IE Homepage Disappears After S&D Runs!!!

[SMB1913]

When I load IE after I run S&D my homepage is gone and it just takes me to a blank page. Why is this? And what exclude do I need to check to stop it from doing this? I use FireFox for about 99% of my internet use and don’t have a problem.

[md usa spybot fan]

SMB1913:

Can you explain a little more about what you mean by "… after I run S&D …"?

Assuming that you did a "Check for problems" followed by a "Fix selected problems", please indicate what was detected by Spybot-S&D's "Check for problems" and what you fixed with the "Fix selected problems".

The best way to do that is to post a copy of the Fixes.yymmdd-hhmm,log file from the "Fix selected problems" that you did immediately before you discovered "… my homepage is gone and it just takes me to a blank page."

There are two methods to copy and post that information:
Method 1:
Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Pervious reports. Look for the Fixes.yymmdd-hhmm.log file that was produced when you found and fixed the detections you believe caused the problem with your Home Page. Open it. To copy it to the Clipboard, right click on the listing and select Select All > Right click again and select Copy. Paste (Ctrl+V) the contents of the Clipboard into a new post in this thread.
Method 2
The Fixes.yymmdd-hhmm.log files are stored in the following folders:
Windows 95 or 98:
C:\Windows\Application Data\Spybot - Search & Destroy\Logs
Windows ME:
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
Windows NT, 2000 or XP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
Using Windows Explorer, navigate to the correct Fixes.yymmdd-hhmm.log. Double click on it and it should open with Notepad. To copy it to the Clipboard, right click on the listing and select Select All > Right click again and select Copy. Paste (Ctrl+V) the contents of the Clipboard into a new post in this thread.
Note: By default here are two Checks.yymmdd-hhmm.log files produced during a scan. The second Checks.yymmdd-hhmm.log file has the details of what the scan found. A Fixes.yymmdd-hhmm.log file is produced if you fix or attempt to fix something.

[SMB1913]

Here's the report of what was fixed prior to my homepage disappearing. notice that i didn't fix the first two in hopes that one of them was the problem. no luck there though.




--- Report generated: 2007-03-16 10:19 ---

Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0

Microsoft.WindowsSecurityCenter.FirewallDisableNotify: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0

Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Avenue A, Inc.: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


DoubleClick: Tracking cookie (Firefox: default) (Cookie, fixed)


HitBox: Tracking cookie (Firefox: default) (Cookie, fixed)


HitBox: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


HitBox: Tracking cookie (Firefox: default) (Cookie, fixed)


HitBox: Tracking cookie (Firefox: default) (Cookie, fixed)


MediaPlex: Tracking cookie (Firefox: default) (Cookie, fixed)


MediaPlex: Tracking cookie (Firefox: default) (Cookie, fixed)


HitBox: Tracking cookie (Firefox: default) (Cookie, fixed)


Statcounter: Tracking cookie (Firefox: default) (Cookie, fixed)


CoreMetrics: Tracking cookie (Firefox: default) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


DoubleClick: Tracking cookie (Firefox: default) (Cookie, fixed)


WebTrends live: Tracking cookie (Firefox: default) (Cookie, fixed)



--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2005-05-31 TeaTimer_original.exe (1.4.0.2)
2007-01-12 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2007-01-02 advcheck.dll (1.2.0.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2007-01-02 Tools.dll (2.0.1.0)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2007-03-14 Includes\Cookies.sbi (*)
2006-12-08 Includes\Dialer.sbi (*)
2007-03-14 Includes\DialerC.sbi (*)
2007-02-07 Includes\Hijackers.sbi (*)
2007-03-14 Includes\HijackersC.sbi (*)
2006-10-27 Includes\Keyloggers.sbi (*)
2007-03-14 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2007-02-14 Includes\Malware.sbi (*)
2007-03-14 Includes\MalwareC.sbi (*)
2007-01-19 Includes\PUPS.sbi (*)
2007-03-14 Includes\PUPSC.sbi (*)
2007-03-14 Includes\Revision.sbi (*)
2006-12-08 Includes\Security.sbi (*)
2007-03-14 Includes\SecurityC.sbi (*)
2007-02-02 Includes\Spybots.sbi (*)
2007-03-14 Includes\SpybotsC.sbi (*)
2005-02-17 Includes\Tracks.uti
2007-03-14 Includes\Trojans.sbi (*)
2007-03-14 Includes\TrojansC.sbi (*)

[md usa spybot fan]

The only detections fixed were Firefox tracking cookies and that would not account for changes in your IE home page.

[SMB1913]

Well, before I was just ticked off because I keep having to reset my homepage in IE. But now I’m worried. You’re telling me that it’s just some unknown thing that sets my IE homepage to a blank page every time I run a check in S&D? It doesn’t make sense to me!!!

[md usa spybot fan]

You’re telling me that it’s just some unknown thing that sets my IE homepage to a blank page every time I run a check in S&D?
I'm telling you that there is absolutely nothing in the log you post that would account for a change to IE's Home Page.

Are you running TeaTimer or any other software that could be preventing the change to IE's Home Page or resetting the change after the change to IE's Home Page?

[SMB1913]

Yes, yes I am actually. I didn’t realize that TeaTimer could prevent IE from changing the home page. How can I fix this?

[md usa spybot fan]

When you change your IE Home Page you should get a TeaTimer dialog message in the following format asking if you want to do an "Allow change" or a "Deny change":
Spybot - Search a Destroy

Spybot - Search & Destroy has detected an important registry entry that has been changed

Category: Browser page
Change: Value changed
Entry: Start Page

Old data: about:blank
New data: whatever (you never indicated)
□ Remember this decision
[Allow change] [?] [Info] [Deny change]
Do an "Allow change".

Your IE Home Page should now be changed. Exit all IE sessions and restart IE to verify that the change actually occurred.

Then refresh TeaTimer's snapshot files to make sure that they are in sync with the registry. To do that:
Right click Spybot's TeaTimer (Spybot-SD Resident) System Tray Icon > click Exit Spybot-S&D Resident.
TeaTimer closes.
TeaTimer's snapshot files are refreshed at this time.

Restart TeaTimer:
Using Windows Explorer, navigate to C:\Program Files\Spybot - Search & Destroy.
Double click TeaTimer.exe to start it.

[SMB1913]

Okay, I tried what you recommended and it worked, until I had S&D run a check and fix problems. So, then what I did was unchecked resident completely from the tools menu inside S&D, changed my homepage to what I want it (www.us.army.mil), restarted my computer (Homepage was still there up to this point) and then had S&D check and fix problems again, then tried to get on IE. It reverted back to Blank. I’m posting the fixed problems report from this time because it has to be something that I’m fixing. The Homepage will stay my homepage as long as I don’t run S&D. come to think of it, this didn’t start happening until I upgraded to IE7. I’m wondering if there’s something in the new version of IE that S&D is fixing. Anyway, here’s the new report.


--- Report generated: 2007-04-01 10:40 ---

CoolWWWSearch.Bootconf: IE start page (Registry change, fixed)
HKEY_USERSS-1-5-21-823518204-261903793-682003330-1003\Software\Microsoft\Internet Explorer\Main\Start Page=about:blank

AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Avenue A, Inc.: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


DoubleClick: Tracking cookie (Firefox: default) (Cookie, fixed)


HitBox: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


HitBox: Tracking cookie (Firefox: default) (Cookie, fixed)


HitBox: Tracking cookie (Firefox: default) (Cookie, fixed)


MediaPlex: Tracking cookie (Firefox: default) (Cookie, fixed)


Zedo: Tracking cookie (Firefox: default) (Cookie, fixed)


Zedo: Tracking cookie (Firefox: default) (Cookie, fixed)


Zedo: Tracking cookie (Firefox: default) (Cookie, fixed)


Zedo: Tracking cookie (Firefox: default) (Cookie, fixed)


Zedo: Tracking cookie (Firefox: default) (Cookie, fixed)


CoreMetrics: Tracking cookie (Firefox: default) (Cookie, fixed)



--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2005-05-31 TeaTimer_original.exe (1.4.0.2)
2007-01-12 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2006-02-06 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2006-02-20 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2007-03-28 Includes\Cookies.sbi (*)
2006-12-08 Includes\Dialer.sbi (*)
2007-03-28 Includes\DialerC.sbi (*)
2007-03-21 Includes\Hijackers.sbi (*)
2007-03-28 Includes\HijackersC.sbi (*)
2006-10-27 Includes\Keyloggers.sbi (*)
2007-03-28 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2007-03-21 Includes\Malware.sbi (*)
2007-03-28 Includes\MalwareC.sbi (*)
2007-03-21 Includes\PUPS.sbi (*)
2007-03-28 Includes\PUPSC.sbi (*)
2007-03-28 Includes\Revision.sbi (*)
2006-12-08 Includes\Security.sbi (*)
2007-03-28 Includes\SecurityC.sbi (*)
2007-03-21 Includes\Spybots.sbi (*)
2007-03-28 Includes\SpybotsC.sbi (*)
2005-02-17 Includes\Tracks.uti
2007-03-21 Includes\Trojans.sbi (*)
2007-03-28 Includes\TrojansC.sbi (*)

[md usa spybot fan]

The following detection appears to be the source of the problem:


CoolWWWSearch.Bootconf: IE start page (Registry change, fixed)
HKEY_USERSS-1-5-21-823518204-261903793-682003330-1003\Software\Microsoft\Internet Explorer\Main\Start Page=about:blank
However I don't quite understand what is happening. The "Start Page" being set to "about:blank" is a perfectly legitimate entry. In fact that is what I have my "Start Page" set to because it makes opening new windows/tabs quicker:


[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="about:blank"
I also do not understand why Spybot is finding the "Start Page" set to "about:blank" when you indicate that your "Start Page" is set to "www.us.army.mil".

I do find several other things vary unusual however. If I attempt to access "www.us.army.mil", I get a Security Alert indicating "You are about to view pages over a secure connection …" even though the site is being access as "http:// " not "https:// ".

Further, I get "Certificate Error: Navigation Blocked" instead of a Web page loading.

Do you have special code loaded to access this site? If so the only thing that I can suggest is that you exclude the detection that I listed above. To do that, run another "Check for problems". When you get the detection that detection:
Expand the detection (+ to the left of the detection).
Select the item (entry) that you want to exclude by left clicking on it to highlight it.
Then right click on highlighted detection.
Select the following from the list of options in the menu.
"Exclude this detection from further searches"

In other words expand the detection (+ to the left of the detection), left click to select then right click to display options. If you don't select (highlight) the item first the options menu is for the entire detection list.