[georgeblack18]

Hi,

Been doing some 'surfin' and somehow picked up a 'default' home page address of a questionable (but very legal !) address.<p>
I can of course right click to change the properties of the 'IE' icon back to default before going on line but would really like to edit this out from 'regedit'.<p>
Problem does not 'come back' during the time 'puter' is used only on start-up.<p>
Many Thanks for any assistance.<p>
georgeblack18

[RandyG]

Welcome to TSG!

First thing to ask is if you have already tried to go to Tools, Internet Options, and changed the Home page there? If you have attempted this, and the offending address is persistent in adding itself back in, then try the regedit below.

If you are familiar with regedit, then the easiest thing to do would be to Ctrl + F, and search for the offending address. Replace all instances you find with a more agreeable home address.


If you have IE5.5 and Win98SE, you should find it at HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main and then double click the Start Page in the right window to change the address to something else.

and at HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main and then double click the Start Page in the right window to change the address to something else.


Let us know if this sorts it for you!

[Rollin' Rog]

Welcome to TSG, George.

We're having problems sorting this issue out, but it seems to be happening a lot lately. What evidently has happened is that some site installed a file which is changing the registry back every boot up.

Go to start and run msconfig

Click on the "startup" tab. Do you see anything there with an .hta extension? (this would probably be a shortcut in your Programs\Startups folder). Or sp.dll ?

There is a Reg hack on this thread that you can try. Let us know how it goes.


http://forums.techguy.org/showthread...ight=home+page

[RandyG]

Now that's timing.


Thanx Rog, for the additional input. I hadn't known about the links you posted.

[georgeblack18]

Hi Guys,

Many thanks for your welcomes' and replies - a little late here in the U.K. now but will attempt the suggestions in the a.m. and report back !<p>All the best<p><b>George</b>

[georgeblack18]

Hi <b>RandyG</b><p>
Yes have tried to change Tools>Internet Options but page still persists !<p>
Regedit shows 'no find' on the url - also HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main & HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main only show the correct adresses for default & local page (blank) ?<p>
<b>Rollin' Rog</b><p>msconfig - startup tab show no .hta or sp.dll ?<p>Any other suggestions gratefully received !<p>
Many Thanks<p>
<b>George</b>

[Rollin' Rog]

That's very puzzling. I can't explain how you could have a start page without it being listed in the registry. Was it actually open when you did the search? Sometimes the regedit find tool is a bit tricky to use. It doesn't work right if you have already manually navigated to keys. And it is better to use a key portion of what you are looking for, rather than the whole entry. I always do a Find immediately after opening the Editor.

Anyway, I would try this. Install noscript.exe from symantec. This is a very convenient, one click tool for disabling or enabing the Windows Scripting Host, a very exploitable tool used by worms and sleazy operators to make bad things happen on your pc. It is not at all required for normal Windows functions:

http://www.sarc.com/avcenter/venc/da...t.hosting.html

If this continues to be a problem, it might help us to have a look at the StartupLog.txt, which you can create and copy/paste here after running Startuplog.com from the site below. We don't need the stubbpaths.txt.

http://home.earthlink.net/~rmbox/Reticulated/Toys.html

[TonyKlein]

Hi,

You might have a 'Homepage' registry restriction in place, that prevents you from changing your home page in the first place.

Here's a complete list of tips to follow:

Go to Start/run, and type Regedit.
Navigate to HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Control Panel
Is the subkey called 'Control Panel' indeed there, rightclick it, and choose delete from the context menu.
Close Regedit

Now close Internet Explorer and Outlook Express.
Go to Control Panel/Internet Options, and clear your temporary Internet files.
Now click on Settings/show files, and delete your cookies.

Go to the 'Programs' tab, and click 'reset Web Settings'.
Go to the 'Security' tab, and set all ActiveX options that are now set to 'allow', to 'prompt'.
Also uncheck 'Enable install on demand' on the 'advanced' tab.

Now open Internet Explorer, and go to your favorite Start Page.
Go to Internet Options, General tab, and click 'Use current'.

After changing your home page to the one you prefer, immediately apply the reg hack, in order to lock your home page. This is an easy way:

Past the bold into Notepad. Save as Homepage, reg, and doubleclick it.
Answer 'yes' to have it imported into the registry.

REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Control Panel]
"Homepage"=dword:00000001

And do follow up on Rog's advice as well.

Good luck,

[georgeblack18]

<b>Hi Rollin' Rog & Tony</b><p>
Thank you very much for your further help/guidance (what a site this is !!)<p>I am 'reasonably' computer literate - or I thought I was until (to me !) I see 'regedit' & 'msconfig' suggested ! - anyway I shall follow both of your 'posts' and report back !<p>
Many thanks again for your kind attentions to my problem.<p>
<b>George</b>

[georgeblack18]

Hi again,<p>

I have tried to navigate to HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Control Panel but no file listed (running 'ME' - just realised I had not mentioned sorry !).<p>
Ran the 'Startup' program - resulted :-<p>
The following is a list of your current Start-Ups
__________________________________________________________________________
__________________________________________________________________________

1. HKLM Run - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NAV DefAlert"="C:\\PROGRA~1\\NORTON~1\\DEFALERT.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalCo mponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalCo mponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalCo mponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalCo mponents\IMAIL]
"Installed"="1"


==========================================================================
__________________________________________________________________________

2. HKCU Run - Registry

[RegPath]
"StartUp"


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OPQFile"="C:\\WINDOWS\\regedit.exe /s C:\\WINDOWS\\SYSTEM\\rad3BBBD.tmp"


==========================================================================
__________________________________________________________________________

3. HKLM RunOnce - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]


==========================================================================
__________________________________________________________________________

4. HKCU RunOnce - Registry

[RegPath]
"StartUp"


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]


==========================================================================
__________________________________________________________________________

5. HKLM RunServices - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]


==========================================================================
__________________________________________________________________________

6. HKLM RunServicesOnce - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnc e]


==========================================================================
__________________________________________________________________________

7. WIN.INI File - (c:\windows\win.ini)

Your win.ini run/load lines should look like run= and load= exclusively.
There should be nothing to the right of the equal signs.


These are the run and load lines in your WIN.INI file

run=

load=

==========================================================================
__________________________________________________________________________

8. SYSTEM.INI File - (c:\windows\system.ini)

Your system.ini shell line should look like shell=Explorer.exe exclusively.
You should only see Explorer.exe following the equal sign.


This is the shell line in your SYSTEM.INI file

shell=Explorer.exe

==========================================================================
__________________________________________________________________________

9. AUTOEXEC.BAT File - (c:\autoexec.bat)

(Some trojans have been known to start from this file)


These are your program startups and set paths in your autoexec.bat file


==========================================================================
__________________________________________________________________________

10. StartUp Folder - (c:\windows\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.


These are the shortcuts located in your StartUp folder

*(No start-ups found)*

==========================================================================
__________________________________________________________________________

11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.


These are the shortcuts located in your All Users StartUp folder


*(No start-ups found)*

==========================================================================
__________________________________________________________________________

12. Miscellaneous StartUp Configurations

-============================-
Registry StartUp Directories
-============================-

Should show the Start Menu StartUp and All Users StartUp directories

.....................................................................

[1] HKCU - Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

"Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

.....................................................................

[2] HKCU - User Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders


.....................................................................

[3] HKLM - Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

"Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

.....................................................................

[4] HKLM - User Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders


.....................................................................

-=======================-
Registry Shell Spawning
-=======================-

Open Commands for Executable File Types

@="\"%1\" %*"
(.exe file - RegPath = HKCR\exefile\shell\open\command)

@="\"%1\" %*"
(.com file - RegPath = HKCR\comfile\shell\open\command)

@="\"%1\" /S"
(.scr file - RegPath = HKCR\scrfile\shell\open\command)

@="\"%1\" %*"
(.bat file - RegPath = HKCR\batfile\shell\open\command)

@="\"%1\" %*"
(.pif file - RegPath = HKCR\piffile\shell\open\command)

@="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
(.hta file - RegPath = HKCR\htafile\shell\open\command)

-=========================-
HKLM RunOnceEx - Registry
-=========================-


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]


-====================-
StubPaths - Registry (Partial Listing)
-====================-

(Please see the StubPath.txt on your desktop for complete listing)

HKLM\Software\Microsoft\Active Setup\Installed Components


"StubPath"="C:\\WINDOWS\\SYSTEM\\ie4uinit.exe"
"StubPath"="C:\\WINDOWS\\msnmgsr1.exe"
"StubPath"="C:\\WINDOWS\\COMMAND\\sulfnbk.exe /L"
"StubPath"=""
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:WIN9X /user /install"
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:WIN9X /user /install"
"StubPath"="C:\\WINDOWS\\SYSTEM\\updcrl.exe -e -u C:\\WINDOWS\\SYSTEM\\verisignpub1.crl"

-=================-
WINSTART.BAT File - (c:\windows\winstart.bat)
-=================-

@C:\WINDOWS\tmpcpyis.bat

-=================-
DOSSTART.BAT File - (c:\windows\dosstart.bat)

- Supplemental Environment Information -

COMSPEC=C:\WINDOWS\COMMAND.COM
PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
TEMP=C:\WINDOWS\TEMP
TMP=C:\WINDOWS\TEMP
winbootdir=C:\WINDOWS
windir=C:\WINDOWS

File - c:\windows\deletefi.ini

As before grateful if anything appears 'useful' in the above and will check in tomorrow for any further info'.<p>
Again my Thanks<p>
George

[Rollin' Rog]

OPQFile"="C:\\WINDOWS\\regedit.exe /s C:\\WINDOWS\\SYSTEM\\rad3BBBD.tmp"


Very suspicious! this is running a registry patch from something with a .tmp extension in your c:\windows\system folder.

I don't know what it is, but I doubt it's legit.

Go to start, run: msconfig and deselect it from the startup group.

Retest

To remove it permanently from the Registry, run regedit and navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr
entVersion\Run]

With RUN (or RUN- if it has been unchecked in msconfig) folder highlighted, right click and delete it

Close the Registry editor, reboot and find and delete

rad3BBBD.tmp

from c:\windows\system


Edit

Bingo!

http://groups.google.com/groups?q=OP...=Google+Search

[georgeblack18]

Hi Rog,

Many thanks for the info' - will do exactly that and report back !

George

[georgeblack18]

<b>Hi Rog</b><p>
Worked a treat ! - many thanks to you - also <b>RandyG & TonyKlein</b> for thier most helpful inputs<p>
'Thread closed then !!<p><b>George</b>