Results 1 to 10 of 10
  1. #1
    2 Star Lounger
    Join Date
    Sep 2002
    Posts
    180
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Homepage defaults to HTTP://YOUR-SEARCH.CC (IE 6.0.2600 SP1)

    How can I fix this? The default homepage keeps changing to http://your-search.cc

    I am scanning the registry now. I also ran Ad-Aware and Spybot Search & Destroy.

    Thanks

  2. #2
    Plutonium Lounger Leif's Avatar
    Join Date
    Dec 2000
    Location
    U.K.
    Posts
    14,010
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Homepage defaults to HTTP://YOUR-SEARCH.CC (IE 6.0.2600 SP1)

    Sounds like you've been Hijacked!

    Check this Starpost - plus <post#=343516>post 343516</post#> and its replies may given you some additional fodder.

  3. #3
    Uranium Lounger viking33's Avatar
    Join Date
    Jun 2002
    Location
    Cape Cod, Massachusetts, USA
    Posts
    6,308
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Homepage defaults to HTTP://YOUR-SEARCH.CC (IE 6.0.2600 SP1)

    Leif,

    I've never the pleasure (?) of being HiJacked, but my thought is, couldn't you just go to the IE Options, General tab and change the Home page setting back to whatever?
    Or wouldn't this stick and again be over riddden by the Hijack intrusion?

    Just curious.

    Bob
    BOB
    http://lounge.windowssecrets.com/S/flags/USA.gif http://lounge.windowssecrets.com/S/f...sachusetts.gif


    Long ago, there was a time when men cursed and beat on the ground with sticks. It was called witchcraft.
    Today it is called golf!

  4. #4
    Plutonium Lounger Leif's Avatar
    Join Date
    Dec 2000
    Location
    U.K.
    Posts
    14,010
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Homepage defaults to HTTP://YOUR-SEARCH.CC (IE 6.0.2600 SP1)

    I've never had that 'pleasure' either <img src=/S/laugh.gif border=0 alt=laugh width=15 height=15>.
    My understanding of hijacking is that it over-rides your setting there, and my reading of the original post - "...keeps changing to ..." - was that attempts to reset it repeatedly failed.

    I just came across <post#=339679>post 339679</post#> which shows another "search.cc" parasite at work.....

  5. #5
    Silver Lounger
    Join Date
    Jan 2001
    Location
    Long Beach, California, USA
    Posts
    1,912
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Homepage defaults to HTTP://YOUR-SEARCH.CC (IE 6.0.2600 SP1)

    FWIW: the usual Hijack method involves using a script to keep changing the Home Page back to the 'evil' one. So, you can go into Internet Explorer and change your Home Page as many times as you like. However, the next time you reboot, the Home Page is changed back to the site you don't want. Alternatively, the script could be run as a Scheduled Task -- every day at 12:00 noon the script could run and change the Home Page.

    The report of the Home Page chaging back immediately after the user modified it is rather worrisome. That implies something running with IE (a Browser Helper Object or ActiveX Control??) is changing the setting almost instanteously. That is scary!

    Regardless, I would recomend getting and running HijackThis. It should identify the problem.

  6. #6
    3 Star Lounger
    Join Date
    Nov 2001
    Posts
    342
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Homepage defaults to HTTP://YOUR-SEARCH.CC (IE 6.0.2600 SP1)

    I had the hijack problem.
    I ran Ad-aware and Spybot Search and Destroy, and although they picked up data-miners, they did not eliminate my hijack problem. I then ran HijackThis, and couldn't make head or tail of the result - and the forum site has been hit with a denial of service for a few days now.

    I got a hole of "CWShredder.exe" which is also referred to in the forum site references in this thread, and that - finally - did the trick.

    BTW, I then ran HijackThis again after restoring my home page and removing the offending script, compared it to the log it created when my site was hijacked and the script still existing, and only difference was in the Search Bar, Search Page and Start Page settings, which I knew about anyway, so it was pretty useless.

    Bottom line - use "CWShredder.exe" to get rid of the script that changes your home page every time you reboot. Also use Ad-aware and S&D to get rid of data miners. Forget HIjackThis.

    Hope this helps!

  7. #7
    Silver Lounger
    Join Date
    Jan 2001
    Location
    Long Beach, California, USA
    Posts
    1,912
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Homepage defaults to HTTP://YOUR-SEARCH.CC (IE 6.0.2600 SP1)

    HiJackThis is quite powerful. Even if the main program did not pick up the problem, inside is an applet called StartupList that would have identified the culprit. However, Coolwebsearch is a difficult problem to remove.

    Do you realize that the author of HiJackThis ALSO wrote CWShredder? He did it because Coolwebsearch was too difficult and too variable to stick into HiJackThis. His name if Merijn.

    Also, even if the site is under a DDoS attack, you could have posted the logs here.

  8. #8
    3 Star Lounger
    Join Date
    Nov 2001
    Posts
    342
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Homepage defaults to HTTP://YOUR-SEARCH.CC (IE 6.0.2600 SP1)

    R2, this whole area of hijacking browser pages is new territory for me. Fact is, when I compared the logs HijackThis made before and after, only the differing homepages/search pages showed. Pretty useless. CWS was the only product that fixed it.
    I discovered yesterday that the constant "hppt error" I was getting from the HijackThis forum was a DNS - as I said, this is new territory - hence why I *did* post it yesterday.
    Didn't know the two products were made by the same person. Bit of a non sequiter. Not to worry, the point is that CWS may well fix the problem where all else have failed, and that's the bottom line.
    Everything I discovered is in my previous post - just trying to give all the information that might help c1fer and anyone else who is experiencing these most irritating and quite distressing problems.

    btw thanks for the tip regarding 'starupthis' - didn't know about that - I'll go have a play with that and see how it works!

  9. #9
    Silver Lounger
    Join Date
    Jan 2001
    Location
    Long Beach, California, USA
    Posts
    1,912
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Homepage defaults to HTTP://YOUR-SEARCH.CC (IE 6.0.2600 SP1)

    My point was that I do not think that HijackThis is useless by any shake of the stick. Grant it, it might fail with Coolwebsearch -- and that is why the author of HijackThis created CWShredder -- but I take offense to saying that HijackThis is a useless tool. It has and will continue to solve many people's problems. The author is well aware of the deficiencies when it comes to Coolwebsearch and he did something about it in creating CWShredder.

  10. #10
    3 Star Lounger
    Join Date
    Nov 2001
    Posts
    342
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Homepage defaults to HTTP://YOUR-SEARCH.CC (IE 6.0.2600 SP1)

    No offence intended - not at all. Being new to this i was frustrated at it not solving my problem, and the log wasn't of much help to me as I explained, but if it helps others, I'm all for it. The more tools we have the better. The real offence as far as I'm concerned is against the unconscionable people who steal our home pages and search pages, forcing us to their sites.

    Those who have the decency and public spirit to create freeware programs like HijackThis, CWShredder and all the others that are designed to help the computing community battle these unscrupulous creatures have my unqualified support and respect.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •