Someone hot linking my IE 6.0 viewed pages

[Paul McCormick]

I seem to have some sort of virus or worm that has
invaded my Internet explorer program. I have run Spy
Hunter, Ad-Ware, Disc Clean up, Window Washer, emptied
all cookies, temp files, temp internet files and even
tried to delete IE so that I could reinstall. Nothing
seems to get rid of it.

Is what it does is when I go to my web-site
(wildernessadventures.ca) to view pages it has changed
key words in my text (travel and insurance) to links to
another site http://www.runsearch.com/top/go.php?qq=travel

When I highlight the link and look at Properties his is
what's displayed for the 2 different words and links

TRAVEL
Protocol: HyperText Transfer Protocol
Type: COM/?GO=TRAVEL File
Address (URL): http://go-advertising.com/?go=travel

Insurance
Protocol: HyperText Transfer Protocol
Type: COM/?GO=INSURANCE File
Address (URL): http://go-advertising.com/?go=insurance

Have you seen this before?

Can you recommend a way of getting rid of it?

I'm running XP Home and IE 6.0.2600

Please respond to Paul McCormick at
(e-mail address removed)

Thank you

 

[Mike Burgess]

Paul,
runsearch.com = CWS.Mupdate (coolwebsearch trojan)
FYI: go-advertising.com = runsearch.com

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-08-03]
Please post replies to this Newsgroup, email address is invalid

 

[Paul McCormick]

Thanks Mike for taking the time to share your knoweledge!
Your suggestions worked perfectly!

-----Original Message-----
Paul,
runsearch.com = CWS.Mupdate (coolwebsearch trojan)
FYI: go-advertising.com = runsearch.com

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.

_________________________________________________________

___
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-08- 03]
Please post replies to this Newsgroup, email address is invalid
--

I seem to have some sort of virus or worm that has
invaded my Internet explorer program. I have run Spy
Hunter, Ad-Ware, Disc Clean up, Window Washer, emptied
all cookies, temp files, temp internet files and even
tried to delete IE so that I could reinstall. Nothing
seems to get rid of it.

Is what it does is when I go to my web-site
(wildernessadventures.ca) to view pages it has changed
key words in my text (travel and insurance) to links to
another site http://www.runsearch.com/top/go.php? qq=travel

When I highlight the link and look at Properties his is
what's displayed for the 2 different words and links

TRAVEL
Protocol: HyperText Transfer Protocol
Type: COM/?GO=TRAVEL File
Address (URL): http://go-advertising.com/?go=travel

Insurance
Protocol: HyperText Transfer Protocol
Type: COM/?GO=INSURANCE File
Address (URL): http://go-advertising.com/?go=insurance

Have you seen this before?

Can you recommend a way of getting rid of it?

I'm running XP Home and IE 6.0.2600

Please respond to Paul McCormick at
(e-mail address removed)

Thank you

.

 

[Mike Burgess]

Paul,
You're welcome .... glad to see you have things resolved.
_____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-08-03]
Please post replies to this Newsgroup, email address is invalid
--

Thanks Mike for taking the time to share your knoweledge!
Your suggestions worked perfectly!

-----Original Message-----
Paul,
runsearch.com = CWS.Mupdate (coolwebsearch trojan)
FYI: go-advertising.com = runsearch.com

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.

_________________________________________________________

___
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-08- 03]
Please post replies to this Newsgroup, email address is invalid
--

I seem to have some sort of virus or worm that has
invaded my Internet explorer program. I have run Spy
Hunter, Ad-Ware, Disc Clean up, Window Washer, emptied
all cookies, temp files, temp internet files and even
tried to delete IE so that I could reinstall. Nothing
seems to get rid of it.

Is what it does is when I go to my web-site
(wildernessadventures.ca) to view pages it has changed
key words in my text (travel and insurance) to links to
another site http://www.runsearch.com/top/go.php? qq=travel

When I highlight the link and look at Properties his is
what's displayed for the 2 different words and links

TRAVEL
Protocol: HyperText Transfer Protocol
Type: COM/?GO=TRAVEL File
Address (URL): http://go-advertising.com/?go=travel

Insurance
Protocol: HyperText Transfer Protocol
Type: COM/?GO=INSURANCE File
Address (URL): http://go-advertising.com/?go=insurance

Have you seen this before?

Can you recommend a way of getting rid of it?

I'm running XP Home and IE 6.0.2600

Please respond to Paul McCormick at
(e-mail address removed)

Thank you

.