Home page changed

[shail]

Hi,

My home page has got changed to some malicious search page.
The url of the home page is about:blank If i change the
page to some other it reverts to the search page.

I found this entry in the system registry:
HKEY_LOCAL_MACHINE - SOFTWARE - Microsoft - Internet
expolorer - Search : SearchAssistant
(res://%43%3a%5c%57%49%4e%44%4f%57%53%5c%53%79%73%74%65%6d%33%32%5c%66%69%65%67%6a%66%61%2e%64%6c%6c/%73%70%2e%68%74%6d%6c)
If i change the value of the above search assistant, it
gets reset to the value above on its own.

How can i get rid of this problem?

 

[Mark]

Look for a program called Hijacker- it will fix your
problem

 

[Frank Saunders, MS-MVP]

Hi,

My home page has got changed to some malicious search page.
The url of the home page is about:blank If i change the
page to some other it reverts to the search page.

I found this entry in the system registry:
HKEY_LOCAL_MACHINE - SOFTWARE - Microsoft - Internet
expolorer - Search : SearchAssistant
(res://%43%3a%5c%57%49%4e%44%4f%57%53%5c%53%79%73%74%65%6d%33%32%5c%66%69%65%67%6a%66%61%2e%64%6c%6c/%73%70%2e%68%74%6d%6c)
If i change the value of the above search assistant, it
gets reset to the value above on its own.

How can i get rid of this problem?

First, if you don't have WinXP SP2, get LSP-Fix - a free program to repair
damaged Winsock 2 stacks
http://www.cexx.org/lspfix.htm
save it because you might need to repair the Winsock 2 stacks after removing
the culprit.
For WinXP SP2 this command will restore the Winsock stacks if you can't
connect after clearing the malware.
Then see
How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Frank Saunders, MS-MVP IE/OE]

Mr. Saunders

Thank you for your response.

I went to the LSPfix web site. It states that the software repairs the
Winsock LSP when a entry has been improperly removed by and or any
gaps in the chain. I have not removed any entries by hand. It also
says that is not a malware removal utility and does not target
specific products.

Then how do I remove the malware?

Do I still use this software?

You

See the second link. The point is that removing the malware may break
Winsock, so you want to have already downloaded LSPFix.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Guest]

Thank you for the clarification. I appreciate your help.