IE start page tutorial needed

[gwlogue]

I'm working on a WinXP Pro system trying to figure out why it's having problems with IE. Select the IE icon from the desktop or system tray and it fails trying to get to www.msn.ca. I tried changing the default start page using IE's Internet Tools but it is ignored. When I use Control Panel's Internet Option it resets as asked. If I manually type http://www.msn.ca into IE's address area it redirects to sympatico.msn.ca and works fine.

I ran AdAware and CWShredder and took an HJT log but it makes no difference and the log looks VERY clean.

I figure I'm unclear about how setting the default start page works when using IE vs Control Panel.


I'm sure the problem lies with me but I need some help understanding this.

[Sterling_Aug]

Do you have AdAwares Adwatch running? You may have a home page reset option set.

[Hola hoop]

firstly does IE actually work?

You just having problems setting the start page?

Barring any IDS as Sterling_Aug suggested (intrustion detection system - which doesnt allow changes to things like the registry without express permission), you need to change the page in the registry, and there are actually 3 diff registry strings that can effect your hompage settings.


But u need to check to make sure software u ahve is not stopping this otherwise registry tweaks will not help

[gwlogue]

IE works fine. It just this www.msn.ca page that is failing.

I ran AdAware and cleaned the 6 pests it found and I have run and posted an HJT log at the Castlecops website. It looks clean to me but I thought I should have an expert check it just in case I've missed something.

What is confusing me is the fact that changing the home page using the Control Panel interface works. Although the interface from with IE looks identical it gets ignored.

I'm trying to understand why the one method works but the other does not.

[Hola hoop]

as far as i know the reason is as i mentioned before.

In your registry navigate to these strings and see what the "www....." is.

BE AWARE....dont mess with the registry without backing it up first...File/Export
If your unsure then do not mess with the registry

If u wanna PM me your highjack log i should be able to tell from there also:

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page

HKLM\Software\Microsoft\Internet Explorer\Search

HKCU\Software\Microsoft\Internet Explorer\SearchURL

the highjack log will aslo tell me if u have had a previous highjack attempt which would affect your homepage.

In the registry, those above strings will also have values 1 or 0 whihc indicates show and hide or write and read only. If IE is set to say 0 meaning read only, then any change you make will not stay effective for very long

ps u still didnt mention what AV, spyware, firewall packages u are using...this could be part of the problem to

gl

[gwlogue]

Although I have made changes to the registry when needed in the past I really prefer to keep my fingers out of there if at all possible.

There is an expired version of NAV on it but nothing else along those lines. I'll try to PM the log to you.

Thanks

[gwlogue]

I tried to PM the log to you but was told it was too long. I'll post it here instead.

Logfile of HijackThis v1.99.1
Scan saved at 8:24:01 PM, on 8/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\$compwell\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.ca/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Zero Popup - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - C:\PROGRA~1\ZEROPO~1\ZERO-P~1.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Hola hoop]

hi gwlogue

ok

norton may be causing part of these problems actuall

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

Script blocking is a semi IDS and basically it dont allow changes to the registry

O2 - BHO: Zero Popup - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - C:\PROGRA~1\ZEROPO~1\ZERO-P~1.DLL


this BHO (Broswer helper objects) looks a lil strange. Maybe goto program files try and find folder and see what it is. U dont need bho but they can be useful like Adobes BHO so u can hyperlink to a PDF file in the same browser.

Nothing seems offhand here and u have not been highjacked either. The only suggestion i can make to u is to stop the Nortons script blocking service and set its provacy functions off or low (cookie and pop up blocker, script blocking event manager ect ect.) and then try. u can always reenable.

Apart from that, if all those 3 strings i posted before have the same homepages on them, then i guess maybe small thing u goto live with hehe.

Hope this has been of some help to you

GL

[gwlogue]

I think I've found something that might be related.

If I start IE by double-clicking it starts at the home page set in my internet options.

If I start by right-clicking and selecting OPEN HOME PAGE it also starts at the desired page.

But if I right-click and select OPEN it starts at an MSN page I want nothing to do with.

Not sure what the difference is between OPEN and OPEN HOME PAGE.

[omendata]

Run this

http://www.softpedia.com/get/Interne...Shredder.shtml