IE won't or can't maintain my home page on startup

[Guest]

When I open up IE I always get this address: res://mshp.dll/index.html#1237
I go into tool, internet options and set my home page to well, my home page of http://www.watercolor-online.com. When I close and reopen IE it goes back to res://mshp.dll/index.html#12372. This is some kind of a search engine that I can't get rid of. At the top of the page it has the MS logo of the red, green, blue and yellow flag and next to that it has the words "Home search". On the left side is a series of vertical buttons like books, flowers, loan, mortgage etc. These are buttons for default searches. The middle and majority of the page is a web site directory organized by subject

Does anyone know how to remove this thing. Thanks in advance

 

[Frank Saunders, MS-MVP]

When I open up IE I always get this address:
res://mshp.dll/index.html#12372
I go into tool, internet options and set my home page to well, my
home page of http://www.watercolor-online.com. When I close and
reopen IE it goes back to res://mshp.dll/index.html#12372. This is
some kind of a search engine that I can't get rid of. At the top of
the page it has the MS logo of the red, green, blue and yellow flag
and next to that it has the words "Home search". On the left side is
a series of vertical buttons like books, flowers, loan, mortgage etc.
These are buttons for default searches. The middle and majority of
the page is a web site directory organized by subject.

Does anyone know how to remove this thing. Thanks in advance

mshp.dll = coolwebsearch trojan
How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Debbie Breining]

Hi Frank,
I have a similar trojan but I can't decipher which one it
is. The Web page that it keeps going to is:
http://homepage.com
@www%
2e%65%2d%66%69%6e%64%65%72%2e%63%63/%68%70/ and the top
of the web page just says invalid syntax.

I ran the virus scan and it identified and deleted
download.trojan. I turned off my system restore, ran the
virus scan again, and then edited my registry to get rid
of the offending entries, but it still comes back.

What I find is:
HKEY_LOCAL_MACHINE\software\microsoft\internet
explorer\main and the start page entry reverts to the
info above.

Any suggestions? Please say yes.
Debbie Breining

 

[Frank Saunders, MS-MVP]

Hi Frank,
I have a similar trojan but I can't decipher which one it
is. The Web page that it keeps going to is:
http://homepage.com
@www%
2e%65%2d%66%69%6e%64%65%72%2e%63%63/%68%70/ and the top
of the web page just says invalid syntax.

I ran the virus scan and it identified and deleted
download.trojan. I turned off my system restore, ran the
virus scan again, and then edited my registry to get rid
of the offending entries, but it still comes back.

What I find is:
HKEY_LOCAL_MACHINE\software\microsoft\internet
explorer\main and the start page entry reverts to the
info above.

Any suggestions? Please say yes.
Debbie Breining

Run CWShredder. See my answer above.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Debbie]

CWShredder worked. Thanks very much. Don't these kids
who write these wicked trojans have anything better to do
like solve world hunger or work toward peace?!