China DOS Union

How to set it so that it can't be modified after being set, since the homepage is always being modified?

[ Last edited by HAT on 2008-10-22 at 10:46 ]

Prevent modifying the IE homepage through "Internet Properties"

reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\internet explorer\control panel" /v homepage /t reg_dword /d 1 /f

If it can be locked, it can be unlocked, unless you monitor it in real time.

Setting read-only permissions for the registry entries in the second floor would be better, at least ordinary malicious websites can't change them. Completely change the browser (but it can't be absolutely safe because there is only relative safety.)

Prohibited from modifying the IE homepage through "Internet Properties"

This is a restriction set manually.

Directly modifying the registry, you still need to remove it and run a setting to set an empty homepage, which is troublesome for yourself. Modifying some keys, changing the homepage here is useless...

You can add parameters to the IE shortcut in the quick launch to set your own homepage. I use the -nohome parameter

It's caused by a virus or malware,

Using BAT is not powerful enough.

Why not add a "Restore IE Home Page" button?

@echo off



If exist %windir%\startpage.reg (

echo The "Restore IE Home Page" button will be deleted&echo.&pause

del %windir%\startpage.reg

del %windir%\RestoreStartPage.lnk

reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{8515FC11-B332-447E-8056-1197551CFDB4}" /f

exit

) 



>%windir%\startpage.reg echo Windows Registry Editor Version 5.00

>>%windir%\startpage.reg echo. 

>>%windir%\startpage.reg echo 

>>%windir%\startpage.reg echo "Start Page"="http://www.google.cn"



>%windir%\creatlink.vbs echo set WshShell = WScript.CreateObject("WScript.Shell")

>>%windir%\creatlink.vbs echo set oShellLink = WshShell.CreateShortcut("%windir%\RestoreStartPage.lnk")

>>%windir%\creatlink.vbs echo oShellLink.TargetPath = "regedit.exe"

>>%windir%\creatlink.vbs echo oShellLink.Arguments = "/s startpage.reg"

>>%windir%\creatlink.vbs echo oShellLink.Save



start creatlink.vbs



reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{8515FC11-B332-447E-8056-1197551CFDB4}" /f /v "Icon" /t REG_SZ /d "shell32.dll,255"

reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{8515FC11-B332-447E-8056-1197551CFDB4}" /f /v "HotIcon" /t REG_SZ /d "shell32.dll,255"

reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{8515FC11-B332-447E-8056-1197551CFDB4}" /f /v "ButtonText" /t REG_SZ /d "Restore IE Home Page"

reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{8515FC11-B332-447E-8056-1197551CFDB4}" /f /v "Default Visible" /t REG_SZ /d "Yes"

reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{8515FC11-B332-447E-8056-1197551CFDB4}" /f /v "Exec" /t REG_SZ /d "RestoreStartPage.lnk"

reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{8515FC11-B332-447E-8056-1197551CFDB4}" /f /v "CLSID" /t REG_SZ /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"



del %windir%\creatlink.vbs

Clicking the button will modify the value of "Start Page" under "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main".

After running, right-click the toolbar → Customize, and find that button.

Check if there is this item:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEXPLORE.EXE

[ Last edited by tireless on 2009-1-20 at 18:52 ]

-

[ Last edited by tireless on 2009-1-20 at 18:51 ]

What does this mean if there is this entry?

Google search "image hijacking"

What process is this??