Hi Andrew - This is often indicative of malware hijacking of your computer.
Try the following:
The best way to start is to get Ad-Aware 6.0, Build 162 or later, here:
http://www.lavasoftusa.com/support/download/. Update and run this regularly
to get rid of most "spyware/hijackware" on your machine.
Another excellent program for this purpose is SpyBot Search and Destroy
available here:
http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After fixing things with SpyBot S&D (I recommend only
the "Red" initially - you can get into difficulties otherwise), be sure to
re-boot and rerun SpyBot again and repeat this cycle until you get a clean
"no red" scan.
Once you're sure you are "clean", then enter the following (NOT including
the dashed lines) into Notepad and save as: RestoreSearch.reg, then double
click on the saved file to restore your default search settings.
----------------------------
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Do404Search"=hex:01,00,00,00
"Search Page"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="
http://search.msn.com/intl/searchpane/en-au/prov2.htm"
"Use Custom Search URL"= dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"SearchAssistant"="
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.
htm"
"CustomizeSearch"="
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.
htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"
"Search Page"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="
http://home.microsoft.com/access/autosearch.asp?p=%s"
" "="+"
"&"="%26"
"+"="%2B"
"#"="%23"
"?"="%3F"
"="="%3D"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Search Page"="
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar="
http://search.msn.com/intl/searchpane/en-au/prov2.htm"
---------------------------
Finally, you might want to consider installing the SpywareBlaster and
SpywareGuard here to help prevent this kind of thing from happening in the
future:
http://www.wilderssecurity.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it updated) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.
http://www.wilderssecurity.net/spywareguard.html (Monitors for attempts to
install malware) Both Very Highly Recommended.
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
In
