the about:blank start page problem.
Results 1 to 10 of 10

Thread: the about:blank start page problem.

  1. August 4th, 2004, 10:12 AM #1
    molo
    molo is offline
    Registered User
    Join Date
    Aug 2004
    Posts
    4

    the about:blank start page problem.

    Hey guys.

    I read about the problem in other threads and followed some of the instructions.

    Now, this is what I have done so far:

    Ran ( in safe mode )
    online virus check ( which found 1 trojan in my java cache [deleted that] )
    Spybot
    Adaware 6
    Spy Sweeper
    and after all Hijack This
    I have also downloaded Spyblaster and activated all the protection there is.
    I'm downloading BHODemon right now.
    /edit: BHODemon finds "lhe.dll" which is located in windows/system32/
    is that a "good" file ? or to be deleted ?
    plus: i can't update BHODemon. I deactivated my firewall, but it still won't get the updates.

    Spybot tells me about the DSO exploit, but as far as I understand there is no fix to that problem, or at least not a real one. I will later download all the Windows Security updates. (Which reminds me: when I wanted to use the update search thing (which checks which updates you already have) on the microsoft site my IE kept jumping to the about:blank search site.)

    So I still have the problem with my start page. How can I get rid of that ? Is there a connection between that and the DSO exploit ?

    Here's my latest Hijack This! log:

    Logfile of HijackThis v1.97.7
    Scan saved at 17:02:47, on 04.08.2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    d:\progra~1\0190wa~1\w0svc.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    d:\Programme\AVPersonal\AVWUPSRV.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    D:\PROGRA~1\0190WA~1\WARN0190.EXE
    D:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    D:\PROGRA~1\LEXMAR~1\AcBtnMgr_X84-X85.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printra y.exe
    D:\PROGRA~1\ZONEAL~1\zlclient.exe
    C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe
    C:\WINDOWS\Au51Fun.exe
    C:\Programme\Internet Explorer\IEXPLORE.EXE
    C:\Programme\Internet Explorer\IEXPLORE.EXE
    C:\Dokumente und Einstellungen\molo\Desktop\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {F16571CD-1051-4C4E-8A3B-F07305AC8170} - C:\WINDOWS\System32\lhe.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [0190 Warner] D:\PROGRA~1\0190WA~1\WARN0190.EXE
    O4 - HKLM\..\Run: [Lexmark X84-X85 Button Monitor] d:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe
    O4 - HKLM\..\Run: [Lexmark X84-X85 Button Manager] d:\PROGRA~1\LEXMAR~1\AcBtnMgr_X84-X85.exe
    O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printra y.exe
    O4 - HKLM\..\Run: [Zone Labs Client] D:\PROGRA~1\ZONEAL~1\zlclient.exe
    O4 - HKCU\..\Run: [Aureon 5.1 Fun Mixer] C:\WINDOWS\System32\Aureon 5.1 Fun Mixer.exe /minimize
    O4 - HKCU\..\Run: [SpySweeper] "C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe" /0
    O4 - Startup: Kopie von ControlPanel.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office\Office\OSA9.EXE
    O9 - Extra 'Tools' menuitem: Sun Java Konsole (HKLM)
    O9 - Extra button: ICQ Pro (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\explorer.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
    O16 - DPF: {52290B25-D07A-43B5-84D8-493116D50FA0} (WebPlugin Class) - http://webinstall.tscash.com/webinstall.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/2531b5f5ec128c4...p/RdxIE601.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...987.4531944444
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/Sha.../bin/cabsa.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{59553750-18E9-4532-AD7C-F31AA5817B44}: NameServer = 62.104.191.241 62.104.196.134


    Is there stuff I should get rid of ?

    And another thing. Today I encountered the Sasser worm again. Weird, because I haven't had a problem with that in a long time. So I wanted to get the patch from Microsoft, but Windows always tells me, that the "file is corrupt" when I want to install it. What's up with that ? Is that a problem with my computer? Because I can't really imagine, that Microsoft has corrupt files for download. I tried the English version of the file too (I'm from Germany) with the same result.

    I appreciate your help already

    /edit again: well i thought cwshredder had removed the start page. it did work for about a minute, now the old things back up again. gonna try to do all the stuff again in safe mode...

    /editedit: nothing works. as soon as i connect to the internet (actually even before that) i get a note from spysweeper that something is changing ( or trying to ) my start page. and when i open my browser i have the search page again. please help me ! this is driving me nuts!
    Last edited by molo; August 4th, 2004 at 11:54 AM.
    Reply With Quote Reply With Quote
  2. August 5th, 2004, 10:01 AM #2
    Zonie
    Zonie is offline
    Registered User Zonie's Avatar
    Join Date
    Apr 2001
    Location
    Phoenix, Arizona
    Posts
    1,461
    Welcome to WD Molo, I would suggest removing these lines:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about :blank

    Then run SPybot again. I had a client with this and was finaly able to get it resolved by this method.

    See if This link gets you better results for the Sasser patch. Good luck.
    Reply With Quote Reply With Quote
  3. August 5th, 2004, 10:13 AM #3
    Darlid01
    Darlid01 is offline
    Registered User Darlid01's Avatar
    Join Date
    Jun 2004
    Posts
    26
    Yep! Kill all these. And I'm not sure about lhe.dll Since you keep a backup if you installed Hijack in it's own folder, I'd remove it and see if it causes any problem. When it comes to BHOs there are very few I like. Some of the stuff in there looks odd, but since you are from Germany I'm assuming it's a language version difference.
    I'd clear those and then run a pestscan from www.pestpatrol.com (It doesn't remove them using the online scanner, but it does identify them)

    repost when you've completed that and we'll take it from there.

    Now as far as the Windows update, you can download the updates manually as opposed to using the auto update site.
    I hate to ask, but are you sure you are using a valid version of windows? I came across a pirated version on a laptop I worked on, and it wouldn't update for the same reason. There is a link on the top of the windows page that you can use to "validate" your version.

    Zonie is too darn fast! Gah!

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about :blank


    Quote Originally Posted by molo
    Hey guys.

    I read about the problem in other threads and followed some of the instructions.

    Now, this is what I have done so far:

    Ran ( in safe mode )
    online virus check ( which found 1 trojan in my java cache [deleted that] )
    Spybot
    Adaware 6
    Spy Sweeper
    and after all Hijack This
    I have also downloaded Spyblaster and activated all the protection there is.
    I'm downloading BHODemon right now.
    /edit: BHODemon finds "lhe.dll" which is located in windows/system32/
    is that a "good" file ? or to be deleted ?
    plus: i can't update BHODemon. I deactivated my firewall, but it still won't get the updates.

    Spybot tells me about the DSO exploit, but as far as I understand there is no fix to that problem, or at least not a real one. I will later download all the Windows Security updates. (Which reminds me: when I wanted to use the update search thing (which checks which updates you already have) on the microsoft site my IE kept jumping to the about:blank search site.)

    So I still have the problem with my start page. How can I get rid of that ? Is there a connection between that and the DSO exploit ?

    Here's my latest Hijack This! log:

    Logfile of HijackThis v1.97.7
    Scan saved at 17:02:47, on 04.08.2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    d:\progra~1\0190wa~1\w0svc.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    d:\Programme\AVPersonal\AVWUPSRV.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    D:\PROGRA~1\0190WA~1\WARN0190.EXE
    D:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    D:\PROGRA~1\LEXMAR~1\AcBtnMgr_X84-X85.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printra y.exe
    D:\PROGRA~1\ZONEAL~1\zlclient.exe
    C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe
    C:\WINDOWS\Au51Fun.exe
    C:\Programme\Internet Explorer\IEXPLORE.EXE
    C:\Programme\Internet Explorer\IEXPLORE.EXE
    C:\Dokumente und Einstellungen\molo\Desktop\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\molo\LOKALE~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {F16571CD-1051-4C4E-8A3B-F07305AC8170} - C:\WINDOWS\System32\lhe.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [0190 Warner] D:\PROGRA~1\0190WA~1\WARN0190.EXE
    O4 - HKLM\..\Run: [Lexmark X84-X85 Button Monitor] d:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe
    O4 - HKLM\..\Run: [Lexmark X84-X85 Button Manager] d:\PROGRA~1\LEXMAR~1\AcBtnMgr_X84-X85.exe
    O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printra y.exe
    O4 - HKLM\..\Run: [Zone Labs Client] D:\PROGRA~1\ZONEAL~1\zlclient.exe
    O4 - HKCU\..\Run: [Aureon 5.1 Fun Mixer] C:\WINDOWS\System32\Aureon 5.1 Fun Mixer.exe /minimize
    O4 - HKCU\..\Run: [SpySweeper] "C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe" /0
    O4 - Startup: Kopie von ControlPanel.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office\Office\OSA9.EXE
    O9 - Extra 'Tools' menuitem: Sun Java Konsole (HKLM)
    O9 - Extra button: ICQ Pro (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\explorer.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
    O16 - DPF: {52290B25-D07A-43B5-84D8-493116D50FA0} (WebPlugin Class) - http://webinstall.tscash.com/webinstall.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/2531b5f5ec128c4...p/RdxIE601.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...987.4531944444
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/Sha.../bin/cabsa.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{59553750-18E9-4532-AD7C-F31AA5817B44}: NameServer = 62.104.191.241 62.104.196.134


    Is there stuff I should get rid of ?

    And another thing. Today I encountered the Sasser worm again. Weird, because I haven't had a problem with that in a long time. So I wanted to get the patch from Microsoft, but Windows always tells me, that the "file is corrupt" when I want to install it. What's up with that ? Is that a problem with my computer? Because I can't really imagine, that Microsoft has corrupt files for download. I tried the English version of the file too (I'm from Germany) with the same result.

    I appreciate your help already

    /edit again: well i thought cwshredder had removed the start page. it did work for about a minute, now the old things back up again. gonna try to do all the stuff again in safe mode...

    /editedit: nothing works. as soon as i connect to the internet (actually even before that) i get a note from spysweeper that something is changing ( or trying to ) my start page. and when i open my browser i have the search page again. please help me ! this is driving me nuts!
    Reply With Quote Reply With Quote
  4. August 5th, 2004, 10:58 AM #4
    NooNoo
    NooNoo is offline
    Driver Terrier NooNoo's Avatar
    Join Date
    Dec 2000
    Location
    UK
    Posts
    31,824
    You need to kill this one too
    O16 - DPF: {52290B25-D07A-43B5-84D8-493116D50FA0} (WebPlugin Class) - http://webinstall.tscash.com/webinstall.cab
    and find the webinstall.cab - probably in your temp internet files.
    Reply With Quote Reply With Quote
  5. August 5th, 2004, 11:00 AM #5
    Darlid01
    Darlid01 is offline
    Registered User Darlid01's Avatar
    Join Date
    Jun 2004
    Posts
    26
    Oops! Missed that one. Good eyes Noonoo.

    Quote Originally Posted by NooNoo
    You need to kill this one too
    O16 - DPF: {52290B25-D07A-43B5-84D8-493116D50FA0} (WebPlugin Class) - http://webinstall.tscash.com/webinstall.cab
    and find the webinstall.cab - probably in your temp internet files.
    Reply With Quote Reply With Quote
  6. August 6th, 2004, 11:34 AM #6
    molo
    molo is offline
    Registered User
    Join Date
    Aug 2004
    Posts
    4
    hey.

    well i know now what causes the start page problem. BHO Demon tells that it is the CoolWebSearch and i should use the CWShredder to get rid of it. But if i run it, it clears it and as soon as i connect to the net spysweeper tells me, that something has changed my startpage. well i will do the stuff you have told me and we will see.

    /edit: forgot something: Thank you !
    Last edited by molo; August 6th, 2004 at 11:37 AM.
    Reply With Quote Reply With Quote
  7. August 6th, 2004, 12:02 PM #7
    molo
    molo is offline
    Registered User
    Join Date
    Aug 2004
    Posts
    4
    seems like it finally worked. i booted in safe mode and ran CWShredder, Hijack This; SpySweeper and SpyBot. My start page hasn't changed back yet. Awesome. Thank you guys.

    Btw: That Update link worked for me too. Thanks again.
    Reply With Quote Reply With Quote
  8. August 6th, 2004, 02:46 PM #8
    NooNoo
    NooNoo is offline
    Driver Terrier NooNoo's Avatar
    Join Date
    Dec 2000
    Location
    UK
    Posts
    31,824
    Reply With Quote Reply With Quote
  9. August 6th, 2004, 06:43 PM #9
    molo
    molo is offline
    Registered User
    Join Date
    Aug 2004
    Posts
    4
    well SEEMED like it did work. but it didn't. when i just connected to the net, it came back on again. what the hell am i supposed to do ?
    Reply With Quote Reply With Quote
  10. August 7th, 2004, 05:31 AM #10
    NooNoo
    NooNoo is offline
    Driver Terrier NooNoo's Avatar
    Join Date
    Dec 2000
    Location
    UK
    Posts
    31,824
    If you go to a site where coolwebsearch is auto downloaded, then stop going to the site. Failing that install spybot 1.3 and the teatimer utility to block the site being able to download without your permission.

    Also use the immunise function in spybot to prevent further installations of other well known nasties.
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Similar Threads

  1. Cannot change the start page in IE6
    By karubin in forum Windows NT/2000
    Replies: 1
    Last Post: June 30th, 2004, 05:06 AM
  2. something hijacked my internet start page
    By cammstar in forum Windows XP
    Replies: 1
    Last Post: June 17th, 2004, 11:58 AM
  3. Help Win ME errors
    By riasat3 in forum Windows 95/98/98SE/ME
    Replies: 1
    Last Post: August 17th, 2001, 08:18 AM
  4. Problem with Forum page counts
    By beach101 in forum Comments and Suggestions
    Replies: 3
    Last Post: February 24th, 2001, 07:31 PM
  5. [RESOLVED] How to approach invalid page fault problem
    By JohnZonie in forum Windows 95/98/98SE/ME
    Replies: 0
    Last Post: September 29th, 2000, 09:50 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules