Internet Explorer "Home Icon" is hijacked

[ockerb]

I have a computer which initially had dozens of files and reg entries that were identified as spyware. I was able to get rid of everything that was annoying but am not able to stop going to some page full of advertised spyware programs and other garbage when I press the home icon in internet explorer. Everything to do with internet explorer works fine except for that. I was able to run "hijack this" and got a log file that didn't mean a lot to me. I have run adaware and giant antispyware but to no avail. I found a program called IE Hijack remover which identifies that a program had hijacked my home page and fixed the problem. When I reboot, login to my ISP and connect to the internet everything is perfect. As soon as I click the "home" icon on the main toolbar, up comes all the garbage I described before.
Can someone provide further assistance in this matter. Thanks for your time.
Ockerb

 

[aftertaf]

try reinstalling IE once you scan and remove all parasites in registry..

http://www.compu-docs.com/ieadmininstall.htm

Aftertaf (david)
MCSA 2003

 

[ockerb]

Further to my recent post I found that after IE Hijack remover blocked a homepage takeover the address it attempted to go to was res://wtlbass32.dll. I found that file in the windows directory and deleted it. Within a couple of seconds it reappeared again, this happened everytime I attempted to get rid of it. Is this info any help to anyone that might be able to help?

Ockerb

 

[ockerb]

Thanks David, I'm not sure when I know I have got rid of all the parasites in the registry.

Ockerb

 

[aftertaf]

i know how you feel...

i'd get ad-aware , and spywareblaster too....
make sure they're up to date

download the IE setup files like in the link..., then run the anti spyware stuff...
once they find and clean stuff, disconnect from network and reinstall IE.

Have you tried IEFix??

Aftertaf (david)
MCSA 2003

 

[aftertaf]

http://www.mvps.org/sramesh2k/IEFIX.htm

(thx again bcastner)

Aftertaf (david)
MCSA 2003

 

[ockerb]

Thanks David, I am trying that now (IEFIX) however I have also noticed that there is a file starting up in msconfig which I can't account for or delete. The file name is CSRSSW.EXE. I can't delete it (even using dellater) and even when I remove the tick against the filename in msconfig, it reappears after a reboot, any ideas??

 

[ockerb]

Well I tried IEFIX and it found no errors, do you think I still should re-install IE even though I have a couple of strange files?

Ockerb

 

[aftertaf]

could be worth a try...

can you run hijack this, and post us the list?
search for this strange file in the registry too...., if you find it and its seems suspicious, rename the reference to it in registry..

seems suspect that it is in msconfig, according to google results...
eg:

http://startup.iamnotageek.com/srch-CSRSS.EXE.html

Aftertaf (david)
MCSA 2003

 

[aftertaf]

search for this and csrss exe files on your drive...
you can post us the directories it appears in.

csrss is a very important windows file, but is apparently spoofed a lot!!

i have csrss in system32 and in cached service pack directories.
i dont have csrssw...
so it's either part of a program you have installed, or its a nasty ... :O

Aftertaf (david)
MCSA 2003

 

[jimp56]

run

http://housecall.trendmicro.com

to remove the reinfecting trojan, then re-scan with the scanners you used previously (must be latest versions w/latest signatures)

its also important that you post the hijack logfile somewhere so you can get advice on how to remove the offending entries, or else it will keep coming back over and over...

 

[bcastner]

My FAQ on removal of such malware: faq608-4650