Searchpage

[Bill]

Hi, Recently I was searching the internet explore and
ran into problem now. Normally when I open up my
internet explore I usually get "MSN" which I set my
default property to the home page http://www.msn.com/,
but now it really doesn't matter what I do, it keeps
defaulting my homepage address to "c:\searchpage.html"
and put an HTML document file to C drive directory. I
tried delete it, but nothing work. How can I get rid of
this "c:\searchpage.html" ? What must I do to reset so
the problem doesn't happen again? The problem is that it
keeps defaulting to this homepage which I don't want at
all.

 

[Guest]

Download Hijack This http://www.majorgeeks.com/downloads31.html more information about Hijack This
http://www.wilderssecurity.com/showthread.php?p=163614

----- Bill wrote: -----

Hi, Recently I was searching the internet explore and
ran into problem now. Normally when I open up my
internet explore I usually get "MSN" which I set my
default property to the home page http://www.msn.com/,
but now it really doesn't matter what I do, it keeps
defaulting my homepage address to "c:\searchpage.html"
and put an HTML document file to C drive directory. I
tried delete it, but nothing work. How can I get rid of
this "c:\searchpage.html" ? What must I do to reset so
the problem doesn't happen again? The problem is that it
keeps defaulting to this homepage which I don't want at
all.

 

[Jim Byrd]

Hi Bill - Sounds like this might be a variant of some malware called
CoolWebSearch (if not, then see AdAware, SpyBot, and HijackThis, below). Do
the following:

Download, UPDATE before running, and run:
http://209.133.47.200/~merijn/files/CWShredder.exe to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: http://www.zerosrealm.com/downloads/CWShredder.zip

You will need to disable System Restore and then reboot your system
in order to clear the CWS garbage from the backups. After rebooting, then
re-enable System Restore.

The following link gives instructions on how to disable it:
http://service1.symantec.com/SUPPOR...sf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl=



Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093#appliesto

which blocks the exploit upon which this parasite family depends.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions.


However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm



If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13

Unzip it to any convenient folder, start it then press Scan. Click on
SaveLog when it's finished which will create hijackthis.log. Now click the
Config button, then Misc Tools and click on Generate StartupList.log which
will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).




Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Tbac3]

I have been having the same problem of late. If you find
an answer please let me know. I can go to Google or some
other search engine and link to a page but I can't type
in a web address without getting that search page.

 

[Altrus]

Hi,

It would appear that (both you of) have been infected with SpyWare. The best
bet to removing spyware is to hire some muscle to do it for you.

The muscle I am referring to (on this occasion) happens to be a free program
called AdAware. So you aren't really hiring anybody, so much as getting rid of a
pesky problem. AdAware is a straight-forward program designed to remove ad-ware
with as little a hassle as problem.

http://www.lavasoftusa.com/support/download/

Remember to 'Check for updates' so that you are protected against the
latest threats. Once updated, run the program to eliminate any other spyware
programs which were left behind or missed.

While AdAware should remove this particular bug, some others may have
slipped past. Thus, it's a good idea to use CWShredder to remove some of the
varients which may have been missed. CWShredder is available at:

http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Learn more about your adversary here:

http://mvps.org/winhelp2002/unwanted.htm

This neat little guide is filled with valuable tips on protecting your
computer.

With this knowledge, and a few snappy programs, you can turn the tide and
return your computer to its natural, productive, state.

Best regards,

Altrus

Some information:
http://www.computing.net/security/wwwboard/forum/11198.html




| I have been having the same problem of late. If you find
| an answer please let me know. I can go to Google or some
| other search engine and link to a page but I can't type
| in a web address without getting that search page.
| >-----Original Message-----
| >Hi, Recently I was searching the internet explore and
| >ran into problem now. Normally when I open up my
| >internet explore I usually get "MSN" which I set my
| >default property to the home page http://www.msn.com/,
| >but now it really doesn't matter what I do, it keeps
| >defaulting my homepage address to "c:\searchpage.html"
| >and put an HTML document file to C drive directory. I
| >tried delete it, but nothing work. How can I get rid of
| >this "c:\searchpage.html" ? What must I do to reset so
| >the problem doesn't happen again? The problem is that
| it
| >keeps defaulting to this homepage which I don't want at
| >all.
| >.
| >