spyware?keeps taking my homepage and closes internet explorer

From: sgopus (anonymous_at_discussions.microsoft.com)
Date: 05/18/04 

Date: Tue, 18 May 2004 12:15:31 -0700

This is another coolweb search variant.
Here is how to remove it.
How do I Remove Lookfor.cc homepage hijacker and IEFEATS.A
trojan?

1) Start Windows in Safe Mode by pressing F8 as the
computer is booting and choosing Safe Mode

2) Remove the Registry entries

Click on Start, Run, Regedit
In the left panel go to
HKEY_CURRENT_USER>Software>Microsoft>Windows>Current
Version>Runonce

In the right panel, right-click and delete the following
entry (if it exists)
iefeats1Update = "rundll32 <path to
virus>\iefeats1.dll,UpdateDlls"

Close the Registry Editor
3) Delete the infected files (for Windows ME and XP
remember to turn off System Restore before searching for
and deleting these files to remove infected backed up
files as well)

Click Start, point to Find or Search, and then click Files
or Folders.
Make sure that "Look in" is set to (C:\WINDOWS).
In the "Named" or "Search for..." box, type, or copy and
paste, the file names:
IEFEATSL.DLL
MSIESH.DLL
SUBMITHOOK.DLL
UNINSTALL.EXE
UNINSTALL.INI
MSHP.DLL
Click Find Now or Search Now.
Delete the displayed files.
4) Reset Internet Explorer Homepage and Search Page

Close all Internet Explorer windows.
Open Control Panel. Click Start>Settings>Control Panel.
Double-click the Internet Options icon.
In the Internet Properties window, click the Programs tab.
Click the "Reset Web Settings." button.
Select "Also reset my home page." Click Yes.
Click OK.
4) Reboot the computer and download and run CWShredder,
created by Merijn of Spywareinfo.com. Merijn has an entire
page devoted to CoolWebSearch and its many variants.

You can download CWShredder by clicking on this link.

5) Run a thorough virus scan using your favorite antivirus
program or Housecall, Trend Micro's online virus scanner

>-----Original Message-----
>Help,
>my home page resets to
>res://mshp.dll/index.html#37049
>and it looks like a microsoft site but is not. It comes
back even after running adware and resetting my homepage. \
>.
>

Relevant Pages

  • Re: IE 7 - malware?
    ... A day or two ago, when I tried to load HP Director, the panel ... caused by the upgrading of Internet Explorer to v. 7. ... Director Software Does Not Display After Installing Internet ... On the Add/remove windows Components Uncheck the Check Box for Internet ...
    (microsoft.public.windowsxp.newusers)
  • Re: send page by email in ie 6 taken over by netscape
    ... Troubleshooting Internet Explorer in Windows XP ... "jon straub" wrote in message: ... I have reset the default email program to outlook, ...
    (microsoft.public.windowsxp.general)
  • Re: Internet Explorer doesnt prompt me to be the default browser
    ... For Windows XP, you can use this .REG file which sets IE as the default: ... I've been trying for ages to get Internet Explorer to be the default ... My problem started when I set Firefox to be my default browser to try ... what about if I reset the web settings? ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: KDE Panel: automatic hide/unhide stopped working.
    ... Murphy's Law? ... I tried "allow other windows to cover the panel", ... found that worked, reset to "hide automatically", and that now works. ...
    (comp.windows.x.kde)
  • Re: Internet Options Disabled
    ... If you have Windows 98 or ME, From Control Panel select Add/Remove Programs. ... Scroll down to Microsoft Internet Explorer and highlight it. ... When the IE Tools menu comes up, select Repair. ... > tried to reset it and reboot, and I even used some spyware ...
    (microsoft.public.windows.inetexplorer.ie6.browser)