All your home pages are belong to us!

[Guest]

I'm having a serious problem. Every so often, my IE
homepage will be changed against my knowledge/will. It is
always easliy changed back to whatever homepage I had
previously loaded. Within the past week my homepage has
been About:blank with some super suck random search engine.
This normally isn't a problem but when I attempt to change
the page back it doesn't allow the change, and I can't even
do normal browsing as it tells me that whatever page I'm
searching for (i.e. www.hotmail.com) doesn't exist, but
then has the same exact link available to click on from
their website. Has anyone else had this specific problem?
Any ideas short of chucking it out the window to take care
of it? Any help would be greatly appreciated.

 

[H Leboeuf]

Get this removal tool. You probably have been hacked by the AboutBlank
variant of this nasty parasite.

CoolWebSearch - CWS http://www.spywareinfo.com/articles/cws/
The: Complete list by variant with up-to-date information.
http://www.spywareinfo.com/~merijn/cwschronicles.html
More: Removal tool: http://www.spywareinfo.com/~merijn/files/cwshredder.zip

 

[Sandi - Microsoft MVP]

You have been infected with a coolwwwsearch variant. CWshredder should get
things sorted for you:
http://www.spywareinfo.com/~merijn/cwschronicles.html

This advice covers three types of home page locking - hijacking (by web
sites), hijacking (by viruses) and locking (by ISPs when you install their
software, and computer manufacturers)

Hijacking

First, update to Internet Explorer 6. Most sites that try to hijack your
home page will now trigger a 'do you want to do this' warning message that
lets you stop the hijacking. The sneaky background activex downloads that
are often used by hijack sites to install spyware will also trigger a 'do
you want to do this' install window.

Some web sites try to change your home page or search engine options if you
visit them. Some that have been mentioned in the newsgroups include gohip,
sureseeker, webcombo, cybersearch and passthison.

Microsoft links to problems with the above sites are as follows:

PassThisOn.com Home Page Appears When You Start Computer [Q309313]
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q309313

Cannot Change Default Home Page Setting from Webcombo Site [Q302459]
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q302459

More general advice can be found at the next link:

Home Page Setting Changes Unexpectedly, or You Cannot Change Your Home Page
Setting
http://support.microsoft.com/default.aspx?scid=kb;EN-US;320159

In addition, you may discover that browser.secondpower.com is being added to
your homepage URL. This link has an Uninstaller:
http://www.secondpower.com/customer.html

Please see this link for advice on security fixes that can help prevent such
hijackings.

http://www.mvps.org/inetexplorer/Darnit.htm#hijackings

Also, there are some viruses that can reset your home page - so make sure
that your antivirus is completely up to date.

There is a clever little shareware programme that can help stop your home
page being changed; it seems to work well but tends to trigger when you
change your home page manually the next time that you start IE - the
programme makes it much easier to take back control of your home page
settings:

http://www.pjwalczak.com/spguard/

Locking

Some computer manufacturers and suppliers of internet access set IE to their
home page and lock this setting via the registry. Hijackers use exactly the
same trick. The locking is done using registry settings as per the
following:

Home Page Setting Changes Unexpectedly, or You Cannot Change Your Home Page
Setting (Q320159)
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q320159

Specific registry settings affected are:

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel] - DWORD "HomePage"=dword:00000001 (grays out the whole section)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
- DWORD "NoSetHomePage"=dword:00000001

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet
Explorer\Restrictions] - DWORD "NoSetHomePage"=dword:00000001

--
Hyperlinks are used to ensure advice remains current
Do NOT send me an email. I will NOT see it (thank the spammers and viruses)
_______________________________________
Sandi - Microsoft MVP since 1999 (IE/OE)
http://inetexplorer.mvps.org/