IE home page is being hijacked

[Richardk]

Everytime I reset a friends home page in IE, it goes back to some crap after we reboot. Ran Ad-aware but still need to check registry settings. Nothing is in the startup. Any ideas?
Thanks.

[TRexx]

Sounds like CoolWebSearch, a particularly nasty virus.

www.softpedia.com/public/...-150.shtml

[The Gorn]

Suggestions:

Use "Bazooka" to do an inventory of viruses and adware found on the system. Bazooka is inert, all it does is find and list malware; it does no removal.

If Coolwebsearch is indicated, look for and download "Coolwebshredder". AFAIK, none of the all in one adware solutions deal well with Coolwebsearch.

You may have to print off instructions and boot the system to the recovery console to find and remove any remaining crap.

[The Original Dinosaur]

google shows many links.  This came up first.

Bazooka

[boty]

A couple of points here:

1. Run AdAware in safe-mode as some of the hijacker/spyware procsses like to hide as running system processes and hence can't be removed.

2. Download, update and then run in safe-mode Spybot Search and Destroy - wierd name, but effective, as it will find stuff that AdAware leaves behind.

3. In safe-mode, run MSConfig and look for strange start-up processes. Remove them from start-up, or they will come back and have to be removed again.

Good luck!