Re: Internet Explorer unwanted search engine

From: H Leboeuf (NoAddress_at_generation.invalid)
Date: 08/08/04 

Date: Sun, 8 Aug 2004 09:00:02 -0400

You have been hacked. These tool will probably fix it.
I would strart with the CWSHredder, looks like a CoolWebSearch infection.

Try this: Tools > Internet Options > Advanced > Browsing
Uncheck the Enable 3rd party browser extensions

If this clears your problem then find out who the culprit(s) is/are with
these tools.

Let AD-Aware Scan your system for advertising Spyware
http://www.lavasoftusa.com

If you use a HOSTS file, beware of this new issue.
Ad-Aware has decided to include a new detection when scanning the HOSTS
file. This now creates a "Bad hosts file entry" in the log file generated at
the end of a scan. The best thing to do is to place a check in each entry,
right-click and select: "Add selection to ignorelist". Otherwise if you let
AWW "fix" these items it will trash the HOSTS file! Even if you have it
"locked" by [example] SpywareBlaster or Winpatrol. It does not return the
attributes and renames the HOSTS file incorrectly to hosts.

and:

SpyBot-S&D
http://security.kolla.de/

p.s Reset the 3rd party browser setting.

More: This may be caused by a third-party program (adware, spyware,
parasite).
Get AdAware and SpyBot and run them both. Keep them up to date.
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Additional link:
http://aumha.org/a/quickfix.htm

You may need this removal tool.
More: Complete list by variant with up-to-date information.
http://www.spywareinfo.com/~merijn/cwschronicles.html
More: Removal tool: http://www.spywareinfo.com/~merijn/files/CWShredder.exe

CWShredder - Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47

IMPORTANT:
Before trying to remove spyware, download a copy of LSPFIX from
the URL below - some malware may kill your internet connection when it is
removed, this program will enable you to regain your connection.
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html (if your OS is Win2k or
XP)

Important: "So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051 

-- 
Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===
"Kris" <anonymous@discussions.microsoft.com> wrote in message
news:1b5b01c47c84$ced417b0$a301280a@phx.gbl...
> Many thanks for yourr message. I have done all that you
> suggested but still this MSN thing pops up. There is
> nothing in the registry like "search.uk.msn.com". I think
> this thing pops up because it is somehow part of Internet
> Explorer and put there by Microsoft. I have succeeded in
> changing the default search engine from MSN to Google and
> I had thought that this other thing might go away, but it
> hasn't.
>
>
> >-----Original Message-----
> >Searching the registry is only one step.  There may be
> >actual files on your system which need to be removed as
> >well.  I have used the following steps to completely
> remove
> >any piece of spyware/malware from numerous systems where I
> >work.
> >
> >Disconnect your compter from the net if you have a
> >high-speed connection such as cable or dsl.
> >
> >1) Go to Add/Remove Programs and look for programs that
> >shouldn't be there.  Things such as Hotbar Toolbar, Gator,
> >etc.  These programs should stand out in your mind as ones
> >that you did not install.
> >
> >Write down the names of these programs then go ahead and
> >use Add/Remove to remove them. This WILL NOT completely
> >remove the program but begins the process.
> >
> >2) Go onto your hard drive and look for folders which have
> >the same or similar names to the programs you just wrote
> >down.  Look under C:\Program Files for these folders.
> >
> >Delete these folders. In some cases you may not be able to
> >remove the entire folder or parts of their contents.  That
> >is ok.  Just be sure that what you are removing is what
> you
> >want to remove.  If in doubt, leave it in.
> >
> >3) Go to Start | Run and type in 'regedit' (no quotes).
> >When your registry comes up do Ctrl-F (Find) and type in
> >part of the name of one of the programs you are looking
> >for.  For instance, if you have the Hotbar Toolbar you
> >could simply type in 'hotbar' (no quotes).  Click Find
> Next
> >and the search begins.  When it stops on an entry look at
> >it closely.  Does it have the name of one of the programs
> >you are looking for?  If so, delete that key.  Hit F3 to
> >continue the search.
> >
> >When you get the message that you are at the end of the
> >registry do Ctrl-F and repeat the process for the next
> >piece of spyware/malware.  Repeat as necessary.
> >
> >4) Reboot your machine.  When you come back in see if you
> >can reset your homepage or access the net.  Hopefully at
> >this point you can.  If your homepage still won't reset
> you
> >need to go back into the registry and search for whatever
> >page you are being redirected to.  Again, just part of the
> >name is fine.  Also recheck your C: to see if there are
> any
> >leftover folders which you can remove.  If so remove them
> >and reboot again.
> >
> >
> >
> >
> >>-----Original Message-----
> >>Can ANYONE help with this, please?
> >>
> >>Frequently when I click on a Favourite that I know
> works,
> >>or if I (CORRECTLY) type in a web address, a window
> opens
> >>with a message "We cannot find the address taht you
> typed"
> >>or words to that effect. It then goes on to accuse me of
> >>misspelling the address (how can one misspell a
> favourite
> >>that one simply clicks on and that is know to function?)
> >>
> >>The address in the windows that appears is something
> like:
> >>http://search.uk.msn.com.
> >>
> >>I have never used MSN UK for searching because I am
> >>frequently not in the UK and in any case this search
> >>engine invariably makes mistakes.
> >>
> >>How can I permanently inactivate it? Presumably it
> >>requires the registry to be edited? Having searched the
> >>registry for a string like the one that appears with
> this
> >>irritating window, I can't find one.
> >>
> >>HELP before I go insane!
> >>.
> >>
> >.
> >

Relevant Pages

  • Re: Problems with History dont fix
    ... Let AD-Aware Scan your system for advertising Spyware ... If you use a HOSTS file, ... download a copy of LSPFIX from ... DO NOT use any of the TEMP folders that are presently in your computer. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Unknown Icons in My Network Places ?
    ... the internet connection line from the computer. ... delete the folders in Netwowrk Places. ... normal Hosts file looks like. ... spyware programs to disinfect your system.. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: HOSTS file not working
    ... I had checked the registry setting and it was setup correctly. ... edit the registry in another location to override the proper registry entry? ... >>Anyone have any ideas besides spyware as to why the HOSTS file would be ...
    (microsoft.public.windowsxp.network_web)
  • Re: where are the newsgroups???
    ... All other websites are fine. ... >If you have any other thoughts on what is happening to the DNS, ... Spyware Info: ... Block possibly dangerous websites with a Hosts file. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Internet Explorer Favorites
    ... >i cant find them in the folder, ... AdAware, CWShredder, and Spybot S&D have install routines - run them. ... Spyware Warrior: ... Block possibly dangerous websites with a Hosts file. ...
    (microsoft.public.windowsxp.network_web)