[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 722
  • Last Modified:

IE won't allow me to change the default home page

Dear Expert,

I just bought a new laptop with an XP Home config.

The machine comes with a pre load of HP Games. In IE the following URL opens up by default http://hpen.oberon-media.com/

I changed the setting several times to open up a blank browser but it doesnt accept it. It goes back to opening up the HP browser each time. What can I do to correct it.

The process is listed below for your reference.

1. I open IE from my desktop
2. It automatically has a redirect code that is  http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_IN&c=Q106&bd=presario&pf=laptop
3. The site it opens up is http://hpen.oberon-media.com/
4. Now I go to Tools  ---> Internet Options ---> General --> Home Page  and select the USE BLANK option so that the above site does not open up by default.
5. I save the settings.
6. I open IE again. The browser redirects one more time and opens the http://hpen.oberon-media.com/ site again inspite of changing the settings.
7. The URL in the Address area under Tools  ---> Internet Options ---> General --> Home Page  is http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_IN&c=Q106&bd=presario&pf=laptop
8. I tried changing the default site to Yahoo or Google or any other...but it does not work. Seems like IE has been encoded with the redirect code on the laptop


Please help.

Thanks in advance

AuroRA Sky
0
AuroRA_Sky
Asked:
AuroRA_Sky
  • 16
  • 11
  • 11
  • +1
1 Solution
 
Irwin SantosComputer Integration SpecialistCommented:
One of the things to do..is locate your HP Help Centre software, then go to the options and check to see if the default URL is stuck in there.

If you can do without the HP stuff, then go to MSCONFIG, START-RUN-type MSCONFIG <enter> then located any programs you recognize that you can turn off. Note your changes as you may need to re-enter them.  Restart your machine

0
 
AuroRA_SkyAuthor Commented:
This URL has been registered in teh DEFAULT URL in the registry! I tried deleting it but it still wont work

HKLM/Software/Microsoft/InternetExplorer/Main/Default_Page_URL

I changed it to another but it still wont work
0
 
Irwin SantosComputer Integration SpecialistCommented:
did you apply my comment?
0
Take Control of Web Hosting For Your Clients

As a web developer or IT admin, successfully managing multiple client accounts can be challenging. In this webinar we will look at the tools provided by Media Temple and Plesk to make managing your clients’ hosting easier.

 
AuroRA_SkyAuthor Commented:
none work
0
 
Irwin SantosComputer Integration SpecialistCommented:
let's explore malware
-----------------------
Download and Install.
http://www.majorgeeks.com/HijackThis_d3155.html

Copy and paste your log to:
http://www.hijackthis.de/index.php?langselect=english
Click ANALYZE

Look for NASTIES and post your Analyze log link here
-------------------
Download Ewido, http://www.ewido.net/en/download/, install, open program, check for updates, restart computer, press F8 before windows logo appears, select safe mode, open Ewido, run full system scan. let Ewido delete all it finds, if anything is called serious by Ewido, disable Norton's Goback, and run Ewido again.
0
 
ClickCentricCommented:
Download firefox and forget about IE?  These days, this is a common solution to problems like that.  
0
 
ClickCentricCommented:
http://www.getfirefox.com in case you're interested.
0
 
AuroRA_SkyAuthor Commented:
is firefox better than Opera?
0
 
ClickCentricCommented:
That's mostly a subjective issue.  I like it better because it tends to render well and Opera sometimes jumps back and forth in their standards support.  And I think firefox has more extension options available.  But whether one is 'better' than another is really hard to say.  Firefox is just my personal preference.
0
 
ClickCentricCommented:
Netscape is another option (http://www.netscape.com).  It can render pages as either IE or firefox.  Can come in handy for those pages where the author isn't quite good enough to make it cross-browser compatible.  But, it's bulky.  Can be a bit sluggish.
0
 
AuroRA_SkyAuthor Commented:
hmmmm thanks....i've used opera but i guess with IE it's more of a comfort factor. i agree that there are better browsers than IE and ideally i should use those. But I would still like to fix this issue....
0
 
AuroRA_SkyAuthor Commented:
FOR IRWINPKS

HIJACK THIS LOG REPORT......NOTICE the link on R0 HKCU....it has the redirect link. I tried changing that but it doesnt work






Logfile of HijackThis v1.99.1
Scan saved at 10:52:52 AM, on 5/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Plaxo\2.9.0.38\PlaxoHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Amisha\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_IN&c=Q106&bd=presario&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.aurora-hospitality.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://toolbar.google.com/done
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zSPGuard] c:\program files\pjw\spguard\spguard.exe /s /r
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.9.0.38\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Bluetooth.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_IN&c=Q106&bd=presario&pf=laptop
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/latest/PlaxoInstall.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/bejeweled2/popcaploader_v6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E365A229-DD23-4295-A49F-BBAA4B6DCD3F}: NameServer = 192.168.0.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

0
 
ClickCentricCommented:
O4 - HKLM\..\Run: [zSPGuard] c:\program files\pjw\spguard\spguard.exe /s /r

That's the offender.  StartPage guard. http://pjwalczak.com/spguard/index.php  It's what's preventing you from changing your start page.  Disable it and you should be good to change it.
0
 
ClickCentricCommented:
Check in add/remove programs for it...should be able to delete it that way.  If not, disable it with hijack this.
0
 
AuroRA_SkyAuthor Commented:
ok i just tried SP guard last night to try and change the URL from the HP games one to none or any other...

this default URL  problem has been around since the time i bought the laptop ....meaning it has been pre programmed.
0
 
ClickCentricCommented:
Hmm..I don't see anything else likely to cause it.  Have you tried just setting it to a blank page rather than an alternate page?
0
 
ClickCentricCommented:
Oh, and you'll still need to disable SPGuard before it will be able to be changed now.
0
 
AuroRA_SkyAuthor Commented:
yes...done all of that! wonder if i should post the query into the HARDWARE section...since this thing has been preconfigured
0
 
ClickCentricCommented:
No, you're in the right section, but what you have is something beneath the surface.  I don't see any references to it being a common thing on HP laptops.  HP Games is controlled by wildtangent, but I don't see it in your hijack this log.  Check in add/remove programs for WildTangent.  Or something with a similar name.
0
 
AuroRA_SkyAuthor Commented:
dont see wildtangent but see a LOT of games installed indepedently....i dont really need those...ok to uninstall them?
0
 
Irwin SantosComputer Integration SpecialistCommented:
There are more items to fix in your hijack log... did you fix the "nasties" yet?
also, did you run Ewido?
0
 
AuroRA_SkyAuthor Commented:
what is nasties? also what are the other items to be fixed? what is Ewido?
0
 
Irwin SantosComputer Integration SpecialistCommented:
The nasties are the items that are in your hijack log...In my previous comment above, there were instructions on how to display the contents (look way at the top of this thread where I gave you the entire recipe to fix this problem)

Since I've run th analyze for you, here is the link
http://www.hijackthis.de/logfiles/f0aa52b04ea6e7c8cd0aca0d67e7a42d.html

Ewido is a malware fixer....Please RE-READ my 3rd comment and execute what you have not done yet.
0
 
ClickCentricCommented:
If you don't want the games, it is ok to uninstall them.  There are a few other questionable entries in your log, but nothing that should cause that problem.  The one that most likely would, SearchAssistant, is blank, so that shouldn't be the problem.  The only other one that traces back to something that could cause it, from what I see, is:

O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe

I can't find any references to this causing it, but it is a settings manager, so it likely has the potential to.
0
 
Marc ZCommented:
My first thought is actually Norton's.  Doesn't the Internet Suite have the ability to block the change or Lock the Home Page of IE?

They have very poor service on their website for support, but go into it's settings and see if you can find a Shield or read through their help files for Home Page Hijacking and see what it tells you about disabling it.
0
 
ClickCentricCommented:
I thought about that, but I asked someone who has it (I don't, myself) and they said that it would prevent sites from changing it, but you can still change it in the settings window.  Of course, the source isn't particularly good with technical matters, but he said he tried and it worked, so it seemed hard for him to be wrong (though with him, you never know....ever know one of those people for whom they can hit the k key on the keyboard and the t will show up because they're just so bad with technology that it defies the laws of everything?)
0
 
Marc ZCommented:
I don't know anyone that has  it that I support, so I can't even ask them for help on finding that particular setting.  I'm sure (yeah, right)  that the Help Files from the program can help find it although the pdf file I got from Symantec was just a simple install Manual, it didn't go into any of the specifics of the actual program.  What kind of company is that?  How do you get support for it?  They closed their public forums a while ago, I guess they just want one on one service for their customers.

A possibility is that AuroRA_Sky has the settings on the Norton's so high that he/she doesn't get warnings from it when it blocks something.  Might want to also search the help files for Alerts - Viewing, something like that.

Did you tell Hijack this to Fix these?
         R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.aurora-hospitality.com                         This entry should be fixed by HijackThis!
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =               

For what it's worth, I also endorse Firefox.
0
 
Marc ZCommented:
By any chance, is this Norton's Internet Security the Trial version from the laptop maker and has it expired?  You are aware it is only a trial, correct?  
0
 
Marc ZCommented:
If this were my machine or if I were supporting it, I would follow these steps http://service1.symantec.com/SUPPORT/sharedtech.nsf/docid/2006031710323113?Open&src=&docid=2005033108162039&nsf=tsgeninfo.nsf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl=&seg=hm
until I got to #4, which is where I would use these instead.


MS Defender http://www.microsoft.com/athome/security/spyware/software/default.mspx Free
Lavasoft Adaware  http://www.lavasoftusa.com/software/adaware/ Free
Spybot Search & Destroy  http://www.safer-networking.org/en/download/ Free
Spysweeper http://www.webroot.com/ Not Free but 14 day trial
Spyware Guard http://www.javacoolsoftware.com/spywareguard.html Freeware/shareware
Spyware Blaster http://www.javacoolsoftware.com/spywareblaster.html Free/shareware

Also ZA Pro with an anti-spyware element Not free  http://www.zonelabs.com/store/content/home.jsp

My AV of choice is Avast at www.avast.com both a free version and a professional.

0
 
AuroRA_SkyAuthor Commented:
Dear all,

Thanks for all your help on this matter. I however don't believe this is a spyware issue. if it were then one of the above would have been able to fix it.

I tried using IE 7 beta but it wont help the matter. I agree the easiest thing to do in this CRISIS is to use Firefox or any other browser. However its a question of a comfort factore that I now have in using IE.  While one could always change and get used to new methods of using the internet, i much prefer to use IE.

Also the site that you pointed out is my own so thats not something i would remove. i had put it there to see if this stupid link was going to get replaced or not.

I'm convinced this is an issue with HP and they have a tie up with Oberon Media which is a gaming company. All they do is instill this link into every laptop they sell. I even talked with HP...they simply said, "if you dont want it reformat your machine" - however am not convinced reformatting would help either simply because we're finally going to be using a windows recovery set that HP has provided with the machine.

In all probality the recovery files too may have IE preloaded with the game site.  Anyone knowing about XP reformating should be able to tell me if my presumption is true or not.


PS : I am a 'she'

0
 
AuroRA_SkyAuthor Commented:
OK  Please check out O14 from my hijack log. it has the stupid URL installed as IERESET.INF. Now am assuming this the the file code that is resetting my browser. Can anyone check what file type is .INF and let me know if i can just delete this entry from the system?
I think this may solve my problem.


O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_IN&c=Q106&bd=presario&pf=laptop
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/latest/PlaxoInstall.cab
0
 
Irwin SantosComputer Integration SpecialistCommented:
"I however don't believe this is a spyware issue. if it were then one of the above would have been able to fix it."

Uh..no...it's still can be a malware issue.. just because it wasn't fixed, doesn't mean it doesn't exist.  It probably something that the programs didn't catch.  New malware & virus is out everyday.

did you fix anything as suggested by the other experts since my last post which had your analyze log?  If not, run hjt, analyze and post the link please
0
 
AuroRA_SkyAuthor Commented:
Irwinpks,

actually havent found any others to fix. did a HJT again ...no nasties around.   Now i need someone to check on the 'IERESET.INF' file and tell me if i should delete that entry.

I did find some sites on the net about this file type and malware etc. Have to still execute those and find out if it works.

Cheers
0
 
Irwin SantosComputer Integration SpecialistCommented:
can you post your most recent analyze log link please?
0
 
AuroRA_SkyAuthor Commented:
Logfile of HijackThis v1.99.1
Scan saved at 2:56:56 PM, on 6/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\eFax Messenger 4.1\J2GDllCmd.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\Program Files\Plaxo\2.9.0.38\PlaxoHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\eFax Messenger 4.1\J2GTray.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\GlobalSCAPE\CuteFTP 7 Home\cuteftp.exe
C:\Program Files\GlobalSCAPE\CuteFTP 7 Home\ftpte.exe
C:\Documents and Settings\Amisha\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_IN&c=Q106&bd=presario&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://toolbar.google.com/done
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zSPGuard] c:\program files\pjw\spguard\spguard.exe /s /r
O4 - HKLM\..\Run: [eFax 4.1] "C:\Program Files\eFax Messenger 4.1\J2GDllCmd.exe" /R
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.9.0.38\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: eFax 4.1.lnk = C:\Program Files\eFax Messenger 4.1\J2GTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/latest/PlaxoInstall.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/bejeweled2/popcaploader_v6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E365A229-DD23-4295-A49F-BBAA4B6DCD3F}: NameServer = 192.168.0.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

0
 
Irwin SantosComputer Integration SpecialistCommented:
yikes!!! not the log again.. the LINK!!! after you analyze it, you get a link.
:-(
0
 
Irwin SantosComputer Integration SpecialistCommented:
http://www.hijackthis.de/logfiles/4e98be2c94fcae98956c7396b46f9874.html

That's the link....posting the log is not a good practice here as it takes up alot of visible space.

In the log you still have Possible nasties, and lots of unknowns. You need to determine if you can do without the unknowns (uninstall the software) and confirm that the possible nasties is not a real program.  With that said... select the offending entries, then FIX then in HJT.
0
 
Marc ZCommented:
From http://support.microsoft.com/default.aspx?scid=kb;en-us;320159
1.  Run the full antivirus scan.
2.  Open the Web site that you want to set as your home page in Internet Explorer.
3.      Click Tools, click Internet Options, and then click Use Current. Restart your computer, and then restart Internet Explorer. If the issue is resolved, do not follow the remaining steps.

4. Do a Clean Reboot.  See this page http://support.microsoft.com/kb/310353/
     
       Note You must be logged on as an administrator or a member of the Administrators group to follow these steps. If      your computer is connected to a network, network policy settings may also prevent you from follow these steps.
    1.      Click Start, click Run, type msconfig in the Open box, and then click OK.
    2.      On the General tab, click Selective Startup, and then clear the Process System.ini File, Process WIn.ini File, and     Load Startup Items check boxes. You cannot clear the Use Original Boot.ini check box.
    3.      On the Services tab, select the Hide All Microsoft Services check box, and then click Disable All.
    4.      Click OK, and then click Restart to restart your computer.
    5.      After Windows starts, determine whether the symptoms still occur.

Note Look closely at the General tab to make sure that the check boxes that you cleared are still cleared. Continue to step 6 if none of the check boxes are selected. If the Load System Services check box is the only disabled check box, your computer is not clean-booted. If additional check boxes are disabled and the issue is not resolved, you may require help from the manufacturer of the program that places a check mark back in Msconfig.

If none of the check boxes are selected, and the issue is not resolved, you may have to repeat steps 1 through 5, but you may also have to clear the Load System Services check box on the General tab. This temporarily disables Microsoft services (such as, Networking, Plug and Play, Event Logging, and Error Reporting) and permanently deletes all restore points for the System Restore utility. Do not do this if you want to retain your restore points for System Restore or if you must use a Microsoft service to test the issue.
    6.      Click Start, click Run, type msconfig in the Open box, and then click OK.
    7.      On the General tab, select the Process System.ini File check box, click OK, and then click Restart to restart the computer. If the issue continues, the issue is with an entry in your System.ini file. If the issue does not continue, repeat this step for the Process Win.ini File, Load Startup Items, and Load System Services check boxes until the issue occurs. After the issue occurs, the last item that you selected is the item where the issue is occurring.

Note Microsoft strongly recommends that you do not use System Configuration Utility to modify the Boot.ini file on your computer without the direction of a Microsoft support engineer. Doing so may make your computer unusable.

5.  Repeat steps 2 and 3.

If the issue is resolved, you have installed third-party software that changed your Internet Explorer home page or code in the form of a malicious attack, such as an unknown virus has been run on your system. One of the startup items that were removed by using the clean boot method is causing the issue. Any startup items that run Regedit.exe or a .reg, .hta, .vbs, or .js file may be the cause of the issue. Leave any such startup items or suspected third-party software turned off, and then continue troubleshooting with the next step.
6.      Click Start, and then click Run.
7.      In the Open box, type regedit, and then click OK.
8.      In Registry Editor, locate the following subkey, if it exists:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel
9.      If the ResetWebSettings value or the HomePage value exists in this key, right-click the values, and then click Delete.

Note You may also want to verify any Web site information contained in the Default_Page_URL value and the Start Page value in the following registry keys:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main

HKEY_ LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main

HKEY_USERS\Default\Software\Microsoft\Internet Explorer\Main
10.      On the Edit menu, click Delete, and then click Yes to confirm the deletion.
11.      On the File menu or on the Registry menu, click Exit to quit Registry Editor.
12.      Repeat steps 2 and 3. If the issue is resolved, turn on the startup items that you turned off in step 4 except for the items that may be causing the issue for example, commands that run Regedit.exe or a .reg, .hta, .vbs, or .js file. If the issue recurs, you turned on the startup item that was causing the issue. Repeat steps 4 through 11.


How to return from a clean boot state
1.      Click Start, click Run, type msconfig in the Open box, and then click OK.
2.      On the General tab, click Normal Startup - load all device drivers and services.
3.      Click OK, and then click Restart when you are prompted to restart your computer.


0
 
Marc ZCommented:
HOLD IT.  I just reread your first post.  Can you delete that IE shortcut on your desktop?  You are logged on as admin, correct?  Not that you should be using XP in Admin Mode for everyday use unless you are willing to reformat and reinstall occassionally, that would require backups of all of your important data.

When you start IE, you are selecting the IE shortcut on your desktop, correct?

What happens if you go to Start->All Programs->Internet Explorer ?  If it opens the home page that you set, then just drag it to your desktop and use that shortcut and delete the other one.  

You could also look at the Properties of that IE shortcut on your desktop and change the  http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_IN&c=Q106&bd=presario&pf=laptop  to a www.google.com or what ever you want your homepage to be.  I am thinking that is just a shortcut that HP set on your desktop.

Have you tried creating a New Limited User and see what home page that one comes up with?

Did you try IE7 Beta before or after this issue arose?

Have you uninstalled IE7 Beta yet?

 Open Norton Program > Options > Select Norton AntiVirus > In left pane click On Home Page Protection > In right side uncheck the Home Page Protection feature > Apply > OK.
0
 
AuroRA_SkyAuthor Commented:
MTZ1OF4,

YOU'RE THE GENIUS!

After all that one never thought of checking NORTON....IT WORKED.........and for weeks i was breaking my head with the registry....I just changed my browser to Opera this morning.....and after that I even sent a stinker to HP.....after their ONLINE CHAT assistance couldnt help me resolve this stupid thing!!!!!!!!!!!!


Well thanks a ton for the SIMPLE solution :)






0
 
AuroRA_SkyAuthor Commented:
MTZ1OF4,

I loaded IE7 to try and counter this problem. also, now that it was an anti virus setting issue, i havent done any of the things you mentioned in your previous comment. Guess I dont need to
0
 
Marc ZCommented:
Yikes,

Norton's was my first post.  But there were a few exchanges up there, you might not have seen it.  

No, you shouldn't have to try any of those others once you disable the Norton's.

BUT, take your time and read through this whole posting again.  You may see different programs you might want to look at if Norton's was only the trial.

Personally, I uninstall Norton's on every machine I support and install Avast.  Nod32 is also a very good AV.
0
 
Marc ZCommented:
By the way, you were also correct.  It wasn't a spyware issue.  It was an Antispyware issue.

Make sure you accept the answer that helped you so others can see when they are also looking for help.

Glad we could help.
0
 
Irwin SantosComputer Integration SpecialistCommented:
Not to denounce the ultimate conclusion here....though Antivirus, should be second nature to have, installed, updated and scanned periodically. My comment to deploy a malware solution was based on the assumption that all users have Antivirus running.

Guess I'm wrong.
:-(
0
 
Marc ZCommented:
I don't think you are wrong, irwinpks.  I think of Norton's Internet Security as malware.  Some people don't think it is.  It takes such control of your machine that you can't even do the simple things like change your home page.  But  I also believe not one company can make an all over security fix.  ANTIVURUS protection is a MUST but what this was was an Add-on called the Home Page Protection of the Norton's product.

Have a great weekend.
0
 
Irwin SantosComputer Integration SpecialistCommented:
I was thinking that NS only had FIREWALL & AV...wasnt sure the late incarnation had malware...but that is good to know
0
 
AuroRA_SkyAuthor Commented:
Yes i didnt know about the malware incarnation either...i was always using firewalls and AV ...but this is a new version i guess....Thanks MTZ1OF4. sorry I missed your earlier post on the same point. I think i was just too frazzled about the stupid URL in my face.

Thanks to everyone though. ....you'll have been a great help and its surely been a great learning
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 16
  • 11
  • 11
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now