Home Page Default "Hijack"

[Jay]

My Default Home Page settings in IE 6 "Options" changes to
an "Obfuscated" HTTP address in some kind of coded
information that leads to a "FAST FIND" Web Site. I have
been able find these "Obfuscated" HTTP address strings
in the Registry and when I delete them the Default Home
Page reverts back to the original MSN Web address but
sooner or later the next time I boot the computer the
Default Home Page setting is replaced by the coded HTTP
address. How can I find what is causing this change?
Is it some implanted Java script that is executed
periodically? How can I find it.....where to look...what
to do to permanently fix this problem? Thank you.

 

[Burt]

Jay,
You have a new parasite or some variant.
Get help from the experts in this forum.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/
HTH,
--
Burt
The Old Alaskan
MVP's listed on TECKPAGE
http://www.cvinternet.net/~smokydog
http://www.cvinternet.net/~smokydog/teckpage.htm

My Default Home Page settings in IE 6 "Options" changes to
an "Obfuscated" HTTP address in some kind of coded
information that leads to a "FAST FIND" Web Site. I have
been able find these "Obfuscated" HTTP address strings
in the Registry and when I delete them the Default Home
Page reverts back to the original MSN Web address but
sooner or later the next time I boot the computer the
Default Home Page setting is replaced by the coded HTTP
address. How can I find what is causing this change?
Is it some implanted Java script that is executed
periodically? How can I find it.....where to look...what
to do to permanently fix this problem? Thank you.

 

[Mike Burgess]

Jay,
"Obfuscated" = coolwebsearch trojan

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-15-03]
Please post replies to this Newsgroup, email address is invalid