Homepage keeps on changing on its own to 'searchcentral.cc

[Haroon]

Hello,

There's something in my xp system which keeps on changing my hompage to
'www.searchcentral.cc' which happens most times i restart my computer and
also after a few hours my pc is on without even a restart. I installed a
program called startpage gaurd which locks the himepage, but even that
didnt do the trick and reported that the homepage had been changed by may
what be a malicious worm, trojan or internal script. I ran the Trend Micro
systems virus checker and it found nothing. Also ran ad-aware and that
found nothing. Also, there's no extra programs in my add/remove folder
which might be doing this. So what should i do?

Thanks,
Haroon

 

[Marc Reynolds [MSFT]]

This problem may be caused by a program that is installed on your computer
when you download another program from the Web and install it on your
computer. These programs are typically referred to as <Adware> or
<Spyware>.

To resolve this problem, you must remove the offending program. However,
many of these programs can be difficult to remove. You can use a Spyware
or Adware removal program to remove the offending program from your
computer.

Some Spyware or Adware can be removed by antivirus software. Contact the
manufacturer of your antivirus software for more information about removing
Spyware and Adware.


Some of the companies that provide Spyware or Adware removal programs
include:
- Javacool Software - For more information, visit the Javacool Web site
at: http://www.wilderssecurity.net/specialinfo/rapidblaster.html
- Lavasoft - For more information, visit the Lavasoft Web site at:
http://www.lavasoftusa.com/
- Pest Patrol - For more information, visit the Pest Patrol Web site
at: http://www.pestpatrol.com/
- Spybot - For more information, visit the Spybot Web site
at:http://www.safer-networking.org/



For more information about ways you can help to protect your computer,
visit the Protect Your PC Web site at
http://www.microsoft.com/security/protect/default.asp

For more information about ways you can use your computer to browse the
Web and help make your Web browsing a more enjoyable experience, visit the
Surfing securely with IE 6 Web site at
http://support.microsoft.com/defaul...de/en-gb/secureie.asp#XSLTSection126121121120



--

Thanks,
Marc Reynolds
Microsoft Technical Support

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Tia]

You must go to your registry (run>regedit) and go to windows>internet
explorer, then do a search for 81.211.105.43 (thier IP) and then
delete the registry entry that switches the home page (it'll be
obvious).

It is annoying! Did you download Kaaza? That is where I think it
originated. Good luck.

 

[Tia]

You know, I sent you a reply earlier, but there's more....the registry
entries seem to be originating from a javascript file in
c:\windows\update12.

I deleted that and now it works! I am not a "techie" so pardon my
first response which wasn't very helpful.

T

 

[roger]

Hello Haroon,

Download the utility CWshredder:
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Unzip - close *all* instances of IE & OE, hit the executable and
follow
the prompts.


You can also download Hijack This from here:

http://www.mjc1.com/files/merijn/hijackthis.exe

Go here:

http://mjc1.com/mirror/hjt/

For instructions on how to use it; you have to post the log it
produces so experts tell you what is good and what is malware

If these don't correct the problem, then get yourself a copy of
BHODemon, available at
http://www.definitivesolutions.com/bhodemon.htm .

It does not need installing - simply unzip and run the EXE program. It
is easy to use. It will find the hijackware DLL files, and give you
the ability to disable them.

Good luck, hope this helps.

 

[Haroon]

(e-mail address removed) (Tia) wrote in

You must go to your registry (run>regedit) and go to windows>internet
explorer, then do a search for 81.211.105.43 (thier IP) and then
delete the registry entry that switches the home page (it'll be
obvious).

It is annoying! Did you download Kaaza? That is where I think it
originated. Good luck.

I did all that, removed the entires, only to find that the next day they
were back again. After deleting them again, I used CWShredder which
roger recommended and that found 3 more entries which are now removed, so
hopefully that should be it.

I run kazaalite, but i'm fairly sure that it came as i was searching for
a serial key for a prgram on a warez site.

 

[Dave]

I had this issue, and a java script was being called to keep resetting
this from the run once in registry, the file was named: update12.js

Dave

 

[Kelly]

Hijack This
http://www.spychecker.com/program/hijackthis.html

Free Online Virus Scan
http://housecall.trendmicro.com/housecall/start_corp.asp

 

[Richard Grzeszkiewicz]

I had this issue, and a java script was being called to keep resetting
this from the run once in registry, the file was named: update12.js

Dave

Out of all the crap I have read and tried from here.
Yours works.

Richard