Results 1 to 4 of 4
  1. #1

    Default naughty sites in internet explorer

    i have a friend who (lol it is true even if it sounds corny) after browsing an adult site he has porn coming up everytime he starts internet explorer. anyone got an easy fix for this. i can change the settings but everytime i reboot it changes back. i have looked around for what is running but cant find anything. i even tried changing the registry settings for the page that comes up. any help would be wonderful

  2. #2

    Default Re: naughty sites in internet explorer

    If any of the following works for you, give credit to SUSAN B for writing it all up.


    Many people contract an unwanted home page after visiting certain sites on the internet, which becomes very difficult to change because a site installs a file which is changing the registry back at every boot up.
    I have researched and compiled a list of procedures that should fix this problem. It is a long post due to the complexity of the problem, my attempt to cover all possibilities and the need for a diverse range of artillery.
    Carry out each step in consecutive order until your problem is solved, then read the tips in Steps Seven and Eight to protect yourself from future hijackings.
    *STEP ONE:*
    Firstly, open Internet Explorer, go to Tools, Internet Options, and change the Home page to the one you want. If you have attempted this and the offending address is persistent in adding itself back in, go to Step Two.
    *STEP TWO:*
    Do a virus scan with the latest updates installed. Viruses can be a source of some home page hijackings, one being the JS.Seeker trojan. You can do a scan here if you don't have an anti-virus program .
    Download, install and run Ad-aware from to detect any programs with spyware running. Ensure that deep registry scan is enabled. Ad-aware is a very useful (essential?) utility to have in any case.
    *STEP FOUR:*
    Download, install and run the Spider program obtained from . This useful program cleans out your temporary internet and history files, cookies and the index.dat file, which often contains unwanted settings.
    After opening Spider click on the magnifying glass icon with a red cross in it to start the scanning process, then click on the ambulance icon and tick all the boxes. Now click on OK to restart your computer. Spider is another handy program to have in any case as it makes your browser run quicker without all the excess baggage.
    Please note that even if you don't select the boxes to delete your cookies, temporary internet or history files this program often deletes them anyway, so if they are important to you then don't use Spider. Also note that Spider was written for Win 9.x and the more recent versions of Windows, especially Win XP, may not work with it. If that is the case you will have to delete the temporary internet and history files and cookies manually through the Tools menu.
    Hopefully, the unwanted home page will now be gone. If it is STILL annoying you, get ready to bring out the bigger guns.
    *STEP FIVE:*
    Click on Start, Run, type in msconfig and press Enter. (Note: msconfig is not available in Win95, unfortunately). Click on the Startup tab and go through the list of files to see if the unwanted home page is listed in there. Note that the file may have a name completely unrelated to the web page involved, so you have to look carefully.
    Some unwanted files to look for are SWPortal, SWCaller, Sp.dll, winn32.html, and/or MSKernel32 (Win32.hta) and also ones with a .tmp or .hta extension (probably a shortcut in your Programs\Startups folder) or sp.dll. These two latter files are related to viruses. Another line to watch for is 'LoadIE'='Rundll32.exe iexplore.dll,_Load@16'
    If you find one or more of these things, uncheck them, make a note of their names, including their full path, and click OK to exit the msconfig dialogue box. If you are not sure what some files are, you can check them out here:
    Now open Internet Explorer, and go to your favorite Start (Home) Page. Go to Tools, Internet Options, General tab, and click 'Use current'. If after rebooting there's still no change, move to Step Six.
    **Experienced Users: If your home page problem *is* now solved you can navigate to the offending file and delete it. They are often a temp file thrown into the Windows System Folder. The .tmp files are usually running from the registry and should be removed permanently from there also.
    An example is: OPQFile'='C:\\WINDOWS\\regedit.exe /s C:\\WINDOWS\\SYSTEM\\rad3BBBD.tmp' To remove this file permanently from the registry run regedit and navigate to: [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run] With RUN (or RUN- if it has been unchecked in msconfig) folder highlighted, right click and delete it Close the Registry editor, reboot and find and delete rad3BBBD.tmp from c:\windows\system
    *STEP SIX:*
    Start loading the nuclear warheads -- the next step is to search and edit the Registry. For those new to this it is a serious business because if you put a finger wrong in the registry you could do a lot of harm to your PC that might not be repairable without reformatting. Tread carefully and you'll avoid the landmines!
    Firstly, it is essential to backup your registry: ensure that open programs are closed and go to Start, Run, type scanregw and press Enter. Ignore the message that a backup already exists for today and let it create a new backup. That creates a backup file that you can restore back from using scanreg/restore.
    *STEP SIX (a)*
    Go to Start, Run, type regedit and press Enter to open the Registry Editor. Do a search for the offending web address: hold down Ctrl+F and type in a key portion of the address that you are looking for, not the entire address. Make sure all boxes are checked then press Enter.
    For every instance you find, carefully replace it with the web address that you wish to be your home page: if you have IE5.5 and Win98SE, you should find it at HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main and then double click the Start Page in the right window to change the address to something else.
    and at HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main and then double click the Start Page in the right window to change the address to something else.
    Press F3 to continue on with each search.
    *STEP SIX (b)*
    If you cannot find the offending web address in your registry, navigate to HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Control Panel
    If you find the subkey called 'Control Panel' there, right click it and choose delete from the context menu. Close Regedit.
    Now go to Start, Settings, Control Panel, Internet Options. Go to the Programs tab, and click Reset Web Settings. Go to the Security tab and for all ActiveX options that are currently set to 'Allow', change them to 'Prompt'. Also uncheck 'Enable install on demand' on the 'Advanced' tab.
    Now open Internet Explorer and while online, go to your favorite home page. Go to Tools, Internet Options, General tab, and click 'Use current'.
    Hopefully the offending home page will now be permanently gone!
    If, by some chance, it is not then the culprit is something other than what is listed here. You will need to post a message requesting further help.
    Once your home page is set back to what you want it to be, it is possible to set it to prevent sites and other people changing it. Do this immediately after correcting your home page to the one you prefer:
    Backup the registry then go to Start, Run, type regedit. Navigate to: HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\In ternet Explorer
    Right-click on the Internet Explorer key, choose New, Key, name it Control Panel. Right-click on the Control Panel, chose New, DWORD value, name it Homepage. Right-click on Homepage, choose modify and type in the number 1.
    This should lock your home page, so no other web site can change it. If you might later feel like changing your home page again, open Regedit and drill down to this value Homepage again. Double-click it in the right pane and change its value from 00000001 to 00000000, close Regedit, and make your change in Internet Explorer.
    To further protect your computer from unscrupulous websites do the following:
    1. Disable Windows Scripting Host by installing noscript.exe from Symantec . This is a very convenient, one click tool for disabling or enabling the Windows Scripting Host, a very exploitable tool used by worms and sleazy operators to make bad things happen on your PC. It is not at all required for normal Windows functions.
    2. Make sure 'Install on demand' is unchecked in Internet Explorer's Tools, Internet Options, Advanced.
    3. Go to Internet Options/Security/Internet/Custom level, and for all ActiveX options that are currently set to 'enable' change them to 'prompt'.
    4. Make sure you run a reliable, up-to-date anti-virus program.
    5. Make sure you run a firewall program when on the internet. A good firewall, which is freeware, and easy to configure, is ZoneAlarm (go for the free one) here:

  3. #3

    Default Re: naughty sites in internet explorer


    Hats off to Susan B. Thats some post.

    One other thing you may want to try is (in IE): properties or tools>options>general>settings>view objects. Delete anything that does not look kosher.

    Someone may be able to elaborate on what to look out for but files like Java classes should be ok. I would tend to be supicious of anything that looks similar to a URL or .EXE. Check out the files properties>who it belongs to.

    Also check msconfig for running tasks/proceses that may match other oddities on your comp.


    Murray P

  4. #4

    Default Re: naughty sites in internet explorer

    Thank you for the compliments Murray :-)

    If it's OK with you, I'd like to include your tips somewhere in that How-To as they sound useful.

    I actually had a look in my own 'View Objects' department and found a couple of strange-looking specimens, although I've never had problems with unwanted home pages (touchwood).

    One I have identified but the other is an ActiveX control with the CodeBase as

    Would you know if this legitimate?

Similar Threads

  1. Replies: 1
    Last Post: 28-04-2003, 07:49 AM
  2. Replies: 2
    Last Post: 15-11-2002, 12:57 PM
  3. Replies: 1
    Last Post: 15-09-2001, 11:27 AM
  4. Replies: 5
    Last Post: 10-07-2001, 11:16 PM
  5. Some internet sites
    By in forum PressF1
    Replies: 0
    Last Post: 01-02-1999, 09:54 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts