1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Need help removing a 'default' home page from 'IE'

Discussion in 'Archive: Windows 95/98/Me' started by georgeblack18, Nov 29, 2001.

Thread Status:
Not open for further replies.
Advertisement
  1. georgeblack18

    georgeblack18 Thread Starter

    Joined:
    Nov 29, 2001
    Messages:
    39
    Hi,

    Been doing some 'surfin' and somehow picked up a 'default' home page address of a questionable (but very legal !) address.<p>
    I can of course right click to change the properties of the 'IE' icon back to default before going on line but would really like to edit this out from 'regedit'.<p>
    Problem does not 'come back' during the time 'puter' is used only on start-up.<p>
    Many Thanks for any assistance.<p>
    georgeblack18
     
  2. RandyG

    RandyG

    Joined:
    Jun 26, 2000
    Messages:
    7,760
    Welcome to TSG!

    First thing to ask is if you have already tried to go to Tools, Internet Options, and changed the Home page there? If you have attempted this, and the offending address is persistent in adding itself back in, then try the regedit below.

    If you are familiar with regedit, then the easiest thing to do would be to Ctrl + F, and search for the offending address. Replace all instances you find with a more agreeable home address.


    If you have IE5.5 and Win98SE, you should find it at HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main and then double click the Start Page in the right window to change the address to something else.

    and at HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main and then double click the Start Page in the right window to change the address to something else.


    Let us know if this sorts it for you!
     
  3. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Welcome to TSG, George.

    We're having problems sorting this issue out, but it seems to be happening a lot lately. What evidently has happened is that some site installed a file which is changing the registry back every boot up.

    Go to start and run msconfig

    Click on the "startup" tab. Do you see anything there with an .hta extension? (this would probably be a shortcut in your Programs\Startups folder). Or sp.dll ?

    There is a Reg hack on this thread that you can try. Let us know how it goes.


    http://forums.techguy.org/showthread.php?s=&threadid=59071&highlight=home+page
     
  4. RandyG

    RandyG

    Joined:
    Jun 26, 2000
    Messages:
    7,760
    Now that's timing.


    Thanx Rog, for the additional input. I hadn't known about the links you posted.
     
  5. georgeblack18

    georgeblack18 Thread Starter

    Joined:
    Nov 29, 2001
    Messages:
    39
    Hi Guys,

    Many thanks for your welcomes' and replies - a little late here in the U.K. now but will attempt the suggestions in the a.m. and report back !<p>All the best<p><b>George</b>
     
  6. georgeblack18

    georgeblack18 Thread Starter

    Joined:
    Nov 29, 2001
    Messages:
    39
    Hi <b>RandyG</b><p>
    Yes have tried to change Tools>Internet Options but page still persists !<p>
    Regedit shows 'no find' on the url - also HKEY_CURRENT_USER\Software\Microsoft\
    Internet Explorer\Main & HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main only show the correct adresses for default & local page (blank) ?<p>
    <b>Rollin' Rog</b><p>msconfig - startup tab show no .hta or sp.dll ?<p>Any other suggestions gratefully received !<p>
    Many Thanks<p>
    <b>George</b>
     
  7. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    That's very puzzling. I can't explain how you could have a start page without it being listed in the registry. Was it actually open when you did the search? Sometimes the regedit find tool is a bit tricky to use. It doesn't work right if you have already manually navigated to keys. And it is better to use a key portion of what you are looking for, rather than the whole entry. I always do a Find immediately after opening the Editor.

    Anyway, I would try this. Install noscript.exe from symantec. This is a very convenient, one click tool for disabling or enabing the Windows Scripting Host, a very exploitable tool used by worms and sleazy operators to make bad things happen on your pc. It is not at all required for normal Windows functions:

    http://www.sarc.com/avcenter/venc/data/win.script.hosting.html

    If this continues to be a problem, it might help us to have a look at the StartupLog.txt, which you can create and copy/paste here after running Startuplog.com from the site below. We don't need the stubbpaths.txt.

    http://home.earthlink.net/~rmbox/Reticulated/Toys.html
     
  8. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    Hi,

    You might have a 'Homepage' registry restriction in place, that prevents you from changing your home page in the first place.

    Here's a complete list of tips to follow:

    Go to Start/run, and type Regedit.
    Navigate to HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Control Panel
    Is the subkey called 'Control Panel' indeed there, rightclick it, and choose delete from the context menu.
    Close Regedit

    Now close Internet Explorer and Outlook Express.
    Go to Control Panel/Internet Options, and clear your temporary Internet files.
    Now click on Settings/show files, and delete your cookies.

    Go to the 'Programs' tab, and click 'reset Web Settings'.
    Go to the 'Security' tab, and set all ActiveX options that are now set to 'allow', to 'prompt'.
    Also uncheck 'Enable install on demand' on the 'advanced' tab.

    Now open Internet Explorer, and go to your favorite Start Page.
    Go to Internet Options, General tab, and click 'Use current'.

    After changing your home page to the one you prefer, immediately apply the reg hack, in order to lock your home page. This is an easy way:

    Past the bold into Notepad. Save as Homepage, reg, and doubleclick it.
    Answer 'yes' to have it imported into the registry.

    REGEDIT4

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Control Panel]
    "Homepage"=dword:00000001


    And do follow up on Rog's advice as well.

    Good luck,
     
  9. georgeblack18

    georgeblack18 Thread Starter

    Joined:
    Nov 29, 2001
    Messages:
    39
    <b>Hi Rollin' Rog & Tony</b><p>
    Thank you very much for your further help/guidance (what a site this is !!)<p>I am 'reasonably' computer literate - or I thought I was until (to me !) I see 'regedit' & 'msconfig' suggested ! - anyway I shall follow both of your 'posts' and report back !<p>
    Many thanks again for your kind attentions to my problem.<p>
    <b>George</b>
     
  10. georgeblack18

    georgeblack18 Thread Starter

    Joined:
    Nov 29, 2001
    Messages:
    39
    Hi again,<p>

    I have tried to navigate to HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Control Panel but no file listed (running 'ME' - just realised I had not mentioned sorry !).<p>
    Ran the 'Startup' program - resulted :-<p>
    The following is a list of your current Start-Ups
    __________________________________________________________________________
    __________________________________________________________________________

    1. HKLM Run - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NAV DefAlert"="C:\\PROGRA~1\\NORTON~1\\DEFALERT.EXE"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    "NoChange"="1"
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    "Installed"="1"


    ==========================================================================
    __________________________________________________________________________

    2. HKCU Run - Registry

    [RegPath]
    "StartUp"


    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "OPQFile"="C:\\WINDOWS\\regedit.exe /s C:\\WINDOWS\\SYSTEM\\rad3BBBD.tmp"


    ==========================================================================
    __________________________________________________________________________

    3. HKLM RunOnce - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]


    ==========================================================================
    __________________________________________________________________________

    4. HKCU RunOnce - Registry

    [RegPath]
    "StartUp"


    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]


    ==========================================================================
    __________________________________________________________________________

    5. HKLM RunServices - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]


    ==========================================================================
    __________________________________________________________________________

    6. HKLM RunServicesOnce - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]


    ==========================================================================
    __________________________________________________________________________

    7. WIN.INI File - (c:\windows\win.ini)

    Your win.ini run/load lines should look like run= and load= exclusively.
    There should be nothing to the right of the equal signs.


    These are the run and load lines in your WIN.INI file

    run=

    load=

    ==========================================================================
    __________________________________________________________________________

    8. SYSTEM.INI File - (c:\windows\system.ini)

    Your system.ini shell line should look like shell=Explorer.exe exclusively.
    You should only see Explorer.exe following the equal sign.


    This is the shell line in your SYSTEM.INI file

    shell=Explorer.exe

    ==========================================================================
    __________________________________________________________________________

    9. AUTOEXEC.BAT File - (c:\autoexec.bat)

    (Some trojans have been known to start from this file)


    These are your program startups and set paths in your autoexec.bat file


    ==========================================================================
    __________________________________________________________________________

    10. StartUp Folder - (c:\windows\start menu\programs\startup)

    Shortcuts to any program will automatically start when placed here.


    These are the shortcuts located in your StartUp folder

    *(No start-ups found)*

    ==========================================================================
    __________________________________________________________________________

    11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

    Shortcuts to any program will automatically start when placed here.


    These are the shortcuts located in your All Users StartUp folder


    *(No start-ups found)*

    ==========================================================================
    __________________________________________________________________________

    12. Miscellaneous StartUp Configurations

    -============================-
    Registry StartUp Directories
    -============================-

    Should show the Start Menu StartUp and All Users StartUp directories

    .....................................................................

    [1] HKCU - Shell Folders

    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

    "Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

    .....................................................................

    [2] HKCU - User Shell Folders

    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders


    .....................................................................

    [3] HKLM - Shell Folders

    HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

    "Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

    .....................................................................

    [4] HKLM - User Shell Folders

    HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders


    .....................................................................

    -=======================-
    Registry Shell Spawning
    -=======================-

    Open Commands for Executable File Types

    @="\"%1\" %*"
    (.exe file - RegPath = HKCR\exefile\shell\open\command)

    @="\"%1\" %*"
    (.com file - RegPath = HKCR\comfile\shell\open\command)

    @="\"%1\" /S"
    (.scr file - RegPath = HKCR\scrfile\shell\open\command)

    @="\"%1\" %*"
    (.bat file - RegPath = HKCR\batfile\shell\open\command)

    @="\"%1\" %*"
    (.pif file - RegPath = HKCR\piffile\shell\open\command)

    @="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
    (.hta file - RegPath = HKCR\htafile\shell\open\command)

    -=========================-
    HKLM RunOnceEx - Registry
    -=========================-


    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]


    -====================-
    StubPaths - Registry (Partial Listing)
    -====================-

    (Please see the StubPath.txt on your desktop for complete listing)

    HKLM\Software\Microsoft\Active Setup\Installed Components


    "StubPath"="C:\\WINDOWS\\SYSTEM\\ie4uinit.exe"
    "StubPath"="C:\\WINDOWS\\msnmgsr1.exe"
    "StubPath"="C:\\WINDOWS\\COMMAND\\sulfnbk.exe /L"
    "StubPath"=""
    "StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:WIN9X /user /install"
    "StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:WIN9X /user /install"
    "StubPath"="C:\\WINDOWS\\SYSTEM\\updcrl.exe -e -u C:\\WINDOWS\\SYSTEM\\verisignpub1.crl"

    -=================-
    WINSTART.BAT File - (c:\windows\winstart.bat)
    -=================-

    @C:\WINDOWS\tmpcpyis.bat

    -=================-
    DOSSTART.BAT File - (c:\windows\dosstart.bat)

    - Supplemental Environment Information -

    COMSPEC=C:\WINDOWS\COMMAND.COM
    PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
    TEMP=C:\WINDOWS\TEMP
    TMP=C:\WINDOWS\TEMP
    winbootdir=C:\WINDOWS
    windir=C:\WINDOWS

    File - c:\windows\deletefi.ini

    As before grateful if anything appears 'useful' in the above and will check in tomorrow for any further info'.<p>
    Again my Thanks<p>
    George
     
  11. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    OPQFile"="C:\\WINDOWS\\regedit.exe /s C:\\WINDOWS\\SYSTEM\\rad3BBBD.tmp"


    Very suspicious! this is running a registry patch from something with a .tmp extension in your c:\windows\system folder.

    I don't know what it is, but I doubt it's legit.

    Go to start, run: msconfig and deselect it from the startup group.

    Retest

    To remove it permanently from the Registry, run regedit and navigate to:

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr
    entVersion\Run]

    With RUN (or RUN- if it has been unchecked in msconfig) folder highlighted, right click and delete it

    Close the Registry editor, reboot and find and delete

    rad3BBBD.tmp

    from c:\windows\system


    Edit

    Bingo!

    http://groups.google.com/groups?q=OPQFile&hl=en&btnG=Google+Search
     
  12. georgeblack18

    georgeblack18 Thread Starter

    Joined:
    Nov 29, 2001
    Messages:
    39
    Hi Rog,

    Many thanks for the info' - will do exactly that and report back !

    George
     
  13. georgeblack18

    georgeblack18 Thread Starter

    Joined:
    Nov 29, 2001
    Messages:
    39
    <b>Hi Rog</b><p>
    Worked a treat ! - many thanks to you - also <b>RandyG & TonyKlein</b> for thier most helpful inputs<p>
    'Thread closed then !!<p><b>George</b>
     
  14. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/60065