Home Page Problems

[J]

Okay. So I posted the following problem yesterday and got
the excellent advice to run Ad-Aware along with Spybot, CW
Shredder and HijackThis. I did all of these things, but
now the home page and all the nasty bugger files have come
back with slightly different file names. I had everything
fixed, even ran Ad-aware at start-up and got rid of lots
of bad things, and everything was running fine -- but when
I restarted, it was all back again. My new homepage looks
the same, but instead of being res://hihro.dll... now it's
res://ksmqi.dll... This is annoying as all hell! Does
anyone have any ideas?

Thanks a lot.

J


Hey all.

I have Verizon DSL for my internet and I am using IE for
my browser (Windows 98). Somewhere along the line a site
I was visiting changed my preferred home page to a bogus
search site.... This is really annoying, since not only
does it screw up the home page, but it also sets up mirror
search sites that come up with pages and pages of
additional garbage results when you're searching with
google or yahoo. Everytime I switch the homepage back to
what it should be, this bogus page re-establishes itself
on start-up. I've tried using various programs -- like
Adaware and Spybot -- to find the problem, but they've
come up empty. I've deleted all my old cookies. I've
even gone into msconfig and tried to change the startup
confguration, but there seems to be a lot of stuff in
there that either I can't turn off or that duplicates
itself and turns itself back on in spite of my efforts.
Does anyone have any ideas? I'm fresh out.

Thanks.

 

[Jan Il]

Hi J

Try the following and see if this helps. Follow all instructions carefully.

Setting Home Page - Per Jim Byrd

(Though it's not the only cause, it is currently the most
common) - Sounds like this might be a variant of some malware called
CoolWebSearch (if not, then see AdAware, SpyBot, and HijackThis, below). Do
the following:

Download, UPDATE before running, and run:
http://209.133.47.200/~merijn/files/CWShredder.exe to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: http://www.zerosrealm.com/downloads/CWShredder.zip

You will need to disable System Restore and then reboot your system
in order to clear the CWS garbage from the backups. After rebooting, then
re-enable System Restore.

The following link gives instructions on how to disable it:
http://service1.symantec.com/SUPPOR...sf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl=
Or
http://snipurl.com/6pss

Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Be sure that you also download and install hotfix Q816093, here:
http://support.microsoft.com/?kbid=816093#appliesto

which blocks the exploit upon which this parasite family depends.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions.

However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone

Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix

things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm

If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13
or
http://snipurl.com/6pt3

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Unzip the downloaded HijackThis to any convenient folder, start it then
press Scan. Click on SaveLog when it's finished which will create
hijackthis.log. Now click the Config button, then Misc Tools and click on
Generate StartupList.log which will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949
or
http://snipurl.com/6pt4

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).

Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended

Hope this helps.

Jan

 

[H Leboeuf]

It's a new variant of CWS.
How you know you have it : When you start up Internet Explorer it takes a
few seconds to load and in the address bar it starts with res://<Random
..dll>

It's a nasty one and I suggest you get help from the HijackThis forum.
HijackThis will identify it and will not correct the problem. You need to
follow the instructions that you will received from the experts.

 

[Jan Il]

It's a new variant of CWS.
How you know you have it : When you start up Internet Explorer it
takes a few seconds to load and in the address bar it starts with
res://<Random .dll>

It's a nasty one and I suggest you get help from the HijackThis forum.
HijackThis will identify it and will not correct the problem. You
need to follow the instructions that you will received from the
experts.

Thank you very much Henri, I was not aware of this new variant.

Jan

 

[Steve Parry [MVP]]

Okay. So I posted the following problem yesterday and got
the excellent advice to run Ad-Aware along with Spybot, CW
Shredder and HijackThis. I did all of these things, but
now the home page and all the nasty bugger files have come
back with slightly different file names. I had everything
fixed, even ran Ad-aware at start-up and got rid of lots
of bad things, and everything was running fine -- but when
I restarted, it was all back again. My new homepage looks
the same, but instead of being res://hihro.dll... now it's
res://ksmqi.dll... This is annoying as all hell! Does
anyone have any ideas?

Thanks a lot.

J


Hey all.

I have Verizon DSL for my internet and I am using IE for
my browser (Windows 98). Somewhere along the line a site
I was visiting changed my preferred home page to a bogus
search site.... This is really annoying, since not only
does it screw up the home page, but it also sets up mirror
search sites that come up with pages and pages of
additional garbage results when you're searching with
google or yahoo. Everytime I switch the homepage back to
what it should be, this bogus page re-establishes itself
on start-up. I've tried using various programs -- like
Adaware and Spybot -- to find the problem, but they've
come up empty. I've deleted all my old cookies. I've
even gone into msconfig and tried to change the startup
confguration, but there seems to be a lot of stuff in
there that either I can't turn off or that duplicates
itself and turns itself back on in spite of my efforts.
Does anyone have any ideas? I'm fresh out.

Thanks.

also check

http://www.akadia.com/services/about_blank_virus.html