Home Page keeps resetting in IE 5.5 2

[gbstelecom]

Dear Sirs,

It seems that I have a bug that keeps resetting my hompe page in IE 5.5; I have deleted all of the cookies and files in my temp folders, as well as any active x programs on my machine. It is strange that I got this bug since all of my security settings are high, or set to prompt. Here is a paste of what my home page keeps getting reset to:

http://www.coolwwwsearch.com/z/a/x1.cgi?656387 about:blank

I would appreciate your help, and if your ever in any need of telephone help, just let me know.

Thanks in Advance,

GBS

 

[Carpipesdad]

You have been hijacked by spyware. Go to Lavasoft's website and downlaod Ad aware. Install and run. Problem fixed!

 

[carrr]

I agree with Carpipesdad in principle, but more and more spywares are being built to be resistant to conventional removal tools (or at least it seems that way). Please read the information found here on the CoolWebSearch hijacker (which is what you've got):

http://doxdesk.com/parasite/CoolWebSearch.html

There are several variants of this hijacker, so you may have to try different manual approaches, but the CoolWeb Shredder tool found here:

http://www.spywareinfo.com/~merijn/

should take care of it handily.

 

[steamwiz]

Spybot and adaware do not address the problem of coolweb - and looking at your post I second what carr proposes,

Download and Run cws

http://www.spywareinfo.com/~merijn/files/cwshredder.zip

If you have any further problems post a hijackthis log here.

http://tomcoyote.org/hjt

Unzip, doubleclick HijackThis.exe, and hit "Scan".

After the scan has finished the "scan" button will turn into a "save log" button

save the log file and paste it here

Do not delete anything yet, as most things hijackthis finds are harmless and needed.

steam

 

[gbstelecom]

OK, thank you for all of your immediate response(s).

I was able to stop the "resetting" of my homepage. Here is what I did to accomplish this..

I read the information posted at:

http://doxdesk.com/parasite/CoolWebSearch.html

beginning with the section called MANUAL REMOVAL I followed the directions step by step.

as mentioned I found the file entitled oslogo.bmp and deleted it.. just for grins I changed my homepage back to what it was before and applied it, then I restarted my computer and went back into IE. The homepage went back to the "hijacked" page. So I checked to see if the file oslogo.bmp had been replaced, sure enough it was....I started over in the directions and deleted the file oslogo.bmp; then I went to step 2 and assuming I had the MSInfo variant I deleted the line in my win.ini file which read “run=C:\WINDOWS\..\PROGRA~1\COMMON~1\MICROS~1\MSINFO\msinfo.exe” ; I went back into IE and changed my homepage to what I wanted it to be; I closed IE the reopened it... guess what....no "hijacking"...I reset my computer to test to see if there were perhaps an executable file that may have replaced the oslogo.bmp...it did not reappear....So the problem is fixed for now..... I have a program that I run from time to time called regedit; I think the regeistry entries for bootconf.exe or svchost32.exe may have been previously deleted by me when I did not recognize them.(this is assuming that I had the BootConf or SvcHost variant..I made this assumption because of the explanation early on in the reading at

http://doxdesk.com/parasite/CoolWebSearch.html)

However what seems strange is that there was no file named HOSTS as explained in the reading in the systems folder.....This leads me to wonder where then is the executable file which replaces the homepage each time...Like I said I dont have a problem anymore at this point, I am just curious.... Also by the way I did have the cool

http://wwwsearch.com

as a TRUSTED site in my security settings... the first time I removed it, after resetting I found it had been placed there again....However this was before editing my win.ini file....I am not sure if it will be put there again.. I will get back to that in a subsequent reply.... Also can it be placed in the restricted sites and will this help in any way.......

Thank all of you so much,

GBS

 

[steamwiz]

gbstelecom

You could have saved yourself a lot of time and trouble in deleting it manualy (coolwebshredder would have done it all for you)

http://www.spywareinfo.com/~merijn/files/cwshredder.zip