Hi Adonf - Startpage - For the general hijack case, the best way to start is
to get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. Update and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.
Another excellent program for this purpose is SpyBot Search and Destroy
available here:
http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After fixing things with SpyBot S&D, be sure to
re-boot and rerun SpyBot again and repeat this cycle until you get a clean
"no red" scan. The reason is that SpyBot sometimes has to remove things
which are currently "in use" before it can then clean up others.
See this Microsoft article:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q323869
There's good information about hijacking and fixes available here:
http://www.mvps.org/inetexplorer/answers.htm#home_page
http://www.spywareinfo.com/hijacked.html
http://gmpservicesinc.com/Articles/hijack.asp (links here for .reg files to
lock and unlock your homepage, BTW) and,
Courtesy of Mike Burgess - To Unlock your HomePage go to:
http://www.mvps.org/winhelp2002/ietips.htm#Protecting
and download: HKLM-HKCU_Undo_HomePage.reg
or see below for manual instructions.
Then, from
http://www.fjsmjs.com/IE/homepage.htm (Courtesy of Frank
Saunders MS-MVP IE/OE)
"Some ISP's provide a customized version of IE. Some Web pages will also
reset your home page and do this. One of the customizations they might make
is to disable the ability to change the home page, so that you are forced to
use their home page. You can re-enable this by making a small change in the
Windows registry.
In Regedit, navigate to this key:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel
In the right-hand pane, right-click the "HomePage" value, then select
Modify. Change it to: 00 00 00 00
Also change either or these to zero 0 instead of 1 if present:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explo
rer] - DWORD "NoSetHomePage"=dword:00000001
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet
Explorer\Restrictions] - DWORD "NoSetHomePage"=dword:00000001
If you don't have this key, browse to:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
and in the right hand pane, double click "Local Page" and set equal to
"C:\WINDOWS\System\blank.htm" (no quotes) which will hopefully set your Home
Page to blank and then allow you to subsequently modify it using Internet
Options.
Exit regedit and reboot.
When you reboot, you should be able to change the home page again.
Some pages will also download a program which keeps changing the home page
back. Go to Start | Run and type: msconfig and press <Enter> or click OK.
Go to the Startup tab. See if you can identify any suspicious programs. If
you can, uncheck it, If you can't, change the home page to what you want and
then uncheck one and then reboot. Try IE. If the Web page changed, change it
back and then try msconfig again, rechecking the last one and unchecking the
next. Keep doing this until you find the culprit.
You might also want to look at this little program. I haven't tried it, but
I've read encouraging reports:
http://www.pjwalczak.com/spguard/"
also check out:
Home Page Hijacking
Courtesy of Kelly's Korner, here:
http://www.kellys-korner-xp.com/xp_abc.htm
"Check your settings here for the malware address: Start/Run/Regedit
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel\HomePage
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
IE/Tools/Internet Options/General/Home Page/Address.
If the feature is disabled (greyed out), see here for a script to toggle it:
http://www.dougknox.com/security/scripts_desc/nosethomepage.htm
and/or use these reg files to set the secific condition you want
Lock Home Page:
http://www.kellys-korner-xp.com/regs_edits/HomePageLock.reg
Unlock Home Page:
http://www.kellys-korner-xp.com/regs_edits/HomePageUnlock.reg "
Also, in IE6 you can go to Tools|Internet Options|Programs and click on
Reset Web Settings. BE AWARE though that this will reset your homepage and
search settings to the IE6 defaults.
Lastly, if you didn't go the Reset Web Settings route and ONLY if your
search settings were also hijacked, download and run this .reg file from
Kelly's site:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG
Be sure and clear your Temporary Internet Files (TIF) after implementing any
of these fixes.
Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:
http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it updated) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed for 1073 parasites/tracking cookies, and provides
information and fixit-links for a variety of parasites.
http://www.wilderssecurity.net/spywareguard.html (Monitors for attempts to
install malware)
Both Very Highly Recommended.
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
In
