unwanted homepage

[ken]

A couple days ago, my homepage switched all of a sudden
to one of those search sites, icanfindit.com to be exact.
I changed the homepage back in the internet options but
it switches back everytime I press ok. I figured that it
was a cookie that was causing it to snap back, so I
searched for it and I was right, it was a cookie called 4-
counter(which is what is written in the address bar
before the homepage goes to the search site). I deleted
the cookie and changed my homepage back. it looked like
it worked, but when I restarted my computer the next day,
the malicent page was back. I looked up the cookie again
and it was listed, but when I went to delete it, the
system couldn't find the file. I'm out of I deas and I
was hoping somebody else had any ideas on what to do.

 

[Ramesh [MVP]]

Homepage changes unexpectedly:
http://www.mvps.org/sramesh2k/IEFAQ.htm

--
Ramesh - Microsoft MVP
http://www.mvps.org/sramesh2k
-------------------------------------------------
Prevent Spyware from being installed:
http://www.mvps.org/sramesh2k/Malware_Defence.htm
-------------------------------------------------


A couple days ago, my homepage switched all of a sudden
to one of those search sites, icanfindit.com to be exact.
I changed the homepage back in the internet options but
it switches back everytime I press ok. I figured that it
was a cookie that was causing it to snap back, so I
searched for it and I was right, it was a cookie called 4-
counter(which is what is written in the address bar
before the homepage goes to the search site). I deleted
the cookie and changed my homepage back. it looked like
it worked, but when I restarted my computer the next day,
the malicent page was back. I looked up the cookie again
and it was listed, but when I went to delete it, the
system couldn't find the file. I'm out of I deas and I
was hoping somebody else had any ideas on what to do.

 

[Mike Burgess]

Ken,
4-counter.com = CWS.Winproc32 (coolwebsearch trojan)

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 02-07-04]
Please post replies to this Newsgroup, email address is invalid

 

[Guest]

The clue is in your statement, "...but when I restarted
my computer...the malicent page came back".

I suggest doing a "clean boot" to determine if possibly
you may have downloaded 3rd party software that is
hijacking your Internet Explorer browser.

To perform a clean boot:
1. Click "Start", click "Run", type "Msconfig" in the
open box and then click "OK".

2. On the General tab, click "Selective Startup", then
click to clear the "Process System.ini file", "Process
Win.ini File", and "Load Startup Items" check boxes. You
cannot clear the "Use Original Boot.ini" check box.

3. On the "Services" tab, click to select the "Hide All
Microsoft Services" check box, and then click "Disable
All".

4. Click "OK", and then click "Restart" to restart your
computer.

5. After Windows starts, determine whether the symptoms
are still present.

If the problem is resolved, then you have narrowed down
your problem to a 3rd party software. Look in
your "Startup" entries in "Msconfig" and feret out
softwares that end with the extensions, ".reg, .hta, .vbs
or .js. Any startup items that run "Regedit.exe" should
be turned off.

Don't turn all the above mentioned suspects off at once;
try several at a time and restart your computer. By a
process of elimination, you might at least identify the
culprit(s). That alone is half the battle.

Jumping ahead after you have eliminated and destroyed the
malicent program, reset your "Msconfig" settings as
original set by selecting "Normal Startup" in
the "General tab"