homepage changes with startup

[Guest]

When I start my computer and go on line my homepage sympatico is changed to mshp.dll/index.html#.......
I change it back to the correct homepage and it stays, but next time I restart my computer it is changed again.

 

[Frank Saunders, MS-MVP]

When I start my computer and go on line my homepage sympatico is
changed to mshp.dll/index.html#........
I change it back to the correct homepage and it stays, but next time
I restart my computer it is changed again.

mshp.dll = coolwebsearch trojan
How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Guest]

I found the offending file in windows folder.I put mshp.dll in recycle bin and when I restarted my computer my home page was correct. The site you gave me gives a list of files. I will see if I have any others

 

[Frank Saunders, MS-MVP]

I found the offending file in windows folder.I put mshp.dll in
recycle bin and when I restarted my computer my home page was
correct. The site you gave me gives a list of files. I will see if I
have any others

Thanks for the feedback.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Guest]

Looks like the shredder might be the answer. mshp.dll is back after 2 startups. My Mcaffe cant block it either.

 

[Mike Burgess]

ladan,
Thanks for the feedback, however CWShredder is ONLY a preliminary
tool to be run prior to running Ad-Aware and\or SpyBot.

Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 03-15-04]
Please post replies to this Newsgroup, email address is invalid
--

I took your advise and got the shredder.My computer hasn't run this smooth

in months. Thanks

 

[Guest]

Do you mean these specific programs or could I use McAffe Secure IE

 

[Frank Saunders, MS-MVP]

Do you mean these specific programs or could I use McAffe Secure IE

Those specific programs. McAfee is designed for viruses, not hijackware.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Guest]

I wish I didn't get up this morning!!! I did my virus scan and I have 6 Quarantined files so far so I stoped the scan for the moment. They are; SP1RcvryFix.exe( I think that is my HP patch), 24WWWSP1.exe.(isn't that my update?), FondleWindow.exe (sounds important), activeinstaller(2)dll, istdnld.exe and msiesh.dll.Before I restore these how can I check that these are valid programs? Thanks

 

[Mike Burgess]

Landan,

"They are; SP1RcvryFix.exe( I think that is my HP patch), "

Yes it is, why would your AV detect that file?
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q329450

"24WWWSP1.exe.(isn't that my update?)"

Yes it is, comes from the same update as above.

FondleWindow.exe = another HP file
--
activeinstaller.dll = Parasite.RapidBlaster
istdnld.exe = Trojan ISTBar
msiesh.dll = TROJ_IEFEATS.A
--
First run RapidblasterKiller (see below)
Next, run CWShredder
Then run SpyBot
Then run HijackThis and post your log

Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 03-15-04]
Please post replies to this Newsgroup, email address is invalid
--

I wish I didn't get up this morning!!! I did my virus scan and I have 6

Quarantined files so far so I stoped the scan for the moment. They are;
SP1RcvryFix.exe( I think that is my HP patch), 24WWWSP1.exe.(isn't that my
update?), FondleWindow.exe (sounds important), activeinstaller(2)dll,
istdnld.exe and msiesh.dll.Before I restore these how can I check that these
are valid programs? Thanks

 

[Guest]

First I adjusted McAffe to include; MIME/UUE ncoded & OLE objects.When I saw my SP1 and patch ect.(not sure why they were picked up) I stopped the scan.I restored the 3 programs but the other 3 are still in quarantine,I can just delete them. Next I used my AD-WARE6 as recommened I have quite a list. When I used CWShedder the day before it removed alot aswell. I went back to pick up RBlaster Killer but I get an error message HTTP404 not found will try again later.

 

[Guest]

I ran RapidBlasterKiller and it didn't detect anything on my computer.I will readup on Spybot a bit more. It's quite a learning experiece for me.