 defaults.
Lastly, if you didn't go the Reset Web Settings route and ONLY if your
search settings were also hijacked, enter the following (NOT including the
dashed lines) into Notepad and save as: RestoreSearch.reg, then double
click on the saved file to restore your default search settings.
----------------------------
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Do404Search"=hex:01,00,00,00
"Search Page"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="
http://search.msn.com/spbasic.htm"
"Use Custom Search URL"= dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="
http://home.microsoft.com/access/autosearch.asp?p=%s"
"provider"=""
" "="+"
"&"="%26"
"+"="%2B"
"#"="%23"
"?"="%3F"
"="="%3D"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Search Page"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="
http://search.msn.com/spbasic.htm"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.
htm"
"CustomizeSearch"="
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.
htm"
"Default_Search_URL"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"
"Search Page"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix]
@="http://"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"
---------------------------
Be sure and clear your Temporary Internet Files (TIF) after implementing any
of these fixes.
Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:
http://www.wilderssecurity.com/spywareblaster.html
(Prevents malware Active X installs) (BTW, SpyWare Blaster is not memory
resident ... no CPU or memory load - but keep it updated) The latest
version as of this writing will prevent installation or prevent the malware
from running if it is already installed for 325 parasites/tracking cookies,
and provides information and fixit-links for a variety of parasites.
http://www.wilderssecurity.net/spywareguard.html (Monitors for attempts to
install malware)
Both Very Highly Recommended.
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
In
