December 26, 2003

8:04 AM

Computing at the in-laws .... Since they don't know what their ISP password is, I'm forced to do all my web work (I'm telecommuting today) using their Windows machine. The central vagary I'm confronted with is that they have somehow let IE 6.0 for Windows XP become overrun from one of those "Do you want to set your homepage to ...?" sites, and not only has it installed itself as their homepage, but anytime you put a URL in the address bar that's not proceeded by an http:// or www., it redirects you to their shitty find4u.net page. I've changed the homepage to Google, but how can I liberate the address bar?
posted by blueshammer to (15 comments total)

Spybot or Ad-aware.
posted by eyeballkid at 8:08 AM on December 26, 2003

blueshammer, I know you didn't ask, but there are many password recovery tools out there, so you can use your own computer with their connection.
posted by signal at 8:17 AM on December 26, 2003

After you Ad-Aware the machine, give them the gift that keeps on giving:

Open their Internet Preferences, disable everything ActiveX and plugin-related, install Mozilla Firebird, and make it their default browser. You could even install the Luna Theme to make them feel more at home.

Walk them through the browser's features, show them how to use tabs, and they'll likely thank you for saving them from themselves (soon, if not immediately.) If it sounds like I have relatives that required this sort of intervention, well...
posted by Danelope at 8:32 AM on December 26, 2003

Eyballkid gives good advice. I'd go with Spybot of the two. Take the time and spend 30 min and teach them what it does and to update it.

If they can tolerate using it, Danelope's advice to switch them out of Microsoft for web (I'd add email to that also) is probably good for their security. Also, explain simply but directly what you're doing and why.

I find that retention rate for safety/security practices skyrockets if you explain what the changes are for. Otherwise users will continue to reinstall that spyware infested and crash-prone screen saver that you keep uninstalling. If possible leave them a list to go through every month to update things.
posted by rudyfink at 8:41 AM on December 26, 2003

I suppose the irony of you Mozilloids highjacking your inlaws computers and installing your preferred browser instead of the one they know and are comfortable with escapes most of you, doesn't it? Because, it's patently obvious that you know what's best...

For the non-computer-literate family member, the best favor you can do them is to teach them how to use the computer they have, not the computer you wish they had. Teach them how to leave Windows Update on. Teach them how to recognize when there's an update to be installed. Teach them how to use SpyBot, or some other product that can help protect them.

(FWIW, SpyBot is deeper and more thorough than AdAware, so it's more likely to find all the annoyances at one pass (albeit, a longer one) than multiple passes with AdAware).
posted by JollyWanker at 8:55 AM on December 26, 2003

Jolly, us Mozilloids are merely doing the same thing you're suggesting. You suggest turning them on to SpyBot; we're turning them on to Mozilla because it is a better browser and will help prevent some of their problems. They know and are comfortable with IE because they don't know anything else, just like they don't know about SpyBot.
posted by strangeleftydoublethink at 9:08 AM on December 26, 2003

Because, it's patently obvious that you know what's best...

Frankly, in this arena, yes. If you can successfully encourage and guide them through the differences between browsers, they will undoubtedly be better off in the long run. Regardless of their knowledge of Windows Update and spyware-removal utilities, Internet Explorer is an inherently insecure browser, whose enabled-by-default approach to security led to these problems in the first place.

If you leave ActiveX's (and Outlook's, and Windows') gaping security holes exposed, their machine will inevitably be overrun with spyware, malware, viruses, trojans, and soforth. If you are in this situation and want your relatives' machines to continue operating properly, you have two choices: either disable everything required to be secure (severely crippling their browser and Internet experience in the process) or show them viable, secure alternatives.

Yes, it may take some accomodation, but it significantly reduces the chances of their machine being rendered useless to them. Little kids don't like going to the doctor and getting poked with needles, but it's worth the few shed tears to ensure their health further down the road.
posted by Danelope at 9:24 AM on December 26, 2003

And what will you do about the thousand natural shocks Windows is heir to that are not IE related? Why not teach them how to use the machine they have, and use it as safely as Microsoft can make it for them - or get it over with and install some more secure alternative? You can't stop at the browser (and, I suppose, the email client) and call it a winner - that's just the sort of prejudicial IE-bashing that frankly, most Mozilla cheerleading tends to sound like. If your concern is truly for their secure computing welfare, the root of the problem is Windows, not IE, and the respondents above would appear to be smart enough to know that. Don't let your lusty hatred of all things Redmond blind you to the fact that for millions of users, Windows Update is a timely and effective way of managing the vast majority of problems that get sprayed all over the news because too many people have inlaws who know computers and tell them to turn Windows Update off...
posted by JollyWanker at 9:33 AM on December 26, 2003

And that supreme confidence that Mozilla will never, ever, ever have any exploitable security hole could make you look pretty silly at some point.

Give them the car analogy. Just as you can't drive a car and expect it to behave without maintenence, you can't use a computer and not maintain it.

Then, teach a man to fish: Teach them to use Windows Update, anti-virus and Spybot. Their browser of choice: Teach them to use it safely. Teach them how to update them all.

Unless you want to be tech support for them 24/7, don't go around turning their computer into your computer.
posted by sageleaf at 9:52 AM on December 26, 2003

It's a holiday weekend. While it would be nice to get the inlaws switched to a secure OS, the reality is that they, like the majority of users, have a Redmondized PC and that isn't going to change any time soon. In keeping with the time frame and learning curve realities that are being faced here, the best choice at the moment is to lessen the reliance on the primary means of infestations that compromise their computer's security and operations, and those means are IE and Outlook. "(I)nstall some more secure alternative" at this point in time really only means Mozilla.

So long as someone sets everything up for them, importing bookmarks, e-mail and addresses, setting up their POP account, desktop shortcuts and so forth, then takes the time to teach them the simple and minor differences in usage, the switch can be well-managed and it will make an important difference. That's what matters.

This isn't about browser wars or OS wars, this is about making blueshammer's in-laws' computing experience more pleasant, practical and safe all the way around. The "do it all or do nothing" approach isn't a solution, it's a platitude. Why teach a man to fish with the stick and string someone left beside the lake when he coud easily and quickly have an authentic rod and reel with some hi-test line?
posted by Dreama at 10:05 AM on December 26, 2003

I introduced my Dad to Opera, The Bat and Ad-aware a few months ago. Support calls from him have dropped dramatically.
posted by signal at 10:26 AM on December 26, 2003

To the above suggestions, I would add this tune-up program.
posted by JohnR at 11:26 AM on December 26, 2003

Blueshammer, here is what has happened to your system. You have probably visited a site that had a malicious javascript that infected your system.

Browsers are hijacked in several ways. First they modify the registry to hijack your home page. To eliminate this use regedit to find anything with find4u in it and delete it. You can then set your own home page.

Second, to hijack your address bar they modify your hosts file. "Hosts" is a text file found deep in your windows directory, but you can find it using Search. For most PCs there will be no lines or just one line. When you enter a URL in the address bar Explorer first looks in the hosts file for a match and if it finds a match, uses the IP address there to load the page. Normally there is nothing there so the browser then goes to the DNS server at your ISP to look up the real IP address for the URL. The hijacker puts a lot of entries in the hosts file for common sites like google, cnn, msn, yahoo, etc (hopefully not metafilter) all with an IP address pointing to find4u instead of the real address. You can edit the hosts file and delete all of these false entries or comment them out with #.

If you are uncomfortable with editing the registry and hosts file you should download the freeware program HijackThis which you can find many places using google. It will scan for lots of common hijacks and allow you to selectively delete anything that looks suspicious.

If this is all you do you will probably find that the problem recurs as soon as you reboot again. This is because they have installed a program that runs at startup to reinstall all of the hijacking again. You have to find and delete that program. Usually there is a shortcut in the Startup directory of your Start menu. You will have to go into each user directory under C:\Documents and Setting\each user\StartMenu\Programs\Startup. This directory contains programs that are automatically started each time you reboot. Look to see if there is anything suspicious there. Particularly pay attention to anything with recent file timestamps.

In the case of find4u, some people report that the offending file is winlogin.exe. If you do a search you may find two files with that name. One is 23K and the other is 505K. The 23K one is the culprit. Rename it to something like winlog.exe.foo or whatever so that it can't execute.

Remember that it is safer to rename or comment out stuff you aren't really sure of rather than deleting. That way you can restore it if necessary.

You can usually find solutions to common hijack problems just by googling the offender's name, for example, find4u. Since lots of people are similar victims, you will find lots of links to fixes.

If you install the XP updates that should solve your vulnerability to future malicious javascripts.

Good luck. Think of it as a detective game, if that helps.
posted by JackFlash at 1:27 PM on December 26, 2003

And that supreme confidence that Mozilla will never, ever, ever have any exploitable security hole could make you look pretty silly at some point.

I don't see that "supreme confidence" anywhere but in your imagination. But if Mozilla is exploited less over time than MSIE is, then it's an improvement. <cheap shot>(And consider that Microsoft thinks that even using the "back" button means you're just asking to be hacked...)</cheap shot> Certainly blueshammer should be willing to change their browser back to MSIE if they don't like Firebird, but odds are they haven't even looked at any other browsers, and might well prefer Firebird.
posted by hattifattener at 10:31 PM on December 26, 2003

Usually there is a shortcut in the Startup directory of your Start menu. You will have to go into each user directory under C:\Documents and Setting\each user\StartMenu \Programs\Startup.

This isn't very good advice (or is at least incomplete), as it misses the ways that most programs establish themselves to 'run on startup' - via the registry.

Use a tool like this instead, with care.
posted by stavrosthewonderchicken at 10:49 PM on December 26, 2003