MSN hijacks homepage

[Guest]

I LIKE "about Blank" and set IE up that way intentionally; it has worked fine for 5 yrs on various versions; NOW... MSN hijacks the page and resets my homepage to MSN and or one of several MICROSOFT search pages; this problem only began after installing the latest Microsoft 'security' patches; the problem affects 3 different XP pc's that i use at various locations

Adwatch set to 'lock registry' will at least catch & block the MSN hijack, but why is Microsoft trying to hijack my homepage preferences? What can be done to stop this?

I have XP Pro, firewall on, Adaware, spybot, spybot search & destroy, |Trend antivirus, BO Clean, and others... my system is clean;

 

[siljaline]

I LIKE "about Blank" and set IE up that way intentionally; it has worked fine for

5 yrs on various versions; NOW... MSN hijacks the page and resets my homepage to MSN
and or one of several MICROSOFT search pages; this problem only began after
installing the latest Microsoft 'security' patches; the problem affects 3 different
XP pc's that i use at various locations

Adwatch set to 'lock registry' will at least catch & block the MSN hijack, but

why is Microsoft trying to hijack my homepage preferences? What can be done to stop
this?

I have XP Pro, firewall on, Adaware, spybot, spybot search & destroy, |Trend

antivirus, BO Clean, and others... my system is clean;

Configure Ad-aware *not* to load ad-watch on start-up, see if your situation
improves > http://www.lavahelp.com/faq/adwatchauto.shtml

If no joy, run CWShredder for your "about:blank" issue.
Info: http://www.spywareinfo.com/~merijn/cwschronicles.html#aboutblank
Removal tool (does not work in all instances)
http://www.spywareinfo.com/~merijn/files/cwshredder.zip
Close all Browser Windows and running applications > unzip > click on
the executable and follow the prompts.

HTH
~Silj

--
siljaline

MS - MVP Windows (IE/OE) AH-VSOP
________________________________
Anti-Parasite Definition Updates
http://forum.aumha.org/viewforum.php?f=31

(Reply to group, as return address
is invalid - that we may all benefit)

 

[Guest]

Regstry modification attempt is this: (sets homepage to MSN.com)
http://www.microsoft.com/isapi/redir.dll?prd=ie&clcid=0x0409&pver=6.0&ar=home

Adaware/Adwatch catches & blocks this attempt when set to do so.

CWShredder reports: "Done! Your system was completely clean"

HjackThis reports:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

AND a couple of things I don't recognize:

O17 - HKLM\System\CCS\Services\Tcpip\..\{2E9B44B0-D8D3-4107-A472-54169BBFBC8E}: NameServer = 66.81.0.251 66.81.0.252

O17 - HKLM\System\CCS\Services\Tcpip\..\{F8783E7A-0F83-48EB-9704-5B084FB2321E}: NameServer = 172.16.10.2,172.16.10.3

--


******

If they say it on the Internet, it must be true.

 

[Guest]

this is the redirect:
http://www.microsoft.com/isapi/redir.dll?prd=ie&clcid=0x0409&pver=6.0&ar=home

CWShredder reports "Done! Yiour System is Clean"

Hijack this finds

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O17 - HKLM\System\CCS\Services\Tcpip\..\{2E9B44B0-D8D3-4107-A472-54169BBFBC8E}: NameServer = 66.81.0.251 66.81.0.252

O17 - HKLM\System\CCS\Services\Tcpip\..\{F8783E7A-0F83-48EB-9704-5B084FB2321E}: NameServer = 172.16.10.2,172.16.10.3



Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)




--


******

If they say it on the Internet, it must be true.

 

[siljaline]

Regstry modification attempt is this: (sets homepage to MSN.com)
http://www.microsoft.com/isapi/redir.dll?prd=ie&clcid=0x0409&pver=6.0&ar=home

Inline, Larry -

http://www.microsoft.com/isapi/redir.dll?prd=ie&clcid=0x0409&pver=6.0&ar=home

This is a simple redirect to MSN - you *may* have mistakenly reset your
"about:blank"

Adaware/Adwatch catches & blocks this attempt when set to do so.

Shut Ad-watch *off* and re-set your Home Page to: "about:blank"
{Ad-watch - Ad-ware} are most likely false-flagging the "blank" URL setting!
__Report this matter to Lavasoft > http://www.lavasoftsupport.com

CWShredder reports: "Done! Your system was completely clean"

CWShredder does not catch all instances of "about:blank" as there are
variants - don't _assume that you're clean, you may not be.

HjackThis reports:

<snip> <Don't Post Results Here>

Follow the instructions for generating a *full* HijackThis log report >
http://mvps.org/winhelp2002/unwanted.htm

Post your "HijackThis" findings/Log here >
http://forums.spywareinfo.com/index.php?showforum=18
http://computercops.biz/forum67.html
http://forum.aumha.org/viewforum.php?f=30

~Silj

--
siljaline

MS - MVP Windows (IE/OE) AH-VSOP
________________________________
Anti-Parasite Definition Updates
http://forum.aumha.org/viewforum.php?f=31

(Reply to group, as return address
is invalid - that we may all benefit)

 

[Guest]

yes, 'way ahead of you.. did all that, multiple times

everytime I reboot system, the MSN redirect attempts to reset my homepage
--


******

If they say it on the Internet, it must be true.

 

[Guest]

good stuff.. i'll follow all those links for more solutions!

fyi, I also run BO Clean which is supposed to catch CWS, etc
http://www.nsclean.com/trolist.html

 

[Bill Sumrall]

yes, 'way ahead of you.. did all that, multiple times

everytime I reboot system, the MSN redirect attempts to reset my homepage

---------
I had this occur a week, maybe 10 days ago. Found it to be something
called "winpup" as I remember... were about 6 entries. Don't remember
which of the spycleaners caught it, but only one did. I was trying'em
all...spybotsd13, cwshredder, hijackthis, spywareblaster and BHOdemon.
Finally able to get back to about:blank as opening page, which I
prefer.
Bill

 

[siljaline]

yes, 'way ahead of you.. did all that, multiple times

everytime I reboot system, the MSN redirect attempts to reset my homepage

Ok then, where did you post your HijackThis log?
Post the URL of the Forum where your log is at and I'll have
a look.
Sounds to me you're running too fast here and missing important steps.
Your call Larry, if you don't fully read the recommendations laid out
for you, they won't work if they're not carried out to the letter.

~Silj

--
siljaline

MS - MVP Windows (IE/OE) AH-VSOP
________________________________
Anti-Parasite Definition Updates
http://forum.aumha.org/viewforum.php?f=31

(Reply to group, as return address
is invalid - that we may all benefit)