internet homepage keeps reseting

[mark146914]

i've ran adware and it still resets. martoch you around??

[Gettinbye]

I believe Group Policy Editor is only available in XP Pro.
Seeing as you have Millenium, you might try using System Restore to a point prior to this browser hijack.
At that point, it would be prudent to upgrade to/update IE6 (if you haven't already).
To (hopefully) keep this from happening again, go to IE>Tools>Internet Options>Security>Custom Level, and next to "ActiveX controls and plug-ins", "Download signed ActiveX controls", and "Download unsigned ActiveX controls", select "prompt" :and under "initialize and script activeX controls not marked as safe" choose "disable".. This way, next time something wants to be installed via activeX (as many browser hijackers are), it will give you a dialogue box asking whether or not to do so.
Please post back as you progress...

[demon_wolf]

I had the same problem and was running Win ME.

The Group Policy Editor is only available in Win XP Pro.

Heres what I did to fix the problem, has worked now for a Month with no problems:

1. Make sure you have the lastest updates to IE. (From Microsoft Updates)

2. Run AdAware and Spybot.....(This will not fix the problem, but it is always a good idea to run these.....just in case)

The problem is in your registry.....you can edit your registry manually or use this option:

3. Make sure your homepage is the correct one you want, then use WinGuides Registry Mechanic, to fix and delete all incorrect registry entries.

In my case....I had run both AdAware and Spybot, and updated IE. Still had the problem. Ran Reg Mechanic and found 55 errors in the registry.

Well, its been a Month and not a single problem.

Hope this helps, if you need any help feel free to pm me.

[mark146914]

demon wolf...i've just ran registy mechaninc but you have to buy it in order to fix the repairs.....

[mark146914]

i'd do it manually but i have no idea what to look for.

[mark146914]

oh and by the way it found 30 errors in my registy but i don't really want to buy the program just to fix them.

[mark146914]

just ran a hijack detector and i need to know what to delete...

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.IowaTelecom.net
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE
O4 - HKLM\..\Run: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [sys] regedit -s sys.reg
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Popup Ad Filter] C:\Program Files\Meaya\Popup Ad Filter\PopFilter.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE 1
O4 - Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .MID: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...973.7402662037
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minib...ansporter.cab?
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://anu.popcap.com/games/popcaploader_v5.cab

[demon_wolf]

YGPM

[AzKidd69]

I think I see hwere hte problem is.. give me a few minutes to make sure....

yeppers I am pretty sure I found it

Quote:

from hijackthis log
O4 - HKLM\..\Run: [sys] regedit -s sys.reg

at boot up the computer is importing a backup copy of the registry and that should be what is causing your issues... try disabling this entry and let us know what happens

BTW msconfig is your friend.. learn it and love it

[kissyone]

I really dont know how this site works.... is this a reply to the posts above this or can I post a notice of my own? I would like to do that but not sure this is the correct way.... can anyone help please?