Homepage hijacked!!!!!!! HELP!!!!!

[BC]

I have a user who's homepage has been hijacked. I have
run spybot, adaware and gone to the registry and deleted
anything that has any of the words in the file extension.
The page is
res://scrzl.dll/index.html#37049

Has anyone seen this one. I can't even find it in a
google search.

 

[Kim]

I have had much success using "hijack this" to remove
these issues. It is a free download at
http://www.spychecker.com/program/hijackthis.html

HTH
Kim

 

[Paul Bobrowski]

I was hit with this program and it's very nasty to try to get rid of.

I ran a program called CDWShredder. This removed it; however, it would come
back. What I had to do was delete a registry key.

After running CDWShredder open regedit and goto:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion

Rename the Windows folder to Windows2
Delete the AppInit_DLLs key, it appears blank but this is whats causing the
program to come back
Rename Windows2 back to Windows
reboot

If you don't rename the Windows folder in the registry the entry will just
reappear in a few seconds. Hope this helps, I was pulling out hair for a
few days trying to kill this.

BC,
You have been hit by the wwwcoolsearch spyware program. For the best

chance of finding information on getting rid of this is to go to Google and
search for "wwwcoolsearch." I've found plenty of good information on
computercops.biz, but you'll find other sites that can help as well.

 

[Martin Kloter]

You are a victim of:

http://forums.spywareinfo.com/index.php?showtopic=7181
or
http://forums.spywareinfo.com/index.php?showtopic=7447

 

[DG]

Bless you Paul!!! Your fix worked.

This "About:Blank" virus (trojan) was driving me nuts. (CW Shredder
and Ad-aware only temporarily removes the problem, which keeps coming
back with each reboot.)

Symtoms: Internet Explorer home page is replaced by "about:blank"
which actually points to a goofy search engine portal. Also, some
porn sites get added to your favorites.

** See Paul's instructions below for PERMANENT REMOVAL FIX **