hijacked browser - HELP!

[poor schmuck]

Something has taken over the default page on my browser.
It sends me to a shady search site.

When I go to Tools>>Internet Options>>Home Page, I can
reset it, but when I restart the computer the BS site is
back again.

If I click Use Default, it's the URL for the site:
http://in.webcounter.cc/%
2d/?%79%64%74%66%73
It has been set as the Default! (It shows up as
http://fastsearch.cc/ydtfs/ in the browser address line.)

When I go to Tools>>Internet Options>>Programs and click
Reset Web Settings, the Home Page goes back to Microsoft,
but the BS site is still the Default, and if I restart the
computer I'm back to square one.

How do I get rid of this damn thing?

Please reply by email: (e-mail address removed)

Thanks.

 

[Kevin]

Has it occurred to you to do a Google search for hijackers? Use HiJack
This! to find and remove the hijacker.

 

[siljaline]

Something has taken over the default page on my browser.
It sends me to a shady search site.

When I go to Tools>>Internet Options>>Home Page, I can
reset it, but when I restart the computer the BS site is
back again.

If I click Use Default, it's the URL for the site:
http://in.webcounter.cc/%
2d/?%79%64%74%66%73
It has been set as the Default! (It shows up as
http://fastsearch.cc/ydtfs/ in the browser address line.)

When I go to Tools>>Internet Options>>Programs and click
Reset Web Settings, the Home Page goes back to Microsoft,
but the BS site is still the Default, and if I restart the
computer I'm back to square one.

How do I get rid of this damn thing?

Please reply by email: (e-mail address removed)

Thanks.

http://www.symantec.com/avcenter/venc/data/adware.searchcounter.html

HTH

--
siljaline

MS - MVP Windows IE/OE
______________________

(Reply to group, as return address
is invalid - that we may all benefit)

 

[James]

-----Original Message-----
Something has taken over the default page on my browser.
It sends me to a shady search site.

When I go to Tools>>Internet Options>>Home Page, I can
reset it, but when I restart the computer the BS site is
back again.

If I click Use Default, it's the URL for the site:
http://in.webcounter.cc/%
2d/?%79%64%74%66%73
It has been set as the Default! (It shows up as
http://fastsearch.cc/ydtfs/ in the browser address line.)

When I go to Tools>>Internet Options>>Programs and click
Reset Web Settings, the Home Page goes back to Microsoft,
but the BS site is still the Default, and if I restart the
computer I'm back to square one.

How do I get rid of this damn thing?

Please reply by email: (e-mail address removed)

Thanks.

.

To fix best resolve ur issue their are not ways .

first :->> Please delete all the host files from your
computer

Here are the steps for same:

1) From the Start menu on your computer, click Search. (In
some versions of Windows®, you must click Find.)

2) Select All files and folders. (Some versions of Windows
list this option as Files or Folders.)

3) Type "hosts" (without quotation marks) in the file name
box and click Search. (Some versions of Windows list this
as Find Now.)

4) Once you locate the "hosts" file within your Windows or
WINNT directory, right click the file and click Delete.


Second way:-- You have to contact Internet Explorer
support team as search page may have entered in your
registry settings.

Here is the page to contact Internet Explorer:

http://support.microsoft.com/default.aspx?scid=fh;en-
us;prodoffer16


Please contact reply me once your issue is resolved.

EMAIL ADDRESS:-- (e-mail address removed)


Thank you

James

 

[Mike Burgess]

Hi,
"in.webcounter.cc" = CWS.Tapicfg.2 (coolwebsearch trojan)

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-08-03]
Please post replies to this Newsgroup, email address is invalid

 

[Original Poor Schmuck - I mean poster]

I found something that seems to have worked. I searched
for http://fastsearch.cc/ydtfs/ on Google, and found a
German newsgroup where someone suggested the following:

Cool Web Shredder at
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Seems to have worked. Thanks everyone.

 

[Poor Schmuck]

I just noticed Mike Burgess below is linking to the same
fix I found on http://mvps.org. FYI, his site looks
pretty good. Lots of useful info on these creepy
crawlies. Thanks Mike.

 

[H Leboeuf]

It's this parasite, get the removal tool.

CoolWebSearch - CWS http://www.spywareinfo.com/articles/cws/
More: Complete list by variant with up-to-date information.
http://www.merijn.org/cwschronicles.html
Moreirect Download: Removal tool.
http://www.merijn.org/files/cwshredder.zip

 

[siljaline]

I found something that seems to have worked. I searched
for http://fastsearch.cc/ydtfs/ on Google, and found a
German newsgroup where someone suggested the following:

Cool Web Shredder at
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Seems to have worked. Thanks everyone.

Hi,

Merijn has changed his website address.
The CWShredder is available here: http://www.merijn.org/files/cwshredder.zip

Unzip the tool, close all instances of IE and OE, hit the executable and
follow the prompts.

Regards,


--
siljaline

MS - MVP Windows IE/OE
______________________

(Reply to group, as return address
is invalid - that we may all benefit)

 

[Mike Burgess]

Poor Schmuck,
Thanks for the compliment! ..... glad you found it useful.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-08-03]
Please post replies to this Newsgroup, email address is invalid
--