This question was answered earlier today, and I'll copy
and paste some of the answers for you.
----------------------------------
Subject: Re: Setting Homepage
Wrom: LYRWTQTIPWIGYOKSTTZRCLBDXRQBGJSNBOHMKHJYFMY
12/28/2003 6:38:38 AM
Hi,
I guess you have been hijacked. Try HijackThis -
http://tomcoyote.org/hjt/
Kind regards
Hans Le Roy
MS MVP Win/IE-OE
-----------------------------------
Subject: Re: Setting Homepage
Wrom: XOEAIJJPHSCRTNHGSWZIDREXCAXZOWCONEUQZAAFXISHJEXX
12/28/2003 8:31:40 AM
Hi Richard - This is a CoolWebSearch variant. Do the
following:
Download and run:
http://www.merijn.org/files/cwshredder.zip to remove the
parasite. Be sure to close all instances of IE and OE.
Alwasys download a
fresh copy as this program is updated frequently.
Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg
to restore your
tabs and remove any restrictions that the parasite has put
in place.
However, this also indicates that you may have acquired
some other malware
along the way. If you go to this page at Jim Eshelman's
site, here:
http://aumha.org/a/noads.htm and wait a little bit (be
patient), an analysis
of a number of possible parasites on your machine will be
made to help you
identify and remove them. NOTE: You will need to disable
Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software
which interferes
with Java Scripting for this scan to work. You should get
a message between
the two lines of **** giving the results of the scan.
Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. Update and
run this regularly
to get rid of most "spyware/hijackware" on your machine.
If it has to fix
things, be sure to re-boot and rerun AdAware again and
repeat this cycle
until you get a clean scan. The reason is that it may
have to remove
things which are currently "in use" before it can then
clean up others.
Another excellent program for this purpose is SpyBot
Search and Destroy
available here:
http://security.kolla.de/ SpyBot Support
Forum here:
http://www.net-integration.net/cgi-
bin/forums/ikonboard.cgi. I recommend
using both normally. After fixing things with SpyBot S&D,
be sure to
re-boot and rerun SpyBot again and repeat this cycle until
you get a clean
"no red" scan. The reason is that SpyBot sometimes has to
remove things
which are currently "in use" before it can then clean up
others.
Note that sometimes you need to make a judgement call
about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm
Once you get this cleaned up, you might want to consider
installing the
SpywareBlaster and SpywareGuard here to help prevent this
kind of thing from
happening in the future:
http://www.wilderssecurity.com/spywareblaster.html
(Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory
resident ... no CPU or
memory load - but keep it updated) The latest version as
of this writing
will prevent installation or prevent the malware from
running if it is
already installed, and it provides information and fixit-
links for a variety
of parasites.
http://www.wilderssecurity.net/spywareguard.html (Monitors
for attempts to
install malware) Both Very Highly Recommended
