Re: Virus changing home page

From: Mike Burgess (winhelp2002_at_spamthis.com)
Date: 04/12/04


Date: Mon, 12 Apr 2004 14:58:03 -0400

P. Schwartz,
nkvd.us = Coolwebsearch trojan
Requires CWShredder 1.56.2
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.

Note: be *sure* to follow-up with HijackThis
Post back with the URL where you posted if you want help with your log.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 04-09-04]
Please post replies to this Newsgroup, email address is invalid

--
"P. Schwartz" <tiredmomps@hotmailcom> wrote in message
news:1b61701c420a4$f2a17750$a301280a@phx.gbl...
> Help,
>
> I have a virus that is taking over my IE 6.0 home page.
> I can not change my home page. Everytime I do it changes
> back.
>
> I can not find the program that is causing this. I
> changed the homepage in regedit however, it too keeps
> changing back.
>
> The URL of the bad home page s http://nkvd.us/  anybody
> have any ideas how to get of this?
>
> P. Schwartz


Relevant Pages

  • Re: Ad & AdWare
    ... this type hijack indicates an unpatched machine, ... >Please post replies to this Newsgroup, ... your permanent home ...
    (microsoft.public.win2000.security)
  • Re: Ad & AdWare
    ... this type hijack indicates an unpatched machine, ... Please post replies to this Newsgroup, ... as it will become your permanent home ...
    (microsoft.public.win2000.security)
  • Re: Ad & AdWare
    ... this type hijack indicates an unpatched machine, ... Please post replies to this Newsgroup, ... as it will become your permanent home ...
    (microsoft.public.security)
  • Re: Is this a virus?
    ... Lately these "ntdll.dll" problems are caused by a Coolwebsearch trojan. ... this type hijack indicates an unpatched machine, ... Please visit Windows Update to avoid these exploits. ... Please post replies to this Newsgroup, ...
    (microsoft.public.security.virus)
  • Re: I feel like someone has taken over my computer!!!
    ... find-itnow.com = CWS.Alfasearch.2 (coolwebsearch trojan) ... this type hijack indicates an unpatched machine, ... Please visit Windows Update to avoid these exploits. ... > been to is Ebay. ...
    (microsoft.public.security.virus)