| Here's another example of the many variants of
the Coolwebsearch
homepage hijacker. It changes your homepage to
res://mshp.dll/index.html#10213. Although using the normal steps to
remove one of the many variants of coolwebsearch should remove it, it
appears this variant is also part of a trojan virus called TROJ_IEFEATS.A
. Because of this I have modified these directions to include
instructions for removing the possible trojan as well as the homepage
hijacker.
If you are looking for the new hijacker that is using a random.dll in the form of res://random.dll/index.html#random number, then visit my page here |
How do I Remove Lookfor.cc homepage hijacker and IEFEATS.A trojan?
1) Start Windows in Safe Mode by pressing F8 as the computer is booting and choosing Safe Mode
2) Remove the Registry entries
- Click on Start, Run, Regedit
- In the left panel go to
HKEY_CURRENT_USER>Software>Microsoft>Windows>Current Version>Runonce
- In the right panel, right-click and delete the following entry (if it exists)
iefeats1Update = "rundll32 <path to virus>\iefeats1.dll,UpdateDlls"
- Close the Registry Editor
3) Delete the infected files (for Windows ME and XP remember to turn off System Restore before searching for and deleting these files to remove infected backed up files as well)
- Click Start, point to Find or Search, and then click Files or Folders.
- Make sure that "Look in" is set to (C:\WINDOWS).
- In the
"Named" or "Search for..." box, type, or copy and paste, the file names:
IEFEATSL.DLL
MSIESH.DLL
SUBMITHOOK.DLL
UNINSTALL.EXE
UNINSTALL.INI
MSHP.DLL - Click Find Now or Search Now.
- Delete the displayed files.
4) Reset Internet Explorer Homepage and Search Page
- Close all Internet Explorer windows.
- Open Control Panel. Click Start>Settings>Control Panel.
- Double-click the Internet Options icon.
- In the Internet Properties window, click the Programs tab.
- Click the “Reset Web Settings…” button.
- Select “Also reset my home page.” Click Yes.
- Click OK.
4) Reboot the computer and download and run CWShredder, created by Merijn of Spywareinfo.com. Merijn has an entire page devoted to CoolWebSearch and its many variants.
You can download CWShredder by clicking on this link.
5) Run a thorough virus scan using your favorite antivirus program or Housecall, Trend Micro's online virus scanner.
Printer Friendly Version of This Page
Bookmark and Share this Article on PCHELL with these Social Networks:
Removal Instructions for Other Programs
Spyware Removal and Other Resources
Essential Tools for Removing Spyware, Adware, and Malware
Rootkit Removal Tools and Help
How to Delete Undeleteable Files
Review of Free Registry Cleaner
How to Manually Run the Microsoft Malicious Software Removal Tool
How to Remove Windows Diagnostic or Windows Restore malware
Bargain Buddy Removal Instructions and Help
Click2FindNow and I-Lookup Removal
Electronic Greeting Card Virus - MSDATAACCESS.EXE Removal Instructions and Help
Powered by Zedo Popup Ad Removal Instructions and Help
Search and Destroy Removal Instructions and Help
Spyaxe, Spy Trooper, Spy Sheriff, Brave Sentry and Similar Removal Instructions and Help
TheSpyBot Removal Instructions and Help
Spam Blocker Utility Removal Instructions and Help
DriveCleaner Removal Instructions and Help
Alfacleaner Removal Instructions and Help
Spylocked Removal Instructions and Help
AntivirusGolden Removal Instructions and Help
VirusProtectPro Removal Instructions and Help
UltimateDefender and UltimateCleaner 2007 Removal Instructions and Help
VirusRescue Removal Instructions and Help
PestCapture Removal Instructions and Help
SystemDoctor 2006 Removal Instructions and Help
How to Fix Task Manager disabled by your Administrator
How to Fix Problem Changing Desktop Wallpaper
How to Remove SmitFraud Variants like WinAntivirus Pro 2007 and PestCapture
SurfSideKick Removal Instructions and Help
How to Remove Zango Search Assistant and Toolbar
About:Blank Homepage Hijacker Removal Instructions and Help
Kazaa Removal Instructions and Help
How to Disable Windows XP Security Alert Balloons and Notifications
res://random.dll Homepage Hijacker Removal Instructions and Help
IBIS Web Search (websearch.com) Removal Instructions and Help
Open Search Web (Lop.com) Removal Instructions and Help
UPDMGR.EXE Removal Instructions and Help
FCADVICE.EXE Removal Instructions and Help
U3 Smart Drives - What are they and how to remove U3
Dubolom.com Homepage Hijacker Removal Instructions and Help
DSO Exploit Removal Instructions and Help
FastSearch.cc Homepage Hijacker Removal Instructions and Help
My Web Search Removal Instructions and Help
Cursor Mania Removal Instructions and Help
Fun Buddy Icons Removal Instructions and Help
Smiley Central Removal Instructions and Help
My Mail Stamps Removal Instructions and Help
My Mail Stationery Removal Instructions and Help
My Mail Signatures Removal Instructions and Help
Fun Web Products Popular Screensavers Removal Instructions and Help
Webfetti Removal Instructions and Help
What is PDF Spam and Does it Contain Viruses
Hugesearch.net Homepage Hijacker Removal Instructions and Help
Search-Space.com and Start-Space.com Homepage Hijacker Removal Instructions and Help
How to Remove Global-Finder.com Homepage Hijacker
Huntbar and Search Toolbar Info and Removal
Look2Me Removal Instructions and Help
Lookfor.cc (res://mshp.dll/index.html) Homepage Hijacker Removal Instructions and Help
MaximumSearch.net Homepage Hijacker Removal Instructions and Help
Ncase Removal Instructions and Help
People OnPage Toolbar Info and Removal
SearchMyRequest.com Homepage Hijacker Removal Instructions and Help
Smartsearch.ws Homepage Hijacker Removal Instructions and Help
SysUpd.exe (TSCash) Removal Instructions and Help
Ezula TopText (yellow underlined links) Removal Instructions and Help
How to Remove SpeedBlaster and MemoryMeter
TopRebates and WebRebates Removal Instructions and Help
Twaintec.dll Removal Instructions and Help
Viewpoint Removal Instructions and Help
WildTangent Removal Instructions and Help
| Search PCHell.com |
|
| site search by freefind | advanced |
Tools for Removing Spyware, Adware, and Malware
PC HELL
Other Pages
Welchia (Dllhost.exe and SVCHost.exe) Worm Removal
Uninstall Antivir Instructions
How to Manually Run the Microsoft Malicious Software Removal Tool
Bloodhound.Exploit.6 Virus Removal
Backdoor SDBot.H Trojan Removal
iPadastic - News, Tutorials, Help, Tips, and Hints for the iPad
Download Hoyle Games
including Casino 3D, Card, Board, and Solitaire games.
