Virus... Homepage

[(RIP) willstatt]

I've noticed my PC has been getting a bit slow. I do regular disk cleanups and scandisk and don't open any unsolicited emails. Now also, my homepage keeps getting 'pirated' www.ukgser.com/forums is my chosen homepage, but everytime I restart my PC, something called www.search-space.com has made itself the homepage.... it is VERY annoying.

where do I look to erase the little worm that is doing this?

I have run my totally up to date AVG 6.0 anti-virus software, but nothing is found.

I'm running XP

Any help VERY MUCH appreciated.

Will

 

[(RIP) willstatt]

Search too!

Also, when I try and do a 'search' (Start button followed by 'search' button) the desktop locks up for about 30 secs and no search window appears.... I was going to search for anything that mentioned the homepage name.

Is it easy to do an Xp re-install if that's what I need?

Pleease help

Oh yes.... Merry Xmas to all

Will

 

[Gecko]

Re: Search too!

Also, when I try and do a 'search' (Start button followed by 'search' button) the desktop locks up for about 30 secs and no search window appears.... I was going to search for anything that mentioned the homepage name.

Is it easy to do an Xp re-install if that's what I need?

Pleease help

Oh yes.... Merry Xmas to all

Will

Will
Not from me but from young Master Gecko who is studying IT at Uni, he recommends downloading something called 'ad-aware' which is available free from www.ad-aware.com . This will enable you to remove these kind of annoying forced advertisments including the one that you have. Good luck with it. Let us know how you get on.
Gecko

 

[Fanum]

Will....i'm pretty sure this isnt as simple as removing it with adaware, even though thats a fine bit of kit and well worth using anyway.

The bad news is you are gonna have to edit the registry..........there's a particular line that you need to copy, rename, save and then modify........I can't remember off hand the key but I'll have a look in a bit and post it here.....but try a search in Google using search-space and registry fix or something like that and you should find it easy enough.......

I'll get back here in while when i have a few more minutes.......

 

[Gecko]

I thought you could edit the registry through ad-aware ???

 

[Fanum]

Hmmm it does some basic stuff within ther registry yes, but i don't think it does the whole thing on search-space.

Will....you need a thing called HijackThis! which will produce a log of the services that are running and then you do the following to clear it.......


Find the following entry in the HijackThis! log:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-space.com/

Close all windows, and choose 'Fix checked', to let HijackThis! remove it.

While offline reset IE home page in Tools>Internet Options>General tab, to your preference.

Next, in the Security tab enter the search-space website into 'Restricted Sites'.

Back to the General tab, clear Temporary Internet Files, Cookies, and History.

Reboot.

This should solve it.......or as you mentioned you can reinstall xp or just try reinstalling the latest version of IE........If you go for the full XP reinstall dont forget to export all your settings using the wizrd first, and back up everything just in case....

Good luck chap!!

 

[Cheesy Mike]

This is a real b'stard of a worm. See the following linke where you can download a piece of software called cwshredder - read the background info as well, it is quite interesting.

http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Mike

 

[(RIP) willstatt]

Boooger

Bloody hell.... it is a bad one isn't it? And from the sound of it, a few of you have had it too! Will the search-space thing be the reason that links and somewebsites aren't working properly too? because a lot of things on this machine are playing up.

Also, why didn't my AVG 6.0 pick it up?

Thanks for all the help.... better start trying to sort it out!


Will

 

[(RIP) willstatt]

fingers crossed

Well, I've done the CWshredder thing, and it seems to have sorted things out... at least I can now access the links and do the stuff I was struggling with before... cheers mates!

Still don't understand why my virus software failed to either spot it or alert me?

Will

 

[AdamZ]

Welcome to Microsoft & its security.

Few Antivirus software systems cope with spyware or protect against hi-jacking home pages. And even fewer people are comfortable editing Windows registry.

I use a program called "Spy Sweeper" which protects against homepage hijack. There are a number of programs around which ease editing, managing and cleaning Windows registry. You can download a few from the PC Pro Web site ( http://www.pcpro.co.uk/ ) in trial format which will ease the pain of registry management. I also use "Registry Medic" which clears most problems and clears a lot of the crap out of your registry and also checks for Virus's installed in your registry - ever wondered why it takes so long to load Windows.

"Advanced Start Up Manager" is a nice little piece which makes controlling the startup registry entries very easy.

"SpySweeper" identified Spyware in my startup group which Norton did not pick up but had to go to the Symantec site to get manual instructions for removal. That was a pain.

Remember to backup your registry before you muck about with it and also in some cases you may have to switch off System Restore.