Help! I can't change my homepage in internet explorer

[TripleAAA]

I just got a new computer and was websurfing last night with it. I must have gone to a site that sorta hacked into my computer and changed my homepage somewhat permanently. When I start up explorer now, it always goes to this search engine homepage that I don't want.

Here's what I've tried so far: I went into internet options, changed and applied the homepage I wanted. I also cleared cookies, restored internet settings to default, and cleared file history.

What else can I try? Every time I restart my computer or close explorer it automatically changes back to that darn stupid homepage.

Thanks

 

[microAmp]

From another thread:

Originally posted by: Schadenfroh
1st Run CWShredder check for updates and run the sucker
2nd Run Spybot
check for updates then Check for problems and fix problems, then go into immunize and immunize it, block bad pages silently and check the boxes down on the bottom to prevent hijacking
3rd Run Adaware
update it and scan it and delete by spyware
4th Run Spyware blaster and keep it from being installed, update first then apply the new ones


BTW, disable windows messanger, THIS IS NOT MSN MESSANGER

Hijack This is another program you can use.

 

[TripleAAA]

Do you have the link to the entire thread? I'm not sure exactly what all these programs do. I did install and run Adaware, but even though it found a few files, it didn't seem to solve the actual problem I'm having.

Isn't there an easier way to do this? Some type of file option or setting that I'm missing?

Thanks again.

 

[ianbergman]

Download and run Spybot. It's free from download.com.

Once you've downloaded and installed it, make sure to click the "online" button to get the latest updates. Then, scan for problems; it will find and remove your hijackers or anything else, even if it has to run again at boot-time to do it.

EDIT: What probably actually happened, btw, is your "hosts" file was modified; this means that when you (or internet explorer) type in a website - say, auto.search.msn.com - instead of going out onto the internet to find the proper address, it looks at the modified hosts file and gets the wrong addess. Spybot and find, fix, and prevent this kind of dastardly deed.

 

[TripleAAA]

Well tried spybot and that didn't seem to do the trick either. It's frustrating...I think what I'm going to do next is just reinstall internet explorer, but i gotta download it first.

 

[Slikkster]

Something's obviously running at startup that's making the change. You have to figure out what it is.

Get Mike Lin's Startup Control Panel (freeware). Startup Control Panel

Once you unzip this and doubleclick on the file to install it, it will put an applet in your Control Panel labeled "Startup". Click on that, and you'll see various tabs that refer to registry sections that can all run programs at startup. Your culprit will most likely be in there. If you're not sure what those programs are, go into each of the tabs and copy them down and post them here. We'll figure out which one it is so you can delete it.

Also, this page is helpful (but get the Startup Control Panel!):

Fix Hijacked Homepage

 

[TripleAAA]

Ok, I think we're getting somewhere now. I downloaded and installed the "Startup Control Panel". FYI, the homepage that is stuck on my computer is a search engine called "Search Central". Here is what I have listed that I'm not 100% percent sure what they are:

HKLM/Run Tab:

dla
NvCplDaemon
StorageGuard
TkBellExe

Run Once Tab:

tlc (edit: it appears this one is a windows update file...at least thats what the file path suggests?)


*all of these look suspicious, but I don't want to delete anything that might be important.



That's about it. There are others listed, but they are from Dell, Musicmatch, or McAfee so I'm pretty sure they are ok. There are also file paths next to each one but there isn't a copy and paste capability so unless you need it, I won't list it.

Thanks again

 

[TripleAAA]

Well I disabled the dla, NvpCplDaemon, and TkBellexe and that didn't work. Grrrr....this thing is stubborn!

 

[theAnimal]

So, have you run CWShredder yet?
And used immunize in Spybot to prevent homepage changes?

 

[jmagg]

This site is dedicated to removing spyware.
I just got hit with a page called smartsearch that was stubborn as hell.
Swi forums

 

[Slikkster]

I don't know what that "TLC" thing is in the RunOnce folder. It's not a normal MS entry. In the Startup Control Panel, RIGHT-CLICK on that entry. You'll get a menu. Choose "Disabled" for now (not delete). This will take it out of your startup folder. Nothing should show up over and over in the RunOnce folder, but apparently everytime your homepage gets hijacked, this little ditty is added back to the registry.

So, here's the steps:

Disable the TLC entry in the Startup Control Panel. Then, set your homepage to your normal page.
Reboot. See if you've got your homepage back.

Now, if none of that works, download this freeware program and run SCAN on it. Don't chose to FIX anything...Just run Scan. Then, do a "Save a log". It will save a log file, which is just a text file. Open up the saved logfile with Notepad and cut/paste the contents of it here. It will show what, if any, "browser helper objects" you have running with IE. One of them might very well be the hijacker.

The free program is called HijackThis. Get it here: HijackThis

 

[TripleAAA]

Wooohooo! Finally... I disabled the tlc and then changed my homepage, restarted, and voila!

Those kinds of things really tick me off. Thanks Slikkster and others for the tips!

 

[CeeJayCanada]

Hi,

I seem to be having a very similar problem to TripleAAA. I've tried most of the suggested fixes but I'm stuck at a bit of a dead end. My homepage gets changed to bizonio.com/index.htm. I also get 3 pages put into my favorites folder all relating to spy cams. So far I've tried Spy ware S&D, and Adaware. I've also installed the startup control panel, but don't see the TLC thing that Slikkster was talking about. And I've also installed the Google tool bar with the pop-up blocker. I've also gone throught the usual stuff with the IE options and deleting files and cookies, and changing my homepage. Nothing seems to work yet. Whenever I change my homepage back and delete the unwanted favorites, it's fine until I restart my computer. And even when I restart my computer without my internet cable connected it still sets my homepage to this bizonio thing. It sounds like the same sort of thing, but maybe just a different hijacker program. Anyways, I'm not exactly fluent in computers but I'm trying. If any of you would be able to help me it would be much appreciated.
Thanks, and hope to hear from you soon.

 

[ArmchairAthlete]

My dad's PC has something very nasty on it. Spybot, Adaware, Hijack THIS, a virus scan from housecall.trendmicro.com, a look at the startup items, etc can't stop it! I'm at a loss as to what to do.

I think it's some variant of coolWWWsearch. Tried doing a google search on how to remove it. Found some program that's supposed to do it (linked to from Spybot's site). No good either, says I don't have it.

Sometimes Hijack this and spybot delete some files, but it just keeps returning right after that.

 

[cjsmith]

I have the exact same problem with bizonio!! It just wont go away. Ive followed all the messages above and downloaded everything to try and get rid of it and nothing has. In that start up thing in my control panel i dont seem to hav n e dodgy things from wot i can tell. I didnt hav n e thing in the Run once tab.

Can someone please help me get rid of this thing ive been trying for ages! Im not brilliant with computers so id appreciate the help.

I seem to hav the exact same thing as ceejaycanada but nothing will shift it. Hope someone can help soon id be very grateful.

 

[altonb1]

I'm not sure why no one has suggested this, but run msconfig and then start disabling things one at a time until the culprit is foun. definitely time consuming, but when you are desperate, worth the hassle.

Also...go to Control Panel and select Add/remove programs. Remove any toolbars on your system including Google and others, and also look at the names of any apps installed. there is a good chance you have something installed that was a piggy-back app to another program. (weatherbug is one program that likes to install 12-million add-on apps when you install it. Webshots does this, too.)

See if any of that helps...

 

[Slikkster]

I already did suggest an msconfig-like approach above. I use "Startup Control Panel" which give you many more options than msconfig. See the previous post about it.

Unfortunately, however, these hijacking programs don't just work through the startup panel. They piggyback in several registry locations and are self-perpetuating if you try to just do a manual delete.

Regarding deleting Bizonio:

First, you need a program called "HijackThis". It lists all the programs and registry settings that can be altering your web browser, including the normal *good* settings. But it also gives you the opportunity to "Fix" (delete) the settings that are causing the problem with bizonio and other hijackers.

Here's a link to HijackThis:

HiJackThis (sometimes this server is hard to get to)

Don't just willy-nilly *fix* the settings that Hijackthis reports. Some are good settings!

Now, once you have Hijackthis and run it, compare the results to the following forum page's results talking about bizonio. Follow the instructions in the thread I'm about to link to to delete the bizonio hijacker:

The first post you will see is a guy posting the Hijackthis log file of his results when running the program. An expert named "DieHard" walks the guy through how to get rid of Bizonio by pointing out which entries in his HijackThis logfile apply. A couple of the entries in the log have to do with other programs you may or may not have. Also note that the final step required going into Safe Mode to get rid of a pesky entry that couldn't be deleted in regular mode.

Forum link to a thread on how to get rid of Biznonio with the HiJackThis program

New Edit: It looks like the latest version of Adaware has been updated to include getting rid of Bizonio so you can do it automatically, vs. manually with HijackThis. Get it at:

Latest version of Adaware. Make sure you download the latest reference file update for it, too.

 

[Tango57]

Originally posted by: theAnimal
So, have you run CWShredder yet?
And used immunize in Spybot to prevent homepage changes?

spyware frickin sucks! yeah make sure you immunize using spybot and check the box that says "Lock hosts file read-only as protection against hijackers". that should keep them from changing your homepage again without your permission.