Start page created when opening IE?

Hi all,

I have a machine running WinXP and IE 6.0.  Every time IE is started the start page is changed to: res://mshp.dll/index.html#10213

Even if the start page is reset to the correct location, after closing and opening IE, it goes back to res://mshp.dll/index.html#10213 as the homepage.  The mshp.dll is actually an html file added in the C:\Windows directory.  If the file is deleted, it is recreated once IE is opened.  I have searched and changed any references in the registry, which did not help the problem.  

Any ideas on how to fix this or how I can investigate further?

Thanks,
MDA

Download Hijack This!

http://mjc1.com/mirror/hjt/

Unzip it and scan your machine.  Post the log results here and someone will have a look.

Thank you,
I ran the hijackthis application and found the entries related to res://mshp.dll/index.html#10213.  However, the first time I open IE, everything is fine but the second time I open it, the start page is back and the references to res://mshp.dll/index.html#10213 are show again in hijackthis.  Somehow, when I open IE the references and file is being created.  How is this possible?  Any other ideas? Thanks for your help.

Note: I did not paste the log because I found the references.

MDA

Download and run in this order:

cwshredder *
SpyBot 1.2 *
AdAware *

* = Update the definition files within the program as the first step.

http://www.spywareinfo.com/downloads.php?cat=sp#det

If you still have the problem, download and run Hijack This! and post the log here.

Thanks, Each app found something and cleaned it up.  Everything looks great now.

Thanks again,

MDA

Hello, I am having the same problem, I have run spybot, spy hunter, adware and ultra wipe....whatever is hidden in my system changes the homepage back to  -

res://mshp.dll/index.html#22776

Any help on how to get rid of this problem would be greatly appreciated, I am not very literate in how the system works.

if anyone knows what to do would you please email me

rjmalone@cox.net

Thank you
Rick

cwshredder worked for me as well!!  I tried the adaware and had removed the mshp.dll file manually just to see this dll file come back!  thanks for the advice guys.

Buy the way. It appears that this is the only reference to this problem on Google!  Good job guys.

I got it too!  Started on December 30, 2003.  Where do I find cw shreader?  Not sure what I am looking for.

try this link to get to the page where you can find cws shredder...it looks like it worked for me too.

http://www.spywareinfo.com/downloads.php?cat=sp#det


Good luck
Rick

I wrote a FAQ for the site that should have active links to the shredder and other needed applications:  FAQ608-4650

Read and follow the instructions from the FAQ.  The links, and resources  (stolen baldly from smah, manarth, carr, and others).

The FAQ does not suggest an aritray order or appplicatin of repair tools.

Stop, reboot, test, after each tool.

You can beat this malware with regular use (updated) of AdAware and Sypbot.  

I'm having the SAME EXACT problem The shredder seemed to have fixed it (thank you), but now it game me something else? everytime i shut down the system shows a non responsive progam "dialog box demo," it's creepin me out... is it all part of the same evil plot? thanks

MeeneeMinoMo,

Shutdown issues are very OS version dependent.  A quick keyword search on "shutdown" in the the right OS forum of Tek-Tips would likely give you the information to resolve your problem.

This issue can be hard to resolve.  If it helps, the fact that the feature did work at one time is to your advantage.  If it never worked, it grows as a problem from annoying to potentially a big pain.

See the OS specific forums on Tek-Tips.   

Thanks guys

The cwshreder worked great as this was a real problem but everything seems to be fine for now!

Thanks for the help, the programs got rid of the original problem and many others I was unaware of on my computer.

Let me try to save you some time....you will still want to run the spyware utilities but dont wait, go get and run shredder.

1) Spyhunter: Deleted a ton of junk and addware from my computer
2) Spybot: Did the same
3) Adware: Same thing
4) Ultrawipe: Same thing

Result: The issue still resided in my system and no change noted. Still had the res:// etc etc issue.

5) Ran shredder . . .

Result: End of problem for now.

Go to this link and use Shredder, it finds file which appear to be attaching themselves to your root directory. The problem with these files is it seems they keep name changing so you cant locate them. Shredder finds them and gets rid of them no questions asked. Guys & Gals I worked on my system trying to fix it for almost 24hrs straight before I found shredder...GO USE IT! Save yourself some time.

http://www.spywareinfo.com/downloads.php?cat=sp#det

Rick

cwshredder worked for me....does anyone know who wrote this and where I can find them, I need to break in a new 5 iron.

Thanks Tek-Tips Forum!
This is the ONLY web site (as returned by Google) with a solution to this troublesome issue.

Simply download CWSHREDDER  from
http://www.spywareinfo.com/downloads.php?cat=sp#det

'Unzip it, run it and 2 minutes later everything will be fixed!

I'm so happy I joined Tek-Tips AND made a Pay-Pal donation!

Thank You!!

PS: If anyone would like to 'nail' one of the bast*rds promoting this trojan virus, it's being "distributed" at (DO NOT VISIT) http://sirius-cybernetics-corporation.com

You can thank the wonderful fellow merijn, the author of shredder:  http://www.spywareinfo.com/~merijn/

His own guess is that there are now 10,000 variants of the "Cool Web" hijacker running around.

Sheesh.

I think merijn deserves a nobel prize, and the Cool Web hijack authors a baseball bat, frequently applied.

taking the advice of bcaster. It worked quickly and the problem was solved.


bcastner (IS/IT--Manageme) Dec 30, 2003
Download and run in this order:

cwshredder *
SpyBot 1.2 *
AdAware *

* = Update the definition files within the program as the first step.

http://www.spywareinfo.com/downloads.php?cat=sp#det
 

taking the advice of bcaster. It worked quickly and the problem was solved.


bcastner (IS/IT--Manageme) Dec 30, 2003
Download and run in this order:

cwshredder *
SpyBot 1.2 *
AdAware *

* = Update the definition files within the program as the first step.

http://www.spywareinfo.com/downloads.php?cat=sp#det