HELP please, can't change home page or change default pages

[cwalvica]

My home page always comes up http://www.smart-
finder.biz/1507/. and even if the files are changed or
erased (
HKEY_LOCAL_MACINE\Software\Microsoft\Windows\CurrentVersio
n\URL\Prefixes\ and .....URL\DefaultPrefix\ folders.
VIRUS PROGRAMS (AVG + bitdefender) are negative for a
virus. spybot s+d identifies a common hijacker with the
files above listed. fix selected problems wipes them out
but doesn't fix the problem. Anything to do short of
deleting and reinstalling IE? Please help.

 

[Altrus]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

It would seem you have been infected with CoolWebSearch. Despite its cool
name, you will need to download a utility, CoolWebShredder, that will
completely remove the program, and should restore functionality. You can
download CWS from:

http://www.zerosrealm.com/downloads/CWShredder.zip

You may also be interested in the following article:

http://mvps.org/winhelp2002/unwanted.htm


It details the various approaches to dealing with SpyWare and similar
programs.

Altrus




| My home page always comes up http://www.smart-
| finder.biz/1507/. and even if the files are changed or
| erased (
| HKEY_LOCAL_MACINE\Software\Microsoft\Windows\CurrentVersio
| n\URL\Prefixes\ and .....URL\DefaultPrefix\ folders.
| VIRUS PROGRAMS (AVG + bitdefender) are negative for a
| virus. spybot s+d identifies a common hijacker with the
| files above listed. fix selected problems wipes them out
| but doesn't fix the problem. Anything to do short of
deleting and reinstalling IE? Please help.

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBQHRKhnnWWyjmZ2hmEQLqJQCePRFY0xTikXHzl0xIqiRYrKE1KDIAoLgZ
yPpZiCQ4f1NkRwHToHjC6/MD
=IvWI
-----END PGP SIGNATURE-----

 

[Mike Burgess]

Hi,
smart-finder.biz = CWS.Smartfinder (trojan) aka: Trojan.Bookmarker.C

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.

Note: be *sure* to follow-up with HijackThis
Post back with the URL where you posted if you want help with your log.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 04-02-04]
Please post replies to this Newsgroup, email address is invalid