Finding Running Scripts

[Guest]

How do I find scripts running in IE6? I think I have a worm that changes my home page. I correct it, but it's changed again within minutes. The same worm will not let me type only the domain (microsoft.com) in the address bar. If I try, it brings up it's own page. It forces me to type the full URL (http://..........) to get to the page I want. This is very irritating. I've eliminated running processes, so that leaves a script. I saw them once before but can't find them now. Can anyone help me

Ted

 

[Frank Saunders, MS-MVP]

How do I find scripts running in IE6? I think I have a worm that
changes my home page. I correct it, but it's changed again within
minutes. The same worm will not let me type only the domain
(microsoft.com) in the address bar. If I try, it brings up it's own
page. It forces me to type the full URL (http://..........) to get
to the page I want. This is very irritating. I've eliminated
running processes, so that leaves a script. I saw them once before
but can't find them now. Can anyone help me?

Ted

First eliminate any scumware.
See
Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
especially
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note that AdAware and SpyBot S & D will each catch some things the other
won't. Also, each needs to be updated with the program's update function
before every use, even when just downloaded. There's also a lot more to do
than just those two programs. CWShredder is also available here:
http://www.kellys-korner-xp.com/regs_edits/cwshredder.zip
**Post your HijackThis log to
http://forums.spywareinfo.com/ or the Spyware forum at
http://forum.aumha.org/ for expert analysis, not here.**
Alternative download pages for Ad-Aware, Spybot, HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.
If trying everything at that site does not fix the problem please post back
in the same thread.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Guest]

While I was waiting for any help on this, I ran across a thread titled 'Hijacked Homepage' that described the same problem. The reply from Frank Saunders (MS-MVP) was the answer for me. I had to go deep into it to solve my problem which turned out to be spyware, not a script. I downloaded and ran Ad-Aware, Spybot, HijackThis, and CWShredder. They all caught something. CWShredder got my bad guy, then re-running the others cleaned up the remains. Frank is the man on this

Ted