IE homepage hijacker

[Guest]

Whenever I open IE, some strange site is my homepage, no matter how many
times I change it to the one I usually have. I have scanned for viruses and
using Search&Destroy and Adaware. How can I get rid of this page?

I am also getting these popups that move across the screen, or open when i
close normal pages. My popup blocker wont block these because their name is a
number which changes everytime.

Help!!

 

[mac]

Whenever I open IE, some strange site is my homepage, no matter how many
times I change it to the one I usually have. I have scanned for viruses
and
using Search&Destroy and Adaware. How can I get rid of this page?

I am also getting these popups that move across the screen, or open when i
close normal pages. My popup blocker wont block these because their name
is a
number which changes everytime.

Help!!

Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm
Get & run CWShredder, & HijackThis

 

[Sandi - Microsoft MVP]

This advice covers three types of home page locking - hijacking (by web
sites), hijacking (by viruses) and locking (by ISPs when you install their
software, and computer manufacturers)

Malware:
If your computer home page is set to about:blank against your wishes, or any
other page, you have a malware problem. For advice on getting rid of it,
check out the link below:
http://inetexplorer.mvps.org/data/tshoot.htm

If you are using Spybot S&D, check your 'immunize' settings which may be
locking the home page.

Microsoft links to problems with the above sites are as follows:

PassThisOn.com Home Page Appears When You Start Computer [Q309313]
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q309313

Cannot Change Default Home Page Setting from Webcombo Site [Q302459]
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q302459

Home Page Setting Changes Unexpectedly, or You Cannot Change Your Home Page
Setting
http://support.microsoft.com/default.aspx?scid=kb;EN-US;320159

In addition, you may discover that browser.secondpower.com is being added to
your homepage URL. This link has an Uninstaller:
http://www.secondpower.com/customer.html

Prevent Hijacking:

First, update to Internet Explorer 6. Most sites that try to hijack your
home page will now trigger a 'do you want to do this' warning message that
lets you stop the hijacking. The sneaky background activex downloads that
are often used by hijack sites to install spyware will also trigger a 'do
you want to do this' install window.

Please see this link for advice on security fixes that can help prevent such
hijackings:

http://inetexplorer.mvps.org/data/prevention.htm

Make sure that your antivirus is completely up to date.

There is a clever little shareware programme that can help stop your home
page being changed; it seems to work well but tends to trigger when you
change your home page manually the next time that you start IE - the
programme makes it much easier to take back control of your home page
settings:
http://www.pjwalczak.com/spguard/

If you are using Spybot S&D you can lock your home page using the 'immunize'
option.

Manufacturer/ISP Locking:

Some computer manufacturers and suppliers of internet access set IE to their
home page and lock this setting via the registry. Hijackers use exactly the
same trick. The locking is done using registry settings as per the
following:

Home Page Setting Changes Unexpectedly, or You Cannot Change Your Home Page
Setting http://support.microsoft.com/default.aspx?scid=kb;EN-US;q320159

Specific registry settings affected are:

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel] -
DWORD "HomePage"=dword:00000001 (grays out the whole section)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
-
DWORD "NoSetHomePage"=dword:00000001

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet
Explorer\Restrictions] -
DWORD "NoSetHomePage"=dword:00000001