IE6 Home Page Hijack: "res://nqwmr.dll/index.html#37049"

[Mark B]

Whenever I reopen IE6 my home page is reset to:
res://nqwmr.dll/index.html#37049. How do I prevent
this? Thanks!

 

[H Leboeuf]

This is a new CoolWebSearch Variant, a nasty one.
Read on.
http://forums.spywareinfo.com/index.php?showtopic=8847


Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip the Download file in a NEW FOLDER that you can create before you start
the download.
DO NOT install in your Desktop folder.
DO NOT use any of the TEMP folders that are presently in your computer.
Double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html

--

Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===

if you go to run in the start menu and type in "regedit" under the start

menu. Then click on edit and find type in the page address ie:
res://nqwmr.dll/index.html#37049, there you can delete the file and this
should work.