[lAbArYnth]

Hi folks

Any help on this one will do !!!
I have this web page that will not go away on my Win 2k box.
When I change my home page and restart IE - no prob, Then close and reopen IE and hey presto, irritating web page will appear again. The page will then become the home page until changed again.

I have exhausted all options here ie. running software, putting the web site into restricted sites, cleaned out registry with anything pertaining to this site. cleared history, deleted all web content (temp int. files), reinstalled IE6, updated SP but all to no avail.
I am thinking there must be a string in the reg. that cannot be detected

Apart from a new Win2k install ( not a good option), I'm lost for ideas

Any help???? Thanx

 

[zelimir]

Download Adaware it's free install it and scan machine with it and let him clean all malware .Hope this help You.

 

[Zvalkor]

Zelimir's right. Adaware should solve your problem. You can get it at http://www.lavasoftusa.com . After you install Adaware, it is important to update it using the "check for updates" button.

 

[lAbArYnth]

Adaware not working here. nothing gets detected relating to the site.
Have tried a few other software packages with the same result.
Can't remember their names though
still cracking up with this prob!!!!

 

[enyalius]

Ok adaware only works on ad popups, and stuff like that. Has nothing to do with the problem that he is having.

The problem you are having sounds a lot like a virus (trojan or worm) you can try one of the online scanning websites see if they work but if not you may have to buy the virus software to get rid of the virus.

Friend had the same issue, with a very unwanted homepage (had some porn on it i believe if i remember correctly) it was a virus, he reinstalled windows but you should try a virus scan first

 

[the80sguy]

remove all run keys that you don't need

are you sure that you have gone into the registry and removed all run keys that you don't need? that includes HKEY_LOCAL_USER and HKEY_LOCAL_MACHINE. Sounds like a browser hijacker.

 

[lAbArYnth]

ye this is definitely a browser issue
Nothing in the reg. though, have gone through with a "fine toothcomb"
The page is a porn page enyalius, but virus scan with latest pattern file detects nothing
Looks like I may end up following your friend and doing a re-install
Not keen though.
If it is a trojan, it should have a string in the registry. Just gotta try and find it for future tech. notes

 

[V0lt]

Ok adaware only works on ad popups, and stuff like that. Has nothing to do with the problem that he is having.

The problem you are having sounds a lot like a virus (trojan or worm) you can try one of the online scanning websites see if they work but if not you may have to buy the virus software to get rid of the virus.

Friend had the same issue, with a very unwanted homepage (had some porn on it i believe if i remember correctly) it was a virus, he reinstalled windows but you should try a virus scan first

That is completely wrong- adaware scans the entire hard drive for adware and spyware: the exact thing that would change your homepage and keep it changed

 

[the80sguy]

does sound like a trojan or hijacker

have you tried downloading spybot and running that? http://www.safer-networking.org/
that gets rid of a lot of dialers, hijackers, and even some viruses too. sorry if you've already tried this too, just throwing out some ideas. it does sound like a trojan though.

when you look at the source code for the webpage is there anything helpful in there? also, is there a way you can post the address that is appearing in the browser so i can try and help ya out?

 

[the80sguy]

almost forgot...

also check and make sure there is not an explorer.exe file in the root directory. if there is, delete it.

 

[lAbArYnth]

ye Guy, tried spybot without any luck
Nothing in root to suggest that it is dircting my browser to that site.
their are a number of different web pages in the dropdown box of the home page which seem to be pointing to one specific site, being..... http://www.lolita.com.
As I mentioned before I have cleared "everything" but still cannot find anything relating to this page or the others in the home page dropdown box.
All the mentioned pages are also in the restricted sites list

I feel that what is happening, is that whenever I dialup to the net there is a "string" in the registry that somehow forces IE to connect to any of the web sites relating to lolita.com or which are on that domain and then will load one of those pages. Not always the same page gets loaded but always the same home page

Your thoughts???
Thanx for been patient!!!!!

 

[the80sguy]

hijackthis

have you downloaded Hijackthis yet? it's at http://www.softnews.ro/public/cat/10/17/10-17-69.shtml

it'll find some of those keys in the registry that you can delete or change that might have accidently been overlooked. also, you can post a list of all those entries on this board for us to view. i would definitely download it and run it to see what is going on. if you could post your results after you run it that would be awesome. i'm tryin!

 

[Drmwalkr]

Interesting that 'Spybot' didn't find anything. 'Spybot' does have a option to 'Lock' the defined homepage. If none of that works I'd suggest also searching the registry for the URL your referring to and see if anything comes up.

Hope this can help

 

[lAbArYnth]

Puzzling!!!!

As I said before, the web pages that I can see in the homepage dropdown box
1) Cannot be deleted in anyway at all
2) Are nowhere to be found in the registry at all
3) After clearing web page cache and removing records of documents, programs and web sites they still re-appear
4) Have tried spybot, ad-aware, hijackthis and others, yet none of these detect any of these web pages at all
5)Have re-installed IE with patches etc
6)These pages only re-appear once I have tried all these fixes and then dial-up to the net and open IE. Once IE opens the homepage changes back to http.www.lolita.com
I will post all results shortly as they ran with the different software.

later
Thanx again all
Have just received an e-mail from a person out there who has the same problem, says it's very irritating. Ye I sympathise

 

[jgvernonco]

I would suggest that you download Hijack This (link above), and post your log here. We can take take a look at it with you and see if there are any bad guys present.