Manual removal of searchpage.cc
Here is the procedure:
- Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
- Delete 'HKEY_LOCAL_MACHINE\SOFTWARE \ Classes \ CLSID \ {FF1BF4C7-4E08-4A28-A43F-9D60A9F7A880}', if it exists.
- Delete 'HKEY_LOCAL_MACHINE\SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer\ Browser Helper Objects \ {FF1BF4C7-4E08-4A28-A43F-9D60A9F7A880}', if it exists.
- Exit the registry editor.
- Restart your computer.
- Start Windows Explorer and delete:
%SystemDir%\mshelper.dll
%SystemDir%\mshelper_beta.dll
Warning: Registry change is dangerous. Always have backed up the system properly in case you made a mistake.
Alt Keywords: Search CC, Spyware, Part of CoolWebSearch - CoolWebSearch is part of a new strain of trojans that have been identified that all have one thing in common: they install through the ByteVerify exploit in the MS Java VM and change the IE homepage, search page, search bar, etc...
Here is an alternative procedure if the above don't work:
Download and Save it to disk the following:
Important Put hijack in its own folder...it makes backups of what is to be removed in case restore is needed. (don't use a temp folder or the desktop...backups get lost there) . If you have any home page locking tools such as WinPatrol, SpywareBlaster, Spybot or SpywareGuard...disable the home page lock function before continuing.
Now...boot the computer to safe mode/offline. (Tap F8 a few times as your system bootup) .
Run CWShredder.exe then click fix not just scan and let it remove all found.
Reboot the computer.
Now...boot the computer to safe mode/offline. (Tap F8 a few times as your system bootup)
Start hijackthis, hit scan and check to fix all R0, R1 entries with searchpage.html
Check the 02-BHO entry referencing OsbornTech Popup Blocker.<-this is a new CWS hijacker<--bullcrap popup blocker.
Check all 013 entries
Don't "fix" anything else unless you are sure what you are doing. Hijack will delete whatever you tell it to. It Does not know good from bad...just shows you what is there.
Once all are checked; close all open windows except hijack and click fix checked
Reboot the computer when done
|
Post your comment