Internet Explorer unwanted search engine

[Kris]

Can ANYONE help with this, please?

Frequently when I click on a Favourite that I know works,
or if I (CORRECTLY) type in a web address, a window opens
with a message "We cannot find the address taht you typed"
or words to that effect. It then goes on to accuse me of
misspelling the address (how can one misspell a favourite
that one simply clicks on and that is know to function?)

The address in the windows that appears is something like:
http://search.uk.msn.com.

I have never used MSN UK for searching because I am
frequently not in the UK and in any case this search
engine invariably makes mistakes.

How can I permanently inactivate it? Presumably it
requires the registry to be edited? Having searched the
registry for a string like the one that appears with this
irritating window, I can't find one.

HELP before I go insane!

 

[KAS]

Searching the registry is only one step. There may be
actual files on your system which need to be removed as
well. I have used the following steps to completely remove
any piece of spyware/malware from numerous systems where I
work.

Disconnect your compter from the net if you have a
high-speed connection such as cable or dsl.

1) Go to Add/Remove Programs and look for programs that
shouldn't be there. Things such as Hotbar Toolbar, Gator,
etc. These programs should stand out in your mind as ones
that you did not install.

Write down the names of these programs then go ahead and
use Add/Remove to remove them. This WILL NOT completely
remove the program but begins the process.

2) Go onto your hard drive and look for folders which have
the same or similar names to the programs you just wrote
down. Look under C:\Program Files for these folders.

Delete these folders. In some cases you may not be able to
remove the entire folder or parts of their contents. That
is ok. Just be sure that what you are removing is what you
want to remove. If in doubt, leave it in.

3) Go to Start | Run and type in 'regedit' (no quotes).
When your registry comes up do Ctrl-F (Find) and type in
part of the name of one of the programs you are looking
for. For instance, if you have the Hotbar Toolbar you
could simply type in 'hotbar' (no quotes). Click Find Next
and the search begins. When it stops on an entry look at
it closely. Does it have the name of one of the programs
you are looking for? If so, delete that key. Hit F3 to
continue the search.

When you get the message that you are at the end of the
registry do Ctrl-F and repeat the process for the next
piece of spyware/malware. Repeat as necessary.

4) Reboot your machine. When you come back in see if you
can reset your homepage or access the net. Hopefully at
this point you can. If your homepage still won't reset you
need to go back into the registry and search for whatever
page you are being redirected to. Again, just part of the
name is fine. Also recheck your C: to see if there are any
leftover folders which you can remove. If so remove them
and reboot again.

 

[Kris]

Many thanks for yourr message. I have done all that you
suggested but still this MSN thing pops up. There is
nothing in the registry like "search.uk.msn.com". I think
this thing pops up because it is somehow part of Internet
Explorer and put there by Microsoft. I have succeeded in
changing the default search engine from MSN to Google and
I had thought that this other thing might go away, but it
hasn't.

 

[H Leboeuf]

You have been hacked. These tool will probably fix it.
I would strart with the CWSHredder, looks like a CoolWebSearch infection.

Try this: Tools > Internet Options > Advanced > Browsing
Uncheck the Enable 3rd party browser extensions

If this clears your problem then find out who the culprit(s) is/are with
these tools.

Let AD-Aware Scan your system for advertising Spyware
http://www.lavasoftusa.com

If you use a HOSTS file, beware of this new issue.
Ad-Aware has decided to include a new detection when scanning the HOSTS
file. This now creates a "Bad hosts file entry" in the log file generated at
the end of a scan. The best thing to do is to place a check in each entry,
right-click and select: "Add selection to ignorelist". Otherwise if you let
AWW "fix" these items it will trash the HOSTS file! Even if you have it
"locked" by [example] SpywareBlaster or Winpatrol. It does not return the
attributes and renames the HOSTS file incorrectly to hosts.

and:

SpyBot-S&D
http://security.kolla.de/

p.s Reset the 3rd party browser setting.

More: This may be caused by a third-party program (adware, spyware,
parasite).
Get AdAware and SpyBot and run them both. Keep them up to date.
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Additional link:
http://aumha.org/a/quickfix.htm

You may need this removal tool.
More: Complete list by variant with up-to-date information.
http://www.spywareinfo.com/~merijn/cwschronicles.html
More: Removal tool: http://www.spywareinfo.com/~merijn/files/CWShredder.exe

CWShredder - Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47

IMPORTANT:
Before trying to remove spyware, download a copy of LSPFIX from
the URL below - some malware may kill your internet connection when it is
removed, this program will enable you to regain your connection.
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html (if your OS is Win2k or
XP)

Important: "So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051