Start Page Changes Itself After Every Restart

[Sean Agnew]

Everytime I restart my computer, my home page is changed
to " http:/// " - just that - no address with three -
///'s .

I have tried 72361378612387126313 times to fix this
problem - but for some reason it never sticks. Any
ideas ? It's not a spyware thing as it just deletes the
home page and replaces it with NOTHING.

Possible clue : the time on computer/laptop drops back
three hours every few days. Any help is greatly
appreciated

 

[Hans-Georg Michna]

Everytime I restart my computer, my home page is changed
to " http:/// " - just that - no address with three -
///'s .

I have tried 72361378612387126313 times to fix this
problem - but for some reason it never sticks. Any
ideas ? It's not a spyware thing as it just deletes the
home page and replaces it with NOTHING.

Sean,

rid your computer of adware. You can use the free program SpyBot
Search & Destroy, for example. You have to excise the program
that does this.

Possible clue : the time on computer/laptop drops back
three hours every few days. Any help is greatly
appreciated

Not sure if this is related. Maybe, maybe not.

Hans-Georg

 

[Michael Pardee]

That it always reverts is a strong indication it is some
form of spyware or malware gone haywire. The home page
hijackers are especially hard to detect - my daughter's
boyfriend has a hijacker that McAfee anti-spyware and Spy
Hunter (formerly Spybot) do not detect. They are
extremely hard to remove unless you can identify the page
(in this case you can't) and find a specific removal tool
(in our case we can't). The address is encrypted and
appears nowhere in the registry or in any file on the
computer.

The only sure solution I know is reformat/reinstall.
An "install over" won't do it. Yuck.

Mike

 

[Chuck]

Everytime I restart my computer, my home page is changed
to " http:/// " - just that - no address with three -
///'s .

I have tried 72361378612387126313 times to fix this
problem - but for some reason it never sticks. Any
ideas ? It's not a spyware thing as it just deletes the
home page and replaces it with NOTHING.

Possible clue : the time on computer/laptop drops back
three hours every few days. Any help is greatly
appreciated

Sean,

Spyware, such as home page hijacks, is very tenacious once it installs itself on
your computer. So prepare yourself for a bit of work.

Start by downloading each of the following free tools:
AdAware <http://www.lavasoftusa.com/>
CWShredder <http://www.majorgeeks.com/download4086.html>
HijackThis <http://www.majorgeeks.com/download.php?det=3155>
LSP-Fix and WinsockLSPFix <http://www.cexx.org/lspfix.htm>
Spybot S&D <http://www.safer-networking.org/index.php?page=download>
Stinger <http://us.mcafee.com/virusInfo/default.asp?id=stinger>

Create a separate folder for HijackThis, such as C:\HijackThis - copy the
downloaded file there. AdAware and Spybot S&D have install routines - run them.
The other downloaded programs can be copied into, and run from, any convenient
folder.

First, run Stinger. Have it remove any problems found.

Next, close all Internet Explorer and Outlook windows, and run CWShredder. Have
it fix all problems found.

Next, run AdAware. First update it ("Check for updates now"), configure for
full scan (<http://www.lavahelp.com/howto/fullscan/>), then scan. When scanning
finishes, remove all Critical Objects found.

Next, run Spybot S&D. First update it ("Search for updates"), then run a scan
("Check for problems"). Trust Spybot, and delete everything ("Fix Problems")
that is displayed in Red.

Then, run HijackThis ("Scan"). Do NOT make any changes immediately. Save the
HJT Log.
<http://forums.spywareinfo.com/index.php?showtopic=227>

Finally, have your HJT log interpreted by experts at one or more of the
following security forums (and please post a link to your forum posts, here):
Aumha: <http://forum.aumha.org/index.php>
Net-Integration: <http://forums.net-integration.net/>
Spyware Info: <http://forums.spywareinfo.com/>
Spyware Warrior: <http://spywarewarrior.com/index.php>
Tom Coyote: <http://forums.tomcoyote.org/>

If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.

Finally, improve your chances for the future.

Harden your browser. There are various websites which will check for
vulnerabilities, here are three which I use.
http://www.jasons-toolbox.com/BrowserSecurity/
http://bcheck.scanit.be/bcheck/
https://testzone.secunia.com/browser_checker/

Block Internet Explorer ActiveX scripting from hostile websites (Restricted
Zone).
<https://netfiles.uiuc.edu/ehowes/www/main.htm> (IE-SpyAd)

Block known dangerous scripts from installing.
<http://www.javacoolsoftware.com/spywareblaster.html>

Block known spyware from installing.
<http://www.javacoolsoftware.com/spywareguard.html>

Make sure that the spyware detection / protection products that you use are
reliable:
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Harden your operating system. Check at least monthly for security updates.
http://windowsupdate.microsoft.com/

Block possibly dangerous websites with a Hosts file. Three Hosts file sources I
use:
http://www.accs-net.com/hosts/get_hosts.html
http://www.mvps.org/winhelp2002/hosts.htm
(The third is included, and updated, with Spybot (see above)).

Maintain your Hosts file (merge / eliminate duplicate entries) with:
eDexter <http://www.accs-net.com/hosts/get_hosts.html>
Hostess <http://accs-net.com/hostess/>

Secure your operating system, and applications. Don't use, or leave activated,
any accounts with names or passwords with trivial (guessable) values. Don't use
an account with administrative authority, except when you're intentionally doing
administrative tasks.

Use common sense. Yours. Don't install software based upon advice from unknown
sources. Don't install free software, without researching it carefully. Don't
open email unless you know who it's from, and how and why it was sent.

Educate yourself. Know what the risks are. Stay informed. Read Usenet, and
various web pages that discuss security problems. Check the logs from the other
layers regularly, look for things that don't belong, and take action when
necessary.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Chuck]

That it always reverts is a strong indication it is some
form of spyware or malware gone haywire. The home page
hijackers are especially hard to detect - my daughter's
boyfriend has a hijacker that McAfee anti-spyware and Spy
Hunter (formerly Spybot) do not detect. They are
extremely hard to remove unless you can identify the page
(in this case you can't) and find a specific removal tool
(in our case we can't). The address is encrypted and
appears nowhere in the registry or in any file on the
computer.

Mike,

Don't confuse Spybot S&D (free, and reliable) with SpyHunter (not free, and
questionable history). They are not the same product.
Spybot <http://www.safer-networking.org/en/faq/index.html>
SpyHunter <http://enigmasoftwaregroup.com/>
SpyHunter Note <http://www.spywarewarrior.com/rogue_anti-spyware.htm#sh_note>

AdAware and Spybot are both symptom based, and rely upon rule updates. Updates
are a reactive process, and can't keep up with the spyware flood.

If you have observed symptoms, use AdAware and Spybot to remove what they can
find, then continue with HijackThis, and expert advice.
<http://forums.spywareinfo.com/index.php?showtopic=227>

Always have your HJT log interpreted by experts at one or more of the following
security forums (where you may be prescribed additional tools for specific
infections):
Aumha: <http://forum.aumha.org/index.php>
Net-Integration: <http://forums.net-integration.net/>
Spyware Info: <http://forums.spywareinfo.com/>
Spyware Warrior: <http://spywarewarrior.com/index.php>
Tom Coyote: <http://forums.tomcoyote.org/>

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Chuck]

dont forget spyware blaster, if you click on tools it shows you the
redirects, there is no remove feature but u can edit them to point to the
websites of your choice

Yes, Javacools's SpywareBlaster is an excellent protection. SB stops spyware
from installing, by disabling the scripting that the install uses.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.