hijacked homepage

[Evan]

hi there. i've got a user whose homepage keeps resetting to www.dell.com.
virus and spyware checks are clean. hosts file is clean. nothing in startup
group and nothing in hklm....run or hkcu....run. did a registry search and
found a couple of references to dell.com in hkcu\software\microsoft\internet
explorer\main and deleted those. but they keep coming back.

also found references here:

hku\*SID*\software\microsoft\internet connection wizard\shellnext
hku\*SID*\software\microsoft\internet explorer\main\default_page_url
hku\*SID*\software\microsoft\internet explorer\main\start page

deleted those as well. they stayed deleted, but apparently, are not the
culprits.

so, where in the heck is this coming from?

w2k sp4, ie6 sp1. all patches, hotfixes, etc. are current.


thx,

evan

 

[PA Bear]

Is it a Dell machine...?

Check for Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

 

[Jim Byrd]

Hi Evan - Does your user have the Ad-Match component of the paid version of
AdAware installed?

 

[Evan]

yes, silly of me not to mention it....but, yes, it is a dell machine. and,
like i said, av scan (sophos) and spyware scan (ad-aware plus and ms) came
up clean. also, absent from my first post (i apologize for that), is my
thought
that this not actually any sort of malware. in fact, i believe that it's
just something broken in ie. if we follow that line of thinking, is there
anything that pops to mind?

of course, i'm also entertaining the idea that dell has somehow locked their
homepage, although this would be the first time i've seen and/or heard of
such a thing from dell. not likely, i suppose.

NEVERMIND!!!!! here's what's going on.....

%$^%)&^% ad-aware, that's what's going on. ad-aware thought that changing
the homepage was a 'possible browser hijack attempt' and reset the homepage
to dell everytime (a normally desirable behaviour, i suppose). i have
unchecked that setting and reiterated again to my boss how much i hate
ad-aware and that we never should have purchased it. sorry to have bothered
you with my non-issue. although, perhaps, this might happen to someone else
and this might save them some grief.

thx again,

evan

 

[Evan]

yeah, jim. that's exactly what it was. it took me a while to write my last
post and didn't see your post before i posted my post in the posting postal
portal place.

good call, thx!

 

[PA Bear]

Jim, is this where your related post elsewhere came from? If not, pretty
amazing to see this bit with Ad Watch come up twice in a few hours!

 

[Jim Byrd]

Hi Bear - Nope, it actually was a different one in Partners. I wonder if
something changed in a recent update to AdAware (there just was one, IIRC)?

 

[Jim Byrd]

YW, (FWIW) At least you got things straightened out!