can't change IE settings (homepage, default search, etc) from my original choices

[Dominic]

This one is strange, because normally I'd suspect SPYWARE. However, I ran
adaware, spybot, and webroot spysweeper and they found nothing. I also ran
HijackThis but didn't find anything suspicious.

The problem comes when I try to change my homepage in IE. I change it and
hit apply, but when I go back into the options or hit the home button it
gets reset to the old homepage. I also run the google toolbar, and I try to
check the box to use google as my default search in IE. When I go to the
options again, the box is unchecked.

It seems that all settings are somehow protected so they can't be changed.

I am running a firewall, popup blocker, and winpatrol. I thought they might
be protecting the homepage and settings, so I exited all of those programs.
I then went into my task manager and killed all the non-critical processes.
I still could not successfully change my homepage.

I attempted to change the homepage in the registry. Then I get an error
(which does not log itself in the computer management errors) that says the
setting cannot be changed.

This happens for my user account (with admin rights) but not for the admin
account. So it is user account specific.

What else could possibly cause this behavior?

Thanks,
Dominic

 

[PA Bear]

Check your system for "hijackware":

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder (fix all found)

2. Ad-Aware (fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You *must* seek updates for Ad-Aware, Spybot, etc., before each
and every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://www.spywareinfo.com/~merijn/files/HijackThis.exe) is the preferred
tool to use. It will help you to both identify and remove any
hijackware/spyware. **Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

Also:

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow all Removal steps.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then Disk Cleanup > More options > Delete all but the most
recent Restore Point.

3. Check in at Windows Update.

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957

--
HTH - Please Reply to This Thread

~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

AumHa Forums
http://forum.aumha.org

What You Should Know About Spyware
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx

 

[Dominic]

Thanks for your help.

I downloaded CWShredder and that found nothing either. It also reports that
I'm 100% clean.

As I wrote before, I already ran Ad-Aware and Spybot (fully updated). I've
also run Webroot Spysweeper. I'm completely clean.

I ran stinger and that shows nothing as well.

Why would spyware / hijackware prevent me from changing a homepage that I
set myself. It's not like it's trying to get me to use coolweb or some
other crappy site. It never set my homepage. I just want to change my old
homepage to something new and I can't.

Again, I would expect it's some protective software running on my user
account, but I can't seem to find anything at all. Not even in safe mode.
Is there some way I can see a program that is monitoring IE settings?

Check your system for "hijackware":

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder (fix all found)

2. Ad-Aware (fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You *must* seek updates for Ad-Aware, Spybot, etc., before each
and every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://www.spywareinfo.com/~merijn/files/HijackThis.exe) is the preferred
tool to use. It will help you to both identify and remove any
hijackware/spyware. **Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

Also:

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow all Removal steps.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then Disk Cleanup > More options > Delete all but the most
recent Restore Point.

3. Check in at Windows Update.

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957

--
HTH - Please Reply to This Thread

~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

AumHa Forums
http://forum.aumha.org

What You Should Know About Spyware
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx

This one is strange, because normally I'd suspect SPYWARE. However, I ran
adaware, spybot, and webroot spysweeper and they found nothing. I also
ran HijackThis but didn't find anything suspicious.

The problem comes when I try to change my homepage in IE. I change it and
hit apply, but when I go back into the options or hit the home button it
gets reset to the old homepage. I also run the google toolbar, and I try
to check the box to use google as my default search in IE. When I go to
the options again, the box is unchecked.

It seems that all settings are somehow protected so they can't be changed.

I am running a firewall, popup blocker, and winpatrol. I thought they
might be protecting the homepage and settings, so I exited all of those
programs. I then went into my task manager and killed all the
non-critical processes. I still could not successfully change my homepage.

I attempted to change the homepage in the registry. Then I get an error
(which does not log itself in the computer management errors) that says
the setting cannot be changed.

This happens for my user account (with admin rights) but not for the admin
account. So it is user account specific.

What else could possibly cause this behavior?

Thanks,
Dominic

 

[Guest]

Check SpyBot.- See if you accidently checked an option under Tools>IE
Tweaks>lock IE Start Page Settings against User Changes. If so, uncheck it.

Thanks for your help.

I downloaded CWShredder and that found nothing either. It also reports that
I'm 100% clean.

As I wrote before, I already ran Ad-Aware and Spybot (fully updated). I've
also run Webroot Spysweeper. I'm completely clean.

I ran stinger and that shows nothing as well.

Why would spyware / hijackware prevent me from changing a homepage that I
set myself. It's not like it's trying to get me to use coolweb or some
other crappy site. It never set my homepage. I just want to change my old
homepage to something new and I can't.

Again, I would expect it's some protective software running on my user
account, but I can't seem to find anything at all. Not even in safe mode.
Is there some way I can see a program that is monitoring IE settings?

Check your system for "hijackware":

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder (fix all found)

2. Ad-Aware (fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You *must* seek updates for Ad-Aware, Spybot, etc., before each
and every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://www.spywareinfo.com/~merijn/files/HijackThis.exe) is the preferred
tool to use. It will help you to both identify and remove any
hijackware/spyware. **Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

Also:

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files

(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)

and then run a full system scan in Safe Mode

(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)

with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,

http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)

and follow all Removal steps.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then Disk Cleanup > More options > Delete all but the most
recent Restore Point.

3. Check in at Windows Update.

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957

--
HTH - Please Reply to This Thread

~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

AumHa Forums
http://forum.aumha.org

What You Should Know About Spyware
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx

 

[Dominic]

That's a good guess. However I had the problem prior to installing spybot.
Spybot and adaware were both installed after I couldn't get rid of the
problem.

I double checked anyway and that checkbox was not checked.

Thanks anyway

Check SpyBot.- See if you accidently checked an option under Tools>IE
Tweaks>lock IE Start Page Settings against User Changes. If so, uncheck it.

Thanks for your help.

I downloaded CWShredder and that found nothing either. It also reports that
I'm 100% clean.

As I wrote before, I already ran Ad-Aware and Spybot (fully updated). I've
also run Webroot Spysweeper. I'm completely clean.

I ran stinger and that shows nothing as well.

Why would spyware / hijackware prevent me from changing a homepage that I
set myself. It's not like it's trying to get me to use coolweb or some
other crappy site. It never set my homepage. I just want to change my old
homepage to something new and I can't.

Again, I would expect it's some protective software running on my user
account, but I can't seem to find anything at all. Not even in safe mode.
Is there some way I can see a program that is monitoring IE settings?

Check your system for "hijackware":

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder (fix all found)

2. Ad-Aware (fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You *must* seek updates for Ad-Aware, Spybot, etc., before each
and every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://www.spywareinfo.com/~merijn/files/HijackThis.exe) is the preferred
tool to use. It will help you to both identify and remove any
hijackware/spyware. **Post your files to

http://forums.spywareinfo.com/
or

http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

Also:

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files

(http://service1.symantec.com/SUPPOR...m/avcenter/venc/data/adware.winfavorites.html)

I
ran it
and

button

it I
try

go

to

 

[Dominic]

I must step away. I guess if everyone is out of ideas I will need to do a
clean install of XP when I return. That is guaranteed to work...

However if anyone knows of an alternative possible cause, I'm all ears.
Thanks, everyone.

That's a good guess. However I had the problem prior to installing spybot.
Spybot and adaware were both installed after I couldn't get rid of the
problem.

I double checked anyway and that checkbox was not checked.

Thanks anyway

Check SpyBot.- See if you accidently checked an option under Tools>IE
Tweaks>lock IE Start Page Settings against User Changes. If so, uncheck it.

reports
that

that

I

set myself. It's not like it's trying to get me to use coolweb or some
other crappy site. It never set my homepage. I just want to change

my
old

homepage to something new and I can't.

Again, I would expect it's some protective software running on my user
account, but I can't seem to find anything at all. Not even in safe mode.
Is there some way I can see a program that is monitoring IE settings?


Check your system for "hijackware":

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder (fix all found)

2. Ad-Aware (fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You *must* seek updates for Ad-Aware, Spybot, etc.,

before
each

and every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://www.spywareinfo.com/~merijn/files/HijackThis.exe) is the preferred
tool to use. It will help you to both identify and remove any
hijackware/spyware. **Post your files to http://forums.spywareinfo.com/
or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

Also:

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files

(http://service1.symantec.com/SUPPOR...m/avcenter/venc/data/adware.winfavorites.html) However,

I

change

it button

and

I go

 

[Kelly]

Hi,

I also ran HijackThis but didn't find anything suspicious.

What did it find?

In the meantime, run the edit on line 268
http://www.kellys-korner-xp.com/xp_tweaks.htm

 

[Alex Nichol]

I downloaded CWShredder and that found nothing either. It also reports that
I'm 100% clean.

CW Shredder is not being updated any more, so you may have a new variant
that it misses. See if you can get to his site at
http://www.spywareinfo.com/
and check the 'chronicles'

Also get Adaware its VX2 cleaner - their description:

How to use Lavasoft's VX2 Cleaner plug-in

- Close Ad-Aware 6 build 181 and Ad-Watch (if running)
- Download the free VX2 Cleaner at
http://updates.ls-servers.com/plvx2cleaner.exe
- Install the VX2 Cleaner
- Start Ad-Aware 6 build 181
- Go to "Plug-ins"
- Select the VX2 Cleaner plug-in and click "Run Plugin"
- If your computer isn't infected, click "Close", otherwise "Clean
System".

 

[PA Bear]

...When all else fails, HijackThis

(http://www.spywareinfo.com/~merijn/files/HijackThis.exe) is the preferred
tool to use...
...**Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**