Homepage Hijack

[Clintbob]

My home page keeps changing from what I set it to to a
Microsoft Home Search page with URL:
res://mshp.dll/index.html#12802.

I have XPPro with IE6 sp1.

I have been to the support page of Microsoft and tried
everything shown but it makes no difference.
I have deleted all the files from the Windows side and
hacked the registry per the instructions. Even did the
clean boot. It gets rid of it for one or two openings,
then it's back. Does anyone know how to keep this from
returning?

 

[war17]

Some website has hijacked your homepage.

1. Use the following scanners to find and remove the website.

SpyBot S&D searches your harddisk for so-called spy- or adbots;
http://security.kolla.de/
or
Adaware
http://www.lavasoftusa.com/software/adaware/
or
CoolWebShredder
http://www.spychecker.com/program/coolwebshredder.html

2. Some porn websites redirects links to their websites using your HOSTS
file. Do a search for the HOSTS (without extension) file and remove the
entry.

3. If still no joy, download HijackThis from Spywareinfo download page

http://www.spywareinfo.com/program/hijackthis.html

Run the program and you will find many entries. Most are OK. Post the log. I
will find the problem for you.

4. For future preventive maintenance, make sure programs cannot just
download on your computer without your permission. From the Internet
Toolbar, go to Tools > Internet Options > Advanced. Make sure "Enable
Install On Demand (Internet Explorer)" and "Enable Install On Demand
(Other)" are unchecked.

 

[Mike Burgess]

Clintbob,
mshp.dll = Coolwebsearch trojan

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 03-09-04]
Please post replies to this Newsgroup, email address is invalid