PDA

View Full Version : Malware



Cliffy
28-12-2004, 08:33 PM
I am having problems with my Web Browser automatically resetting its home page away from the default home page I had set up. It is redirecting itself (after EVERY close down of the computer) to COOLWEB SEARCH , MALWARE , this programme is apparently found and tracked by Adware in ;C:\WINDOWS\SYSTEM\SYSTIME.EXE. Once Adware takes care of it, I can then reinstall the home page defult again, but on close down of Computer once again it reininstalls itself and I have to ONCE AGAIN go thru the procedure of running Adware to delete it,BUT it DOESNT EVER delete PERMANENTLY. Can ANYONE PLEASE HELP !!!!! ANY help would be much appreciated.
Regards Cliffy.

Speedy Gonzales
28-12-2004, 08:53 PM
Try this

Click Start > Run.

Type regedit

Then click OK.


Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run


In the right pane, delete the value:

"SysTime" = "%SYSTEM%\systime.exe"


Reset the following values:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

to the default site of your choice.


Exit the Registry Editor.

FoxyMX
28-12-2004, 09:15 PM
Check out the Spyware FAQ here (http://pressf1.pcworld.co.nz/faq.php?).

johnboy
28-12-2004, 09:43 PM
There is a removal tool for that cwshredder
here (http://www.spywareinfo.com/~merijn/cwschronicles.html)
hth

drb1
29-12-2004, 01:25 AM
I am having problems with

ECT

ANY help would be much appreciated.
Regards Cliffy.

IF you have system restore. you MAY also need to nuke it.

D.

pheonix
29-12-2004, 10:35 AM
For your information, CWShredder was developed to kill this Hijacker and it's variants by Merijn. He has moved on to other things, and Intermute has picked it up to keep CWShredder updated with new variants. ( and probably to get people to their site and products
;) )

New address for CWShredder...

http://www.intermute.com/products/cwshredder.html

Cliffy
29-12-2004, 03:48 PM
Just want to say to all those people that replied to my problem, THANK YOU ALL for your help and advice. I have now got my Computer "BACK" , yahoo !!
Secial mention goes to "johnboy" and "phoenix" THANKS GUYS !!! Much appreciated !!!!!
Yours etc
Cliffy