Home page set without permission - HOW do they do it?

[Al Becker]

There are a number of Web sites that set the IE default home page
without asking the user for permission.... HOW do they do it?

http://www.passthison.com used to do it up until a few days ago. A few
years ago, they even managed to plant a .hta file into the user's
Startup folder, causing the home page to be re-set at every start up.
Sanford Wallace, the site's owner, was even investigated by the FBI
for this. See this article from 2001:

http://zdnet.com.com/2100-11-528428.html?legacy=zdnn

Same goes for the default search engine when the Search button is
clicked. Some sites have found a way to change that property too and
implant a spy redirect url that monitors all searches.

Unfortunately I don't have a good example URL right now because
passthison.com seems to have turned that feature off right now but if
you surf enough random porn or warez sites, or domains that have been
cybersquatted (i.e. the original owner let it expire and some "search
engine" company grabbed it for the residiual traffic), it'll happen to
your browser sooner or later. ;-)

Most registry keys modified by these sites are here:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\*

Just ***HOW*** do they do it????????? Pisses me off!! I want to create
an antispy tool that automatically guards these registry keys, but I
need to know how they get modified without the user's permission in
the first place.

Thanks for any help you can give. If you know the answer and feel
uncomfortable posting such potentially dangerous information in
public, please email me directly

Thanks - Nick

 

[Guest]

My understading is they come in as a browser helper
object. Additionally there was a patch distributed by
Microsoft to prevent a site from auto-hijacking your
homepage.

Often, just turning scripting to off or prompt will
prevent them from changing anything without your
knowledge.

-----Original Message-----
There are a number of Web sites that set the IE default home page
without asking the user for permission.... HOW do they

do it?

 

[Jim Eshelman]

In Windows 2000 and XP you can set permissions on individual Registry keys
to, among other things, stop them from changing.

As you probably know, there are various forms of adware that can change and
lock down this setting. The main protection has been to protect against
parasites (and remove them once contracted).

Sorry, no, I don't know the coding tricks they use -- I'm not a programmer
so I've never looked into it. I just deal with keeping people safe, and
fixing things after they get unsafe. You might, however, find some clues
buried in some of the links I give on http://aumha.org/win5/a/parasite.htm.

--
Jim Eshelman, MS-MVP Windows
http://aumha.org/
http://forum.aumha.org/

Did you find this newsgroup on the web? A newsreader like Outlook Express
will make your online life a lot easier. Get better help!
See: http://aumha.org/win4/supp1b.htm and
http://support.microsoft.com/support/news/howto/default.asp