Forum Home
Press F1
 
Thread ID: 52729 2004-12-28 07:33:00 Malware Cliffy (6695) Press F1
Post ID Timestamp Content User
308219 2004-12-28 07:33:00 I am having problems with my Web Browser automatically resetting its home page away from the default home page I had set up. It is redirecting itself (after EVERY close down of the computer) to COOLWEB SEARCH , MALWARE , this programme is apparently found and tracked by Adware in ;C:\WINDOWS\SYSTEM\SYSTIME.EXE. Once Adware takes care of it, I can then reinstall the home page defult again, but on close down of Computer once again it reininstalls itself and I have to ONCE AGAIN go thru the procedure of running Adware to delete it,BUT it DOESNT EVER delete PERMANENTLY. Can ANYONE PLEASE HELP !!!!! ANY help would be much appreciated.
Regards Cliffy.
Cliffy (6695)
308220 2004-12-28 07:53:00 Try this

Click Start > Run .

Type regedit

Then click OK .


Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run


In the right pane, delete the value:

"SysTime" = "%SYSTEM%\systime . exe"


Reset the following values:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

to the default site of your choice .


Exit the Registry Editor .
Speedy Gonzales (78)
308221 2004-12-28 08:15:00 Check out the Spyware FAQ here (pressf1.pcworld.co.nz). FoxyMX (5)
308222 2004-12-28 08:43:00 There is a removal tool for that cwshredder
here (www.spywareinfo.com)
hth
johnboy (217)
308223 2004-12-28 12:25:00 I am having problems with

ECT

ANY help would be much appreciated.
Regards Cliffy.

IF you have system restore. you MAY also need to nuke it.

D.
drb1 (4492)
308224 2004-12-28 21:35:00 For your information, CWShredder was developed to kill this Hijacker and it's variants by Merijn. He has moved on to other things, and Intermute has picked it up to keep CWShredder updated with new variants. ( and probably to get people to their site and products
;) )

New address for CWShredder...

www.intermute.com
pheonix (36)
308225 2004-12-29 02:48:00 Just want to say to all those people that replied to my problem, THANK YOU ALL for your help and advice. I have now got my Computer "BACK" , yahoo !!
Secial mention goes to "johnboy" and "phoenix" THANKS GUYS !!! Much appreciated !!!!!
Yours etc
Cliffy
Cliffy (6695)
1