Default homepage set as C:\WINDOWS\secure.html

[Guest]

MY default homepage sets to C:\WINDOWS\secure.html no
matter what i do. Ive tried to change it, reset all the
web settings ive even uninstalled Internet Explorer and
reinstalled. Some damn site has put this on my hard drive
and Internet Explorer now believes that
C:\WINDOWS\secure.html is the default homepage that
Internet Explorer started off with, i deleted 2 files
that were placed in my Windows folder that had
these "secure" names on so the pages dont load but
whenever i start Internet Explorer it says it cant find
these files (obviously because i deleted them) how can i
utterly uninstall Internet Explorer to a totally new
fresh version that doesnt have this sites
C:\WINDOWS\secure.html sitting in the default homepage!

 

[Ramesh [MVP]]

Homepage changes unexpectedly:
http://www.mvps.org/sramesh2k/IEFAQ.htm

For Prevention and to know how to protect the system from spyware:
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines:
http://mvps.org/winhelp2002/unwanted.htm

--
Ramesh - Microsoft MVP
http://www.mvps.org/sramesh2k

-------------------------------------------
Prevent Spyware from being installed:
http://www.mvps.org/sramesh2k/Malware_Defence.htm

Prevent malware from being installed - Part 2:
http://www.mvps.org/sramesh2k/MalwareDefence_Example.htm
-------------------------------------------

MY default homepage sets to C:\WINDOWS\secure.html no
matter what i do. Ive tried to change it, reset all the
web settings ive even uninstalled Internet Explorer and
reinstalled. Some damn site has put this on my hard drive
and Internet Explorer now believes that
C:\WINDOWS\secure.html is the default homepage that
Internet Explorer started off with, i deleted 2 files
that were placed in my Windows folder that had
these "secure" names on so the pages dont load but
whenever i start Internet Explorer it says it cant find
these files (obviously because i deleted them) how can i
utterly uninstall Internet Explorer to a totally new
fresh version that doesnt have this sites
C:\WINDOWS\secure.html sitting in the default homepage!

 

[Khoi Nguyen]

Hi there,

I have the same problem. I have tried Ad-Ware 6, "hijackthis", and
cwshredder, but the problem is still there. I had to delete the two
files secure.html and securel.html and be happy that I suffer only the
inconvinience of not having a default website.

Does anyone have a solution. Please share your knowledge. Thanks.

Khoi
January 25, 2004

 

[Khoi Nguyen]

Dear all:

I myself have that same annoying problem that my default (home) page
being set to C:\WINDOWS\secure.html. After giving up on fixing it, I
have found a way to cheat around that problem!

I opened my desired default site of "www.mail.yahoo.com" and then
saved it in the folder C:\Windows with the new name "secure.html" so
as to replace the one placed there by the parasite program. That's
it!

I am happy with this solution, at least for now.

KHoi
January 25, 2004

 

[H Leboeuf]

If all fails, then get help from this forum.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html

 

[Fred]

These are all nice suggestions, but I've run AntiVirus checks, Run the
latest Ad-Aware. Gone into my registry, checked startup options...
This is dynamic. Something must be reseting it. I can change it back
and then go back into the options and it's gone back to secure.html
again.

fred

 

[H Leboeuf]

It's time for the expert from this forum.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html

 

[Dave]

This is a new one. I got it also, and tried everything. I used updated
Norton, AdAware, Spybot, RegClean, ETC. I perused the registry; I
Googled. (That's how I found this thread)
After reading some Google results, I downloaded CWShredder.

*THAT fixed the registry so that it would not reset itself. I think
the *most recent version** of CWShredder does the trick. I'm kicking
myself for not saving a log of the registry to see exactly what key had
been changed to make it a nasty dynamic.

I changed 6 registry items after CWShredder had done its work.
Under users and machine-software-microsoft-iexplorer-main.
There are 3 references in each to "secure.html" I changed Startpage to
Http://www.google.com and the other four to
C:\windows\system\oobe\blank.htm (that is the path to my "Blank.HTM",
yours may vary)

I hope I have helped,

~Dave

MY default homepage sets to C:\WINDOWS\secure.html no
matter what i do. Ive tried to change it, reset all the
web settings ive even uninstalled Internet Explorer and
reinstalled. Some damn site has put this on my hard drive
and Internet Explorer now believes that
C:\WINDOWS\secure.html is the default homepage that
Internet Explorer started off with, i deleted 2 files
that were placed in my Windows folder that had
these "secure" names on so the pages dont load but
whenever i start Internet Explorer it says it cant find
these files (obviously because i deleted them) how can i
utterly uninstall Internet Explorer to a totally new
fresh version that doesnt have this sites
C:\WINDOWS\secure.html sitting in the default homepage!

--

 

[H Leboeuf]

Yes, thanks for the feedback, now we know that the CWS tool works.

p.s.
Did you still have problems after you used the tool?
Seems like the CSW tool did not remove the reference to your home page.

 

[Dave]

CWS removed the reference in registry that made this thing
"handleable". I suspect a change from a zero to a one,that created the
dynamic change capability, even in the registry.

I also suspect the author of this code has a small penis, and is
reading this now.

Hope I Have helped

~Dave

 

[Dave]

The author of this malware has a small penis, and is reading...

 

[Dave]

I suspect a change from a zero to a one in the registy that allows this
dynamic. I have never seen a registry change like this to correct a
trojan. Add this to my previous response.

C:\windows\secure.htm is fixable

~Dave, again