I like my browser to start with Google, but recently it has launched other websites on startup. (luckysearch.net and global-finder.cc) How can I stop this happening?

L. Patel, October 2003

Try SPYWAREGUARD or there are free Homepage keepers to download.

Mr Kipper, September 2005

Thank you. I love you people. If you guys EVER need any help of any sort when in Bangalore,India, mail me at radagast@mail.com. Thank you a zillion times. Also, if you guys happen to know who runs the #$^@!* globe-finder.cc site, please, for the love of god, give me an address of some sort. If I ever get my hands on the SOB's who run that blasted site, are they going to pay. Uma Thurman may spare Bill, but I'm not going to rest till these mother-bleepers are dead and buried. May the people who made CWShredder live forever.

Abhishek, February 2004

Roberto...

You can download the missing file from here...
http://www.freewareweb.com/cgi-bin/archive.cgi?download=1&ID=1642
...or search for the file using Google.
The file is the backbone of applications written using Visual Basic. Most PCs have it, but yours obviously doesn't. Once this is installed it should work.

Julian H, February 2004

Hi! I'm italian but I've got your same problems with www.global-finder.cc .
I've download cwshredder.zip but it didn't help me.
When I open it, computer says that file DLL MSVBVM60.DLL isn't found.
Help me please, because I don't know what I have to do!

Roberto, February 2004

delete soundmx.exe in C:\windows\system\
then delete the registry run key for it.

timm, November 2003

thank you guy! your tool helped!
luckysearch.net and global-finder.cc removed! :D

Andy Rob0Cop, November 2003

About this luckysearch.net problem, here's what I did. It's worked so far. Look at the string of characters at the top of internet explorer as your hijacked homepage is opening. In my case I saw something like http://%61%63%63... Go into your registry editor and go to Edit-->Find and type in a small portion of this address, like %61%63 . Let the regedit look for each occurance, and when it finds one, either delete the address or type your desired site. Hit Find Next and keep doing the same until you've come to the end of the search. Hopefully this helps. Bad hijackers! Bad! Now if anyone knows a similar solution to getting rid of telemarketers... :)

Kenji, November 2003

Once you have got rid of this *scourge* make a backup of your registry. You can do this from the registry editor ( Start -> Run and type in REGEDIT in the dialog box ).

Then, if this happens again, you can restore the previous backup and this should solve the problem.

The only drawback is that you might lose some settings you created since the last backup was made - so it's a good idea to do regular backups ( like everything else ).

-Simon

Simon Morgan, November 2003

I would just like to thank this forum & all it's users very much for helping me get rid of my browser hijack (the lovely lucky search.net) CWshredder worked wonders & saved me more stress!!

Jaine, November 2003

Ive Run CW Shredder to try and get rid of Lucky Search but it dosent work for me!
Does anyone know if there is an updated version of CW Shredder as I downloaded mine some months ago and thats why it may not be working

John C, November 2003

Thank you. Thank you. Thank you.
I had the same problem with luckysearch.net.
I tried EVERYTHING - different apps, deleting files, changing settings.
But that CWshredder fixed it in in a second.
i just wish I'd found it a week (and about 6 hours of fiddling) earlier.
That's good stuff.

Cheers!

John, November 2003

Im in England (UK), and for the last three weeks damn blasted lucksearch.net kept on coming up, It was driving me NUTS!! I didnt think I could do anything about this, so many thanks to the gentleman at the top for the answers! NextStop I am going to do all I can to make things difficult for the lucksearch freaks! Join me so they can stop making people angry for hijacking their browser!!
CWshredder really is a life saver, well it saved the life of some luckysearch.net freak, cus I was gonna get mad and do my Rambo impression on them!

Mani, November 2003

I got some news for you, please read this:

" Textual from McAfee Viruscan Website: Virus Characteristics
-- Update 25 September 2003 --
A new varaiant of this trojan has been discovered. Detection and removal will be included in 4296DAT files.
This is a detection for a trojan that changes several settings of the Internet Explorer like startpage and searchpage.
After execution, it drops one file to %windir% called :
• default.css (1260bytes)
The same file gets also droped into %windir%\web\ called :
• oslogo.bmp (1260bytes)
These both files are detected as 'application Adware-CWS'.
The following keys are created/modified within the Windows registry:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer
"Search" : http:// *URL omitted*
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer
"SearchURL" : http:// *URL omitted*
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
"Default_Page_URL" : http:// *URL omitted*
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
"Default_Search_URL" : http:// *URL omitted*
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
"Use Search Assistant" = yes
etc..."

Well use McAfee Viruscan

Roxana Vargas, November 2003

Sorry, That was Steven not Wild Will. Thanks Steven for the link that solved my problem..... http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Shreyas Vyas, November 2003

Thanks Wild Will..... The cwshredder.zip worked wonders.

Shreyas Vyas, November 2003

I downloaded the HomePageLock.reg file, but it doesn't match my registry. I'm running Windows XP Home. When I work through my registry, I get as far as HKCU\Software\Policies\Microsoft\...but there is no next listing for Control Panel. There is a listing for "Office" and for "System Certificates" only. I've seen these directions before for earlier versions of Windows. Is it possible that XP needs something different in the registry?

Gil, November 2003

Search for the program " passthison " this is a code that looks smooth under a virus scan but when deleted manually you will see.

A friend, November 2003

You can modify the registry to lock your homepage so that people can't hijack it. Download the zip file from here http://www.gmpservices.com/articles/pufiles/HomePagelock-unlock.zip and run either "HomePageLock.reg" or "HomePageUnlock.reg"

Wild Will, October 2003

It sounds as though your browser has been hijacked.

You've heard of computer viruses, and maybe trojans. Browser Hijacking is similar. Someone has managed to add some code and or configurations to your computer so that your browser opens up the page they want you to see. Changing the page back (via TOOLS>INTERNET OPTIONS) may not be enough. The next time you restart your computer the malicious code may Hijack you again.

Firstly, make sure the people who think that this is a clever way to advertise/market themselves realise that you think they, and the companies that advertise with them, are the lowest form of pond life. (luckysearch.net and globe-finder.cc to name just two.)

Secondly, download this utility which will check and remove the malicous code. http://www.spywareinfo.com/~merijn/files/cwshredder.zip

This should sort you out.

Steven, October 2003