Cannot set IE6 Home Page

Over a week ago I removed the Coulomb dialer from my PC. Since then I have also installed the IE7 Beta 2 and since removed it. I downloaded IE6 again. The homepage was being set to some chinese (encoded?) URL which could not be removed. My machine runs Norton which didn't prevent this. I tried every scanner I could think of to no avail. In MSN browser, I couldn't click on or organize my favorites or setting links. I couldn't get Calendar to come up. MS support helped me download a new minimal version of MSN; I can get Calendar but all the other sympotms are the same.. almost; I no longer see the old URL I was being re-directed to (it never actually connected to this site) but I still cannot set my home page.

I followed the steps you set out and am attaching the 3 logs you specify. I hope someone can point me in the right direction...

 

Welcome to MajorGeeks.com!

Please see the below thread on how to install and run Ewido Anti-Malware.

• Running Ewido Anti-Malware...

 

Hi BJ,

I ran the ewido scan and it came up clean. I ran the hijackthis again and am attaching the log. Some other symtoms are: when writing an email in IE I cannot add an attachment. I still cannot set my home page...

Any help would be welcome at this stage...

IrishChieftain

 

It appears that log is from Safe Mode, if so please attach a fresh one from normal mode.

 

Here's the normal mode log....

 

Please look in Add/Remove Programs for the following and uninstall them if found:

Ewido

Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:[/FONT][/B]

arservice.exe

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavili on&pf=desktop&parm1=seconduser

Again, make sure ALL browser windows are closed when you click FIX.

Now, Please boot into Safe Mode, be sure you have the Viewing of Hidden Files & Folders Enabled per the tutorial. Now, navigate to and DELETE the following if they should remain:

C:\WINDOWS\arservice.exe

Next, run CCleaner to clean up cookies and temp files.


Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.

Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

• Disable and Re-enable System Restore
  
  
• Turn OFF System Restore to flush any bad Restore Points.
  
  
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

After you complete the above reboot once more and then scan with HijackThis and attach the new log.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Hi,

Thanks for your time on this! I've completed all the steps you described. Spybot found and fixed the following:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0

Still can't add an email attachment when using MSN or IE browsers. Still can;t set my home page in Internet Explorer. Worst of all, my machine is absolutely crawling on startup. The first two times I started up after running these scans, the machine froze. Any clues in the log? (attached).

Thanks guys.

 

Click Start > Run > type services.msc and Click OK

Locate ARSVC and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

After you complete the above, please see the below thread on running WinPFind and how to attach a log.

• Running WinPfind by OldTimer

 

I disabled that service and ran the tool. Here's the log. I hope this helps!

 

Your logs look ok!

Can you manually set your homepage? If not, what does it do? Is it greyed out?

 

Hi,

WHen I open IE it goes to the following URL:

http://hp.netscape.com/hp1.adp

When I go to Internet options I see the following where I would set my new home page:

http://ie.redirect.hp.com/svs/rdr?T...=Q405&bd=pavilion&pf=desktop&parm1=seconduser

When I set a new home page it keeps going back to this!

Another problem I'm experiencing is that when I try to add an email attachment I get a JavaScript pop-up message box saying "Invalid file specified(actually is a space here before the period) . Please try again." Whatever malware originally caused this is gone; I think what I'm dealing with now is the after-effects!!

 

It's possible that Windows Defender is protecting your homepage.

Try the below..

Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file iefix.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.)

Double-click on the iefix.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to merge, click YES!

 

No luck. I ran the script and rebooted but still the same browser behavior. I'm real curious to know how the registry is being set to do this....

 

Try this...

Reset Web Settings & Default Security Settings:

To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.