Probs with home-page re-setting

[socenwash]

I'm having a bit of difficulty. Every time I re-start my PC, by home-page in IE resets to some bogus site. I try and change it (Internet->Options->Homepage), which works UNTIL I restart my PC, then it changes to something else. Any ideas??

[degsy]

Hi,
Do a virus scan.
Check in Start>Programs>Startup
for any rogue files/programs.
Also check Start>Run>MSCONFIG
Startup tab.

check for .hta files

Here is a response from another site about a similar question.

Close Internet Explorer and Outlook Express.

Copy the bold to Notepad. Save as Homepage. reg, and doubleclick it.
Answer 'yes' to have it imported into the registry.

REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\In ternet Explorer\Control Panel]
"Homepage"=dword:00000000

This should unlock your Home page.

Now go to Control Panel/Internet Options, and clear your temporary Internet files.
Click Settings/show files, and delete your cookies.
Or, if you're running IE 6.0, click 'delete cookies.
Empty your Recycle Bin, and delete everyting in your C:\Windows\Temp folder.

Now go to Control Panel/Internet (options)
Go to the 'Programs' tab, and click 'reset Web Settings'.
Go to the 'Security' tab, and set all ActiveX options that are now set to 'allow', to 'prompt'.
Also uncheck 'Enable install on demand' on the 'advanced' tab.

Now open Internet Explorer, and go to your favorite Start Page.
Go to Internet Options, General tab, and click 'Use current'.

That should do it.
It's important, however to make suree there's nothing in startup that could revert this situation:

Go to Start/run, and type Msconfig. On the Startup tab, look to see if you can find one or more of the following entries:
SWPortal, SWCaller, Sp.dll, winn32.html, runme.hta, reg.hta, adshow.exe , OPQfile, and/or MSKernel32 (Win32.hta).
If you should find one or more of these, uncheck them.
Also anything that has 'regedit.exe/s' in its path.

Now click OK, close Msconfig, and reboot.

Also have your computer scanned on line at Trend Micro HouseCall.
THere are malicious scripts like JS.Exception.Exploit which can do that as well.

Bold text was

REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\In ternet Explorer\Control Panel]
"Homepage"=dword:00000000


[ 03 February 2002: Message edited by: degsy ]