ehttp.cc/?URL added to address

[Rich]

I have an XP machine that has a unique problem with some
web addresses. If I type http://www.google.com it works
fine. However, if I type www.google.com it changes it to
http://ehttp.cc/?www.google.com. This machine had
several trojans and viruses but they have been cleaned
and deleted. This only happens with some sites (google
and yahoo primarily. Already reset the Explorer options
to default. Any suggestions as to where the problem
might be?

 

[Frank Saunders, MS-MVP]

I have an XP machine that has a unique problem with some
web addresses. If I type http://www.google.com it works
fine. However, if I type www.google.com it changes it to
http://ehttp.cc/?www.google.com. This machine had
several trojans and viruses but they have been cleaned
and deleted. This only happens with some sites (google
and yahoo primarily. Already reset the Explorer options
to default. Any suggestions as to where the problem
might be?

First eliminate any scumware.
See
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Note that AdAware and SpyBot S & D will each catch some things the other
won't. Also, each needs to be updated before every use, even when just
downloaded. There's also a lot more to do than just those two programs.
CWShredder is also available here:
http://www.kellys-korner-xp.com/regs_edits/cwshredder.zip
**Post your HijackThis log to
http://forums.spywareinfo.com/ or the Spyware forum at
http://forum.aumha.org/ for expert analysis, not here.**
Alternative download pages for Ad-Aware, Spybot, HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.
If trying everything at that site does not fix the problem please post back
in the same thread.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Mike Burgess]

Rich,
ehttp.cc = Coolwebsearch trojan

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 03-09-04]
Please post replies to this Newsgroup, email address is invalid