My friend's computer has a virus that will always reset the homepage to a certain website XXX (not the movie). I have searched the registry and changed every reference, and at re-boot, all is changed back. Please help me find the malicious file that is responsible. ( the site is sexhound ) usually an inactive page but still annoying.

he prob has this firstly empty temp internet files folder This is the solution for cool-xxx.net problem: 1. Delete WINSYS.VBS (.VBA) from windows directory 2. Delete WIN0.TXT and WIN1.TXT from windows directory 3. Set correct home/search/etc pages (an easy way is “restore defaults” and then setting the preferred homepage) 4. Run MSCONFIG (on non-2000 boxes) and remove WINSYS.VBA from the Startup tab 5. Reboot check these earlier pages and posts on this problem: http://computing.net/security/wwwboard/forum/203.html http://computing.net/security/wwwboard/forum/138.html

Try http:/www.spywareinfo.com/hijacked.html, and then get Spybot and/or Adaware to eliminate all the spyware. Run the the full system scan at PC Pitstop to make sure your security settings are correct, it will also check the computers performance. Since your friend likes to visit and use high risk websites it is important that these settings are correct, and that he knows that these sites can cause big problems. Make sure he knows to never even think about checking out any WAREZ website for some free porn or downloads. An antivirus program like Norton, that has script blocking built into it would be a wise investment. You can also use the scans at PC Flank and Browsercheck to set the browser settings up for him. Do not go crazy as they can make surfing the net a big hassel. He must be educated and informed of the internet dangers. Take care and all the best!

Iparmor will detect and kill both known and unknown trojans. This useful system-tray utility packs a lot of punch and the known virus database can be updated daily. It has a host of tools to help protect you from Internet-borne harm. Upon startup, it scans your memory for trojan-like activity and immediately disables any suspicious tasks and reports its findings. You can restore any system critical files for the next reboot. Iparmor allows you to view all remaining currently active processes, scan currently active ports, and lists those applications that are registered to start when Windows next loads.