1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Deleted "Start Page" registry key (HJT Log posted)

Discussion in 'Malware and Virus Removal Archive' started by RadoK, 2005/02/19.

Thread Status:
Not open for further replies.
  1. 2005/02/19
    RadoK

    RadoK Inactive Thread Starter

    Joined:
    2005/02/19
    Messages:
    5
    Likes Received:
    0
    Deleted "Start Page" registry key

    Hello.
    My computer was (is??) infected by hijacker. I removed it according to steps written here. No more popups, viruses... But problem is, I accidently deleted registry key HKLM\software\microsoft\internet explorer\main\Start Page.
    Now I cannot recreate it (it disappears after F5 - refresh) and cannot start Internet Explorer. IE starts only with url as parameter.
    What did I try and did not help:
    - logon as administrator in safe mode
    - update IE (no reinstalll)
    - import the registry key from file
    - disable all startup programs, services, system.ini, win.ini
    - another registry editor
    - monitor registry activity using Regmon
    I cannot set the same key in HKCU registry.
    Any other key in the same branch with other name is created without problem.

    Please help.
    Rado
     
    RadoK,
    #1
  2. 2005/02/19
    surferdude2

    surferdude2 Inactive

    Joined:
    2004/07/04
    Messages:
    4,009
    Likes Received:
    23
    Can you start IE and type some valid url in the address field? If so you can type your desired url in and bring it up. Then click Tools > Internet Options > Use Current.

    Another thought, just open IE > clicl Tools > Internet Options > Use Default. Then if that loads ok, migrate to your personal favorite and set it as before. The Registry will take care of itself if this method works.

    If you can't open IE successfully, you can do the deed by right-clicking the big blue E on your Desktop and selecting properties. Just type your url directly in or choose whatever you want.
     
    Last edited: 2005/02/19
    surferdude2,
    #2


  3. to hide this advert.

  4. 2005/02/20
    RadoK

    RadoK Inactive Thread Starter

    Joined:
    2005/02/19
    Messages:
    5
    Likes Received:
    0
    I wish it was so easy.
    Yes, I can start IE (only with url as parameter, otherwise it wont start) and then type any URL. I can use current, type any or use blank page in options. But problem is the page is not saved. There is no key in registry where to store url (Start Page). I deleted it :-(
    Internet Options Use default doesn't help.
    Internet Options shows only one question mark as home page. I can change it, but after OK and reopening of Inet Options there is still "? ".
    I cannot recreate registry Start Page key. Is there any policy preventing me to recreate it? Even when I'm logged in as administrator?

    Rado.
     
    RadoK,
    #3
  5. 2005/02/20
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Try the first stage of a Repair of IE and run System File Checker....

    Start > Run > sfc /scannow - note the space and have your XP CD handy. SFC will run and exit without any closing dialogue. To see which files, if any were replaced look in Event Viewer.
     
    PeteC,
    #4
  6. 2005/02/20
    surferdude2

    surferdude2 Inactive

    Joined:
    2004/07/04
    Messages:
    4,009
    Likes Received:
    23
    I understand. It'll take a restore of that key or a restore of the full IE program.

    Try the IE6 MAIN KEY . I think it may get you going with the least effort. It's a .reg file so run it and allow the merge of data.

    Good luck.
     
    surferdude2,
    #5
  7. 2005/02/20
    RadoK

    RadoK Inactive Thread Starter

    Joined:
    2005/02/19
    Messages:
    5
    Likes Received:
    0
    Petec: done, didn't help

    surferdude2: import of registry keys failed with error (translation): cannot import file.reg: error ocurred while accessing registry.
    (I was logged in as administrator)

    Funny is I can create any entry (Start Page 1, StartPage) but cannot create Start Page entry.
    I guess:
    1. I don't have privileges to create exactly Start Page entry (it looks curious)
    2. There is still some program (hijacker) preventing me to change the entry.
    How can I check 1. and 2.?
    Is it possible to change registry out of running Windows.

    Rado.
     
    RadoK,
    #6
  8. 2005/02/20
    surferdude2

    surferdude2 Inactive

    Joined:
    2004/07/04
    Messages:
    4,009
    Likes Received:
    23
    First, do this:

    Open Regedit and drill down to:

    HKEY_USERS\S-1-5-21-2857422465-927890586-840360825-1003\Software\Microsoft\Internet Explorer\Main

    Right-click the "Main" folder and select "Permissions" and verify that you have full read/write permission.

    If you don't, change it and disregard the .reg file I sent, you should be able to do it via the normal fashion, we hope.
     
    surferdude2,
    #7
  9. 2005/02/20
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    If you used HijackThis to clean up and in the course of fixing things deleted that registry key it would be a good idea to restore the changes from the backup and then run HJT again (from a folder on your hard drive not the desktop) and post the log here - without fixing anything.
     
    PeteC,
    #8
  10. 2005/02/21
    RadoK

    RadoK Inactive Thread Starter

    Joined:
    2005/02/19
    Messages:
    5
    Likes Received:
    0
    surferdude2:
    I have all the permissions. Administrator too. Still without success (no matter who is the owner of Main branch). Use of command line reg.exe didn't help. "reg add" ends successfully, but "reg query" doesn't show Start Page entry.

    PeteC:
    I deleted Start Page manually :) It's funny I can delete it but cannot recreate. Below is HijackThis log.

    One question. Will hijack program infect my computer if I dont have permission to change registry?

    Logfile of HijackThis v1.99.1
    Scan saved at 20:09:09, on 21.2.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\DVDRAMSV.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZONELABS\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\regedit.exe
    C:\WINDOWS\system32\cmd.exe
    C:\Program Files\Hijack This\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
    O2 - BHO: AssistII - -{BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
    O2 - BHO: (no name) - -{D9EAD324-6D86-418F-AAF4-15D9901003AE} - (no file)
    O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
    O9 - Extra button: ICQ 4 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
    O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://inotes-sk1.sk.uss.com/iNotes6.cab
    O16 - DPF: {53B8B406-42E4-4DD3-96E7-9DEC8CEB3DD8} (ICQVideoControl Class) - http://xtraz.icq.com/xtraz/activex/ICQVideoControl.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9DB5C9BE-C6D4-428C-A2A2-C4040E282715}: NameServer = 213.215.79.146 213.215.79.147
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
     
    RadoK,
    #9
  11. 2005/02/21
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    HJT Log posted - moving this thread to the Removing Spyware and Viruses forum
     
    PeteC,
    #10
  12. 2005/02/21
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Scan again with HijackThis and place a check next to the following entries. Close all other windows and click fix.

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
    O2 - BHO: AssistII - -{BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
    O2 - BHO: (no name) - -{D9EAD324-6D86-418F-AAF4-15D9901003AE} - (no file)

    Reboot and post a new log.

    BTW, are you able to get Windows Updates? Your computer is open to many vulnerabilities due to being behind on them.
     
    noahdfear,
    #11
  13. 2005/02/22
    RadoK

    RadoK Inactive Thread Starter

    Joined:
    2005/02/19
    Messages:
    5
    Likes Received:
    0
    Hello,
    I fixed all the lines you wrote except R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy. This is just translation of "Links" in my language. Below is a new hijackthis log.
    First three lines were not fixed. And this is exactly the problem I have. I cannot change these (only these) three registry entries. I have full access to (for example) HKCU\Software\Microsoft\Internet Explorer\Main, can edit any value except Local Page and Start Page. It seems like something is preventing me to change these items. I cannot find what.
    The only working solution is offline registry editor I tried yesterday.
    Example of behaviour:
    - in offline reg. editor I changed Start Page to http://www.google.com
    - after reboot my start page is http://www.google.com
    - in regedit I change start page to http://www.yahoo.com
    - after F5 (refresh) there is still http://www.google.com
    - the same scenario is when using Internet Options

    Rado

    PS: I started updating windows but there are tons of patches. Were I sleep for 10 years? :)

    Logfile of HijackThis v1.99.1
    Scan saved at 23:40:09, on 22.2.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\DVDRAMSV.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZONELABS\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Hijack This\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
    O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
    O9 - Extra button: ICQ 4 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
    O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://inotes-sk1.sk.uss.com/iNotes6.cab
    O16 - DPF: {53B8B406-42E4-4DD3-96E7-9DEC8CEB3DD8} (ICQVideoControl Class) - http://xtraz.icq.com/xtraz/activex/ICQVideoControl.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1109101111374
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9DB5C9BE-C6D4-428C-A2A2-C4040E282715}: NameServer = 213.215.79.146 213.215.79.147
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
     
    RadoK,
    #12
  14. 2005/02/23
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please download the attached IEMain.zip, extract to it's own folder and open. Run the IEMain.bat, then email the three text files it creates here.

    If the attachment saves as attachment.php, simply rename. Been some problems with that lately. :rolleyes:
     
    noahdfear,
    #13
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...