|Home │ Part I │ Part III │ IE 6 Security │ Clear IE cache|
Go back to Part I on previous page: Internet Options menu
Topics on this page:
Please read the introduction in Part I first. Homepage (start page) hijacking is now fairly commonly seen in IE6 especially if you are lax in IE security.
Note: if it is a version or variant of CoolWebSearch then you can get more information here as it is very hard to remove. You need the CoolWebShredder tool. The about:blank page has now been used too as part of CoolWebSearch. For other hijacked home sites you should search on the internet (especially this site) for more up to date specific fix. You usually find answers in forums or ask in forums. This is a general guide which should work in the vast majority of cases of hijacks other than CoolWebSearch or about:blank page hijacks. Read this Lavasoft article too about Ad-aware and about:blank.
The registry key which would normally let you change your home (start) page is in the HKCU hive (Fig. 5). It also has entries for the local page, search page and window title (see Part III). This key is most commonly used for hijacking but there are other possible places which I will refer to below so you need to look for all the possible entries.
Fig. 5. HKCU Start Page registry key.
Fig. 6. HijackThis scan log showing the HKCU Start Page key.
or run Browser Hijack Blaster, click the Start Protection button: it protects the home and other pages; once activated it changes to Stop Protection (Fig. 7).
Fig. 7. Browser Hijack Blaster main window.
Other keys for home page hijacking
It is possible to add the following key as hijack object or customisation; this is not present by default:
There are two other entries in the HKLM key and the default value data should remain the same whether you have customised your home page or not; these are further targets for customisation or hijacking.
(The above values are all in one line.)
In Windows XP Pro's Group Policy editor, Local Computer Policy, User Configuration, Internet Explorer maintenance, URLs, Important URLs, Customize Home page URLs, you can enter your custom URL in the Home page URL box (Fig. 8).
This changes both the HKCU\....\Main\Start Page and the HKLM\....\Main\Default Page URL with the customised URL. Interestingly this change within the Group Policy editor will override the home page restriction set by another Group Policy setting which is discussed below. You can reset your home page here.
Fig. 8. Group Policy: Customize Home page URL.
If your homepage is locked, the Address box in IE's Internet Options is greyed out thus preventing you from resetting it (Fig. 9). If it is hijacked with about:blank to direct to a search page, it is a variant of CoolWebSearch: read my note at the beginning.
Fig. 9. Internet Options Home page Address bar.
Normally you can reset the home page because there is no policy in the registry but if it is present then it will deny you permission:
In the control panel key, setting the Homepage value to (1) would lock the home page and make the homepage setting greyed out in the IE Internet Options box (Fig. 10).
Fig. 10. HKCU Control Panel key which locks the homepage.
You need to reset it to (0) or delete the Control Panel, Homepage subkey. You can also reset this in Window XP Pro's Group Policy Editor:
User Configuration\Administrative Templates\Windows Components\Internet Explorer: Disable changing homepage settings.
Choosing Not Configured would delete the Control Panel, Homepage entry; choosing Disabled would reset the value data to (1). It is possible (although not touched by the Group Policy editor) for the HKLM policy key to be a target of hijacking so it's worth checking it too.
Or if you don't want to do it yourself, copy and paste all the text between (but not including) the lines, save in Notepad somewhere on your computer as Unlock.reg (or any name you like) and double-click to run it; or just download and run the unlock homepage file (unzip and run it).
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel] "Homepage"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Control Panel] "Homepage"=dword:00000000
Or run HijackThis to remove the Control Panel entry in the registry, tick the entry and click Fix checked (Fig. 4 in the previous page).
Often the browser hijack object reappears on reboot because it runs on start up. In that case go to Windows Task Manager and stop all non essential running processes or go to Safe Mode, run HijackThis again and look carefully for other suspicious entries especially the startup entries (see Part III for details). If in doubt, do a Startup List (available in the Config button, Misc Tools, Generate StartupList log) and examine the contents carefully or ask other experts in a forum. Also scan for spyware (with Ad-aware and Spybot Search and Destroy) and for Trojans with a trojan scanner.
Read my note on about:blank at the beginning of this article.
The blank page (if you do not specify a home page in Internet Options) can sometimes be hijacked with a cascading style sheet (css) or another html page: look for this entry in the registry editor or HijackThis (see Fig. 9 above); the default is:
(or: C:\Windows\System32\blank.htm or whatever your drive letter is)
There is no blank.htm file in the System32 folder but there is one in C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\ so it is not clear why the default setting points to a different location.
You can actually lock it yourself by resetting the above homepage value to (1); or use the Group Policy editor or download and run the lock homepage file (unzip and run it). Check that the homepage setting box is indeed greyed out with your desired URL (Fig. 7 above). Remember that HijackThis will show this entry but if you've set it yourself you can ignore it.
This tactic only stops the desktop user from resetting the home page in the Internet Options; it does not prevent scripts from doing so. You should increase your internet zone security settings (refer to my article on this). Also refer to Part III for a summary of the approach and the registry keys.
Go to TOP
Go to Part III: Window Title, Search and Local Pages
Copyright © 2003 by Kilian. All my articles including graphics are provided "as is" without warranties of any kind. I hereby disclaim all warranties with regard to the information provided. In no event shall I be liable for any damage of any kind whatsoever resulting from the information. The articles are provided in good faith and after some degree of verification but they may contain technical or typographical errors. Links to other web resources may be changed at any time and are beyond the control of the author. Articles may be added, removed, edited or improved at any time. No support is provided by the author.
This is not an official support page for HijackThis or other products mentioned. All the products mentioned are trademarks of their companies. Edit the registry at your own risk and back up first.
Last updated 23 June 2004