Home Page Defaults

J

James

My homepage had been set to www.yahoo.com. I recently
downloaded Kazaa, and now my homepage defaults to
www.searchv.com/w/. I have tried changing the homepage
default under internet options, and reseting web
settings, however, everytime I reboot the homepage
defaults back to www.searchv.com/w/.

Also, when I select the search tab, the search window
opens with a different search engine. Up to this point
IE was searching with MSN.

What do I do to get my old settings back?

Thanks.
 
J

Jim Byrd

HI James - This is the CoolWebSearch parasite. Do the following:
Download and run: http://www.spywareinfo.com/~merijn/files/cwshredder.zip to
remove the parasite

Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. Update and run this regularly
to get rid of most "spyware/hijackware" on your machine.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After fixing things with SpyBot S&D, be sure to re-boot
and rerun SpyBot again and repeat this cycle until you get a clean "no red"
scan.


Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm



--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In
 
A

Amanda

Jim,
Thanks for the info! I've had the same problem, and was
very happy to find a solution so quickly - especially one
that actually worked!
Amanda
-----Original Message-----
HI James - This is the CoolWebSearch parasite. Do the following:
Download and run:
http://www.spywareinfo.com/~merijn/files/cwshredder.zip to
remove the parasite

Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. Update and run this regularly
to get rid of most "spyware/hijackware" on your machine.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-
bin/forums/ikonboard.cgi. I recommend
 
J

Jim Byrd

YW, Amanda - glad it worked for you.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In
 
J

James

Jim,

I ran the processes you outlined below. It seemed to
work initially, however, after rebooting the home page
and search engine defauted back to the www.searchv.com/w/
sites.

Any other suggestions?
 
J

Jim Byrd

Hi James - Download HijackThis, free, here:
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Unzip it to any convenient folder, start it then press Scan. Click on
SaveLog when it's finished which will create hijackthis.log. Now click
the Config button, then Misc Tools and click on Generate StartupList.log
which will create Startuplist.txt

Go to Spyware and Hijackware Removal Support, here:
http://www.spywareinfo.com/forums/index.php?s=8a236cdf61469fbad3bddbe810be0374&act=SF&f=11

Sign in, then copy and paste both files a message asking for assistance,
Someone will answer with detailed instructions for the removal of your
parasite(s).


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In
 
J

James

Jim,

Thanks for the direction. I was able to browse the forum
and see that another poster had the same problem I did!
Just followed the already posted fix, and it worked!!

One question: how did this happen, how can I prevent it
from happening going forware?
 
M

Mike Burgess

James,
One question: how did this happen, how can I prevent it from happening
going forware"
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 10-10-03]
Please post replies to this Newsgroup, email address is invalid
--
 
J

Jim Byrd

Hi James - Well, you probably can't totally. However, since you asked . . .
:)

There are a number of things which need to be considered in securing a
computer. The minimum necessary to start with are a good hardware or
software firewall and an AV. Then add at least some basic protections
against "malware":


First, appropriate security settings in IE:

--Recommended Minimum Security Settings-- (Courtesy of Mike Burgess)

Close all instances of IE and OE
Control Panel | Internet Options

Click on the "Security" tab
Highlight the "Internet" icon, click "Custom Level"

1) "Download signed ActiveX scripts" = Prompt
2) "Download unsigned ActiveX scripts = Disable
3) "Initialize and script ActiveX not marked as safe" = Disable
4) "Installation of Desktop items" = Prompt
5) "Launching programs and files in a IFRAME" = Prompt

Click on the "Content" tab
Click the "Publishers" button

Highlight and click "Remove" any unknowns, click Ok

Click on the "Advanced" tab
Uncheck: "Install on demand (other)", click Apply\Ok

Prevent your "HomePage" setting from being Hijacked
http://www.mvps.org/winhelp2002/ietips.htm
_____________________________
Mike Burgess
Information isn't free if you can't find it!
http://www.mvps.org/winhelp2002/

(Note particularly the Publisher stuff - everyone tends to forget that
vector!)


Read and heed:
http://www.mvps.org/winhelp2002/unwanted.htm and
http://www.mvps.org/winhelp2002/security.htm
http://www.staff.uiuc.edu/~ehowes/main.htm (this one will take you several
days - one of the best and most extensive sites on the web for security
issues. Some good tools here also: e.g. IE-SPYAD -
http://www.staff.uiuc.edu/~ehowes/resource.htm)


Next, get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. Update and run this regularly
to get rid of most "spyware/hijackware" on your machine. Reboot and rerun
after you fix anything.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I
recommend USING BOTH NORMALLY. They do and fix different things. In
addition, SpyBot S&D offers some useful preventative measures if you chose
to use them. Always update before running. After fixing things with SpyBot
S&D, be sure to re-boot and rerun SpyBot again and repeat this cycle until
you get a clean "no red" scan. Sometimes it needs to re-boot in order to
eliminate an in-use parasite before it can go on to cleaning up
something else.

..
Lastly, install the SpywareBlaster and SpywareGuard here to help prevent
this kind of thing from happening in
the future: http://www.wilderssecurity.com/spywareblaster.html (Prevents
malware Active X installs) (BTW, SpyWare Blaster is not memory resident ...
no CPU or memory load - but keep it updated) The latest version as of this
writing will prevent installation or prevent the malware from running if it
is already installed for 864 parasites as of this posting, and it provides
information and fixit-links for a variety of parasites.
http://www.wilderssecurity.net/spywareguard.html (Monitors for attempts to
install malware) Both Very Highly Recommended.


I hope some of this is useful. Please post back in this same thread if
you've further questions.


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top