Printable View
I fixed a problem with IE 6 that had been infected with the CoolWebSearch trojan. Now the user has to type in the full url
i.e. http://www.windowsbbs.com....
Normally, you don't have to insert the text "http://", windows will insert that for you. What's happened here ... any ideas.
The good news is that CoolWebSearch is gone.
Thanks for any help
How about other malware?
You should clean it ALL up with all the standard tools here: http://forums.windrivers.com/showthread.php?t=57348
And then, if things are stil problematic, try a repair install of IE:
http://support.microsoft.com/default...&Product=winxp
Quote:
Originally Posted by OldBob
Your problem is a default entry in the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\URL
DefaultPrefix
Name, Type, Data
(Default), REG_SZ, http://
OK: I'll bite: why is that the problem based on what he has said, and what exactly is the fix Votan? Delete that key?
Quote:
Originally Posted by TripleRLtd
Oops, you got me there.
I missed to say that the key or its value must have been erased, this is why the auto-complete was not working. He has to re-enter the key value manually in the registry. I provided the key and its value.
another good tool for spyware scaning is:
doxdesk.com/parasite (not my site) I use this all the time as there is nothing to install.
Another one to be aware of is there are several SpyWare companies that insert their own DLL's as part of the WinSOCK TCP/IP Protocol Stack (NetDotNet6 is an example) - to get rid of these DLL's search for LSPFix.exe and run it. It will display the DLL's used in WinSOCK currently and you will need to determine if al of them belong there - search your computer for the DLL's listed and click "properties" then "version" The Microsoft DLL's can stay, the non-MS ones are generally the spyware component and should be removed.