IE6 home page keeps getting changed

My home page is always set to be a blank page, yet over the last few days out of the clear blue it keeps getting changed to "cool-search.net ".

Anyone have any idea how this is happening?

WinXP Pro
IE6 SP1
All XP and IE patches

 

Hi Blueberry

Is you java virtual machine up to date ?
and what do you use microsofts or suns ?

Get the removal tool CWShredder ,see if this sounds familur its,,, at the bottm of this page
http://www.spywareinfo.com/~merijn/cwschronicles.html

restart even if not prompted,, surf awhile then get and run
hijackthis

Post a log from HijackThis so one of the experts can see what's going on.

HijackThis Quick Start
http://www.tomcoyote.org/hjt/
http://www.spywareinfo.com/~merijn/
Unzip, double-click HijackThis.exe, and hit "Scan ".
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, load it in Notepad, and copy its contents here. Most of what it lists will be harmless or even essential,
don't fix anything yet.

No need to post its sratup log ,as in config ,misc tools,generate startup list unless someone requests it
Lonny

 

Thanks for your response - sorry for the delay, but apparently my original post was moved and I did not get an e-mail notice when your replied. Anyway, here is my log which is chock full of referances to the cool-search ****:

Logfile of HijackThis v1.97.3
Scan saved at 11:35:54 AM, on 11/10/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\CPal\CPBrWtch.exe
C:\Program Files\PopUp Killer\popupkiller.EXE
C:\Program Files\Software by Design\Calendar.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\AtomTime\ATOMTIME.EXE
C:\Program Files\TIME\TIME.EXE
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\CPal\CPal.exe
C:\WINDOWS\Utils\Zoomer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\User\Local Settings\Temp\Temporary Directory 3 for hijackthis_temp.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cool-homepage.co
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://cool-homepage.co
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cool-search.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://cool-search.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cool-homepage.co
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://cool-homepage.co
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://cool-homepage.co
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://cool-search.net/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1} - C:\WINDOWS\msfeme.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe "
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [Cookie Pal] "C:\Program Files\CPal\CPBrWtch.exe "
O4 - HKLM\..\Run: [PopUpKiller] C:\Program Files\PopUp Killer\popupkiller.EXE
O4 - Startup: Calendar 2000.lnk = C:\Program Files\Software by Design\Calendar.exe
O4 - Startup: Norton System Doctor.LNK = C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
O4 - Startup: Shortcut to ATOMTIME.EXE.lnk = C:\Program Files\AtomTime\ATOMTIME.EXE
O4 - Startup: Shortcut to TIME.EXE.lnk = C:\Program Files\TIME\TIME.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {87BF5318-D5F0-41F4-9D14-47967FA8C12B} - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37874.4416319444
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Would really appreciate anyone's help in getting rid of this thing. Right now it's just annoying - hope it doesn't (isn't??!??) doing anything worse.

 

I would take Lonny's advice and run the removal tool(if you
haven't done so already) CWShredder.
You may also want to get a spyware checker such as
Spybot
or Ad-aware

Personally I have both installed, in either case you will want
to install the program and then go online and update the
reference files.
Then repost your Hijack this log.

 

Hello blueberry,

Good advice from Lonny and indmusic.

Additional boards to post your log:

http://www.wilderssecurity.com/index.php

http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi

Each have sections for this pupose.

StartPageGuard warns you if something tries to change the homepage http://www.webattack.com/get/startpageguard.shtml

Regards - Charles

 

Hi

they just came out with new version's important for both 9x
and XP
===============
HijackThis 1.97.5, CWShredder 1.30.2: http://forums.spywareinfo.com/index.php?showtopic=16453

Everyone should use the latest versions, but these are very important fixes for Win9x users. This cures the major problem with fixing DReplace.dll in Windows98 Gold, Windows98 SE, and Windows ME.

You need to download them manually. The internal updater usually only recognizes major version changes.
(I checked and mine would have)

HijackThis 1.97.5 http://www.spywareinfo.com/~merijn/files/hijackthis.zip

CWShredder 1.30.2 http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Note: There was no bug in either program. A hijacker used an entirely new method which had to be analyzed by Merijn and the Experts, and a solution devised.
=========
If You delay msfeme.dll maybe under a differant name, is so
update both tools and post another log
if not close all ie's and wndows and have hijackthis fix these
>>>>>>>
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cool-homepage.co
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://cool-homepage.co
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cool-search.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://cool-search.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cool-homepage.co
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://cool-homepage.co
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://cool-homepage.co
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://cool-search.net/
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1} - C:\WINDOWS\msfeme.dll
=====
"Fix Checked "...reboot

after restarting.......go to C:\WINDOWS & delete msfeme.dll
===
Good luck and let us know
Lonny

 

Thanks Lonny, I was still using Hijack This version 1.96
Here is also a tutorial on Hijackthis. Gives you some incite
of what you are looking at Spyware info

 

OK - deleted all the cool-search entries and msfeme.dll and that seems to have done the trick. So far everything is clean and working well, and my home page hasn't been messed with!

Woohoo!!

Thanks

 

Blueberry

thanks for posting back, and letting us know it worked.
dont forget to keep windows ,IE up to date.

Lonny