Take back control of IE

ANALYSIS

Before we begin
Warning: The following section involves editing your system registry. Using the Windows Registry Editor incorrectly can cause serious problems requiring the reinstallation of your operating system and may lead to the loss of data. TechRepublic does not and will not support problems that arise from editing your registry. Use the Registry Editor and the following directions at your own risk.

Clean the registry
When a program hijacks IE by modifying the registry on a Windows NT/2000/XP system, the change often impacts only the current user. This is because many users don't have local administrative privileges and can only modify the HKEY_CURRENT_USER portion of the registry, not the HKEY_LOCAL_MACHINE portion. If the user has local administrative privileges or the machine is running Windows 9x/Me (which won't protect the registry), the change could be applied to all of the users on the system, depending on hijacker's level of sophistication.

With this in mind, log on as the person who's having the problem and open the Registry Editor. Then, navigate through the registry tree to:
HKEY_CURRENT_USER\Software\Policies\Microsoft\ Internet Explorer\Control Panel

Check for the existence of keys named ResetWebSettings or HomePage. If such keys exist, delete them.

Next, navigate to:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

Verify that the information stored in the Default_Page_URL key and Start Page key is correct. If these keys contain values that reflect an undesirable startup page, double-click on the key to open its dialog box and then replace the existing value with an appropriate one.

There are two more registry entries you should check, but you'll need to ensure you have the proper permissions before doing so. As I mentioned before, if you're using Windows 9x/Me, any user can modify the registry, but if you're using Windows NT/2000/XP you'll need local administrative privileges.

Navigate to the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main

As before, check the Default_Page_URL and the Start Page keys for inappropriate values and change the values if necessary. Next, navigate to:
HKEY_USERS\Default\Software\Microsoft\Internet Explorer\Main

Once again, check the Default_Page_URL and the Start Page keys for inappropriate values, and change them as necessary.

Talkback

For heavens sake, why don't you just install Firefox? Its a better browser and it is not one tenth as vulnerable to hacks.

Microsoft fanatics bewilder me. They will stick with that corporation's software, no matter how bad it gets and no matter how much better the alternatives are.

2 Nov 04 00:46 Reply

Proof that Windows really IS easy to use! And has a low TCO as well. Splendid. I would recommend this article even to a novice user.

3 Nov 04 08:44 Reply

HijackThis and SpySweeper not mentioned!

ZDNet publishes an article about Browser Hijacking and omits mentoining HijackThis? Please visit :
http://www.google.com/search?q=hijackthis (search the web for "HijackThis")
http://www.hijackthis.de/index.php?langselect=english (program's page)
http://www.spywareinfo.com/~merijn/index.html (author's page)

ZDNet also omitted SpySweeper. Beware, there seems to have 2 competitors under that same "SpySweeper" name:
http://www.spysweeper.com/
http://www.webroot.com/products/spysweeper/

Paris, Thu 4 Nov 2004 15:17:10 +0100

4 Nov 04 14:17 Reply

No need to visit porn to get infected. ZDNet is misleading when making people think they are at no risk as long as they don't visit porn sites.

Whatever you visit (or don't), the spammers (and other malevolent people) will always get you anyway if you are in their target list - and they won't if you are not, whatever and how much you can visit porn or financial sites or anything else.

So, be warned: spam (as well as financial thefts and any other malevolent actions) don't depend on your behavior on the net - they actually depend on your race or political orientation. And those actions will always be hidden behind benign pretexts (as visiting porn sites, or eBay, or else, or even without any pretext if they don't find one).

I know repeating this is utterly dangerous - and will be denigrated first. But if taking no risk, we are buying short term limited relief at the expense of sure troubles for everyone some time later.

Paris, Thu 4 Nov 2004 15:51:50 +0100

4 Nov 04 14:51 Reply

Excellent piece of information.. Interestingly enough, my Father in Law had the very same problem - being hijacked by a pornographic site - what is it with Fathers in Law?! This article has helped me clean his system up once and for all ..Many thanx.

8 Nov 04 19:56 Reply

Hijack This is mentioned, in detail and with screenshots, from page 3 of this article onwards...

If you read articles before flaming them, you might actually be listened to rather than have scorn poured upon you.

9 Nov 04 11:37 Reply

The article also doesn't mention Zerospyware which is one of the top rated anti spyware applications on the market.
http://www.fbmsoftware.com/

12 Nov 04 20:45 Reply

i am currently using PANDA's version of anti virus program..it seems to do the job better then norton/mcaafee. but i have a question about using mozzilla/firefox..i hear they're gr8 programs...but i presently use IE and OE for my browser/email..if i download mozzilla/firefox....how do i prevent having to go back and delete emails in the OE programm?

15 Jan 05 19:10 Reply