Internet Explorer home page still blocked

[Pascal]

Hello,
I don't know since when the following problem has appeared on my computer, I realized just a few days ago: my Internet Explorer home page is blocked to 'http://www.gahooyoogle.com/', I cannot change it through the tools/internet options menu.

I have Spybot S&D v1.4 installed, and no problem is reported in 'default' mode.
I have Zone Alarm firewall and Norton antivirus installed and up to date. I scanned the system, no problem reported.
I am administrator on the PC.

After some reading on the WEB - I have just joined this forum because of this issue:
1) I tried to change it in the registry (HKEY_CURRENT_USER > software > microsoft > internet explorer > main > start page : but any change is not effective (I get the message 'cannot edit start page: error writing the new value's contents')

2) I tried in the S&D advanced mode (I never accessed this mode before) to do the following: in the Tools, I ticked the 'Browser Pages' menu item, and inside this menu I tried to change the home page URL and clicked 'ok' but nothing changed. The home page address stays the same and I don't get any error message either.

What do I need to do to resolve? Is there anything else that would be damaged?
By the way, I have also downloaded the 'HijackThis' software, but not installed it yet.

Thanks for your precious help, I am a beginner in this.

Regards

Pascal

[tashi]

Hello.

Please follow the instructions in this sticky topic:
BEFORE you post and who will advise you. Preliminary Steps
Copy paste the logs into this topic and a helper will take a look at the system as soon as available.

Cheers.

[tashi]

This topic is closed.

If you need it re-opened please send me a pm and provide a link to the thread.
Applies only to the original topic starter.

[tashi]

Re-opened topic.

[Pascal]

Hello,
I have done as you required.
1) The on-line anti-virus scan (Panda) is clean - see Panda.zip

2) The Spybot S&D scan in safe mode is clean - see Spybot.zip
Note: I have also tried to activate the 'Teatimer' flag as I understand this is advised. Can you confirm I should do it?
Also, I have tried to activate the 'SDHelper' flag, but there I receive a meesage I cannot read (the bottom of the message 'Spybot SDHelper issue.zip' is not displayed!), and I cannot activate the flag. What should I do?

3) I attach the Hijackthis log file

4) Besides, talking to a friend who had a similar issue, I installed and ran Ad-aware in safe mode. 34 objects were found and should have been removed (I asked to remove them). I also attach the log. Note that (is this normal?) I cannot see the scan result / log when running ad-aware again in Windows normal mode.

After all this, the issue still remains. Thanks a lot in advance for your help

Regards

Pascal

[LonnyRJones]

Hi Pascal

There was a recent ZA update that interfears with changing your homepage, i suggest you post about it at there forums, perhaps they will fix it sooner.

Can you explain the Tea timer and Sdhelper problem in more detail please ?

[Pascal]

Hello,
you were right ! By pure coincidence, when I started reading your mail, I received a ZA notification for update. I did install the update, and the problem is resolved!

Now for what concerns Tea timer and Sdhelper:
- tea timer seems to be ok. Can you please reconfirm whether I should use it or not and why?
- sdhelper: when I activate it, the message here below attached pops up: I cannot read the bottom of the message, it is simply not displayed, I don't know why.
Can you please reconfirm whether I should use it or not (if yes, which option that I cannot read properly should I select from the pop up message), and why?

Thanks again

Pascal

[LonnyRJones]

Hi
Great

I think your confusing sdhelper and Tea timer
Please see this writeup for an explination of both
http://forums.spybot.info/showthread.php?t=281

also see "Solution to fix the pop-ups in TeaTimer" http://forums.spybot.info/showthread.php?t=122

[Pascal]

Hi again,
thanks for the links.

I have fixed the Tea Timer pop up issue - great.

For the SDhelper, the description indicates that there are three selectable modes that this can operate in: (1) Block all pages silently (2) Display dialog when blocking (3) Ask for blocking confirmation.
But I only see a check box to select or unselect SDHelper. Where are the modes to choose from?

Regards

Pascal

[LonnyRJones]

Hi

Check on the immunization page

Think Prevention:
Put in place a good hosts file
http://www.mvps.org/winhelp2002/hosts.htm
How To Download and Extract the HOSTS file:
http://www.mvps.org/winhelp2002/hosts2.htm
Repeat that proccess about once or twice a month

To help avoid reinfection see "So how did I get infected in the first place?"
http://forums.spybot.info/showthread.php?t=279