Re: Home page keeps changing

From: caballo loco (notme@notemail.notmsn.notcom)
Date: 05/15/02 

From: "caballo loco" <notme@notemail.notmsn.notcom>
Date: Wed, 15 May 2002 17:53:33 -0400

Dang!

Question:

My homepage/Searchpage has been hijacked, and I can't seem to change it
back.. no matter what I try. OR:
My computer keeps popping up this annoying web-page even when I'm not
on-line! What can I do?

Answer:

First, at the bottom are two suggestions for keeping this from happening
again.

Second, a few things might be causing this, here are some suggestions from
previous posts:
____________________________________________________________________________
___
1. Try checking here:
HOMEPAGE PROBLEM: http://www.mvps.org/inetexplorer/Darnit.htm#tshoot

HOMEPAGE PROBLEM: http://www.mvps.org/inetexplorer/answers.htm#home_page

SEARCH-PAGE PROBLEM:
http://www.mvps.org/inetexplorer/answers4.htm#search_engine

GO-HIP specific: http://www.gohip.com/remove_browser_enhancement.html
____________________________________________________________________________
___
2. This was suggested to me in a post several weeks ago and worked for some:
go to the registry and search for Default_Page_URL.
When you find it, double click on right-hand pane and modify it back to
whatever default home page you want. Then hit F5 to close
regedit.

____________________________________________________________________________
___
3. Problem:

Normally, to unlock the Homepage setting, follow these steps:
1. Quit all instances of Internet Explorer
2. Open Regedit.exe, navigate to this branch:
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel]
3. Delete the "HomePage" DWORD value.
4. Close Registry Editor, restart IE.

But, somehow some site on the web created an entry in my startup menu with
the following description: OPQFile
C:\Windows\regedit.exe/s C:\Windows\System\rad0348E.tmp That .tmp file
contained a whole bunch of registry settings which kept
sending me back to that porn site "http://sm.sexhound.com", every time I
rebooted my PC.

Solution as submitted by Frank Saunders:
Some page will download a program which keeps changing it back. Go to
Start|Run and type:
"msconfig"
and press <Enter> or click OK. Go to the Startup tab. See if you can
identify any suspicious programs. If you can, uncheck it, If
you can't, change the home page to what you want and then uncheck one and
then reboot. Try IE. If the Web page changed, change it
back and then try msconfig again, rechecking the last one and unchecking the
next. Keep doing this until you find the culprit.

____________________________________________________________________________
___
4. What do you do if you run across a web site that automatically changes
your home page to load their site every time you open
your browser?
Usually you can go into 'Tools' then 'Internet Options' and simply reset it
but some sites are now modifying your security setting
so that you get an error message saying "This operation has been canceled
due to restrictions in effect on this computer. Please
contact your system administrator". To remove the restriction so that you
can reset your home page follow these steps:

Go to start/run and type regedit and hit enter. Click the + sign beside
HKEY_CURRENT_USER (looks like a folder) in the right pane of
regedit
then expand software, then Policies...etc. Keep expanding + signs (you might
have to scroll) to find the next folder (subkey) in the
path until
you finally get to the Restrictions subkey.

HKEY_CURRENT_USER\Software\Policies\Microsoft\InternetExplorer\Restrictions

Click on it (still in the left pane of regedit) and look in the right pane
and you'll see any values it contains. There should be no
values
under that subkey, normally. I think the one you are looking for is called
NoOptions. What you want to do is right click on it and
choose
delete. Do that for any values you find under the Restrictions subkey.
Restart your computer.
HKEY CURRENT USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel
In the right-hand pane, right-click the "HomePage" value, then select
Modify. Change it to: 00 00 00 00
When you reboot, you "should" be able to change the home page again.
Close all of your browser windows, then press Start / Run and type (exactly)
rundll32.exe iedkcs32.dll,Clear

Then open your browser to a home page of your choice and go to Tools /
Internet Options and in the 'General' tab
press 'Use Current' as your home page. 'Apply' / 'OK'.

____________________________________________________________________________
___
5. Yet another.... (Originally posted for 'sexhound.com', but worth a look )
1. Use the Start Button/find file utility to look for: rad0348E.tmp and
delete the file. That .tmp file contained a whole
bunch of registry settings which kept sending me back to that porn site
(There are those who simply do a search for '*.tmp' and
delete ALL temp files from their systems, not a bad idea!)
2. Click on Start and then Run - type in REGEDIT.
3. Click on Edit on the menu bar and then Find - type in the name of the
site (ie - 'sexhound')
4. When it finds one, right click on the file icon and the select Modify,
then enter a 'good' site (eg. http://www.yahoo.com)
5. Once that is complete, hit F3 to find replace all the mentions of that
site with an internet address that you prefer.
6. Close Regedit, then follow step 2 but type in MSCONFIG instead.
7. In the last tab Startup - you should see a file called OPQFile. Make sure
you uncheck this box and then say ok.
8. It will restart the computer and you will find that now your homepage
will revert to the homepage of your choice.

This is for machines running Windows 95/95B/98/98SE operating systems ... I
have not tried this on other operating systems.

____________________________________________________________________________
___
6. a trip to www.lavasoftusa.com for a quick run of Ad-Aware can't hurt.

TWO suggestions for how to keep this from happening again:

1. AND.... I set the ENTIRE internet onto 'Restricted Access' in my INternet
Options/Securty tab, and set for 'Per-Session'
cookies only, and NO SCRIPTING (it is scripts that cause that problem)...
THEN I added my 'known safe' sites to the 'Trusted Sites'
part of the 'Security' area.. now I don't get pop-ups.. and my 'GOOD' sites
work the way I want.. you might consider that idea!

2. From a previous post by 'Bob':
You cannot lock your start page but here is A little app that will stop any
changing of the start page & you can use it to get your
start page back, it is free & this is the url to check it out & if by chance
it does not work go here & do A search for start page
guard.
http://download.cnet.com/downloads/1,10150,0-10000-103-0-1-7,00.html?tag=src
h

OR::
http://pjwalczak.com/spguard/index.php 

--
Microsoft Knowledge-Base:
http://support.microsoft.com/default.aspx
"caballo loco" <notme@notemail.notmsn.notcom> wrote in message
news:#5#ZaEE$BHA.2252@tkmsftngp02...
> Sharon the following is a compedium on the topic of Homepage Hijacks
created
> by Shane who frequents some of the other newsgroups.
>
> See if it helps.
>
> "Sharon" <davi8580@bellsouth.net> wrote in message
> news:285f01c1fac7$6af19e20$a4e62ecf@tkmsftngxa06...
> > I need help.  Somwhow my PC has been targeted by Lolitta
> > (a lovely sex page that I don't want).  I have removed her
> > from my favorites and any other place that I see her
> > name.  I have gone in and changed my homepage a million
> > times, but when I open Internet Explorer POW there she
> > is.  Does anyone out there have any suggestions.  If so
> > please email me directly at davi8580@bellsouth.net
> >
> > I don't know what to do.  I have children in the house and
> > Lolitta and her cousins keep popping up all the time.
> >
> > Thanks
> > Sharon
>
>