Hi John, You've got the coolwebsearch variant called Loadbat. Check out this page:
http://www.spywareinfo.com/~merijn/cwschronicles.html and search for hp.htm or Loadbat. This is a tricky one. Removing it manually involves some registry editing and deleting a few files. Therefore, I recommend the CWShredder tool (farther down the linked page) or which you can get from here: http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder HTH, Chuck Date: Fri, 9 Apr 2004 22:51:28 +0100 From: "johnf" <[EMAIL PROTECTED]> Subject: Re: PCWorks: allneedsearch.com I used these instructions to try and right a friends XP Pro computer that has had the home page on IE6 taken over by a sort of directory page with the URL shown as C:/Windows/hp.htm THe file can be deleted and the home page reinstated but on reboot the hp page is back. Anyway I got to the part where it says "look for Winlogon.exe" but could not find it. A search came up with two, one of which had permission refused to delete it. However the hp home page is still there. Is there any advice that I could have on this problem. Thanks John - ----- Previously ----- From: "Charles Harris" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, April 07, 2004 5:55 AM Subject: Re: PCWorks: allneedsearch.com > Hi Peter, > > Instructions are for Windows XP. Start your computer in Safe Mode (Press > the F8 key before the first Windows splash screen appears to reach the > Windows startup menu. Use arrow keys to highlight Safe Mode, press > enter, press enter again to choose Windows XP whatever edition). Log on > as the Administrator, press Enter unless the Administrator actually has a > password. Enable your view settings in Windows Explorer (Tools - Folder > Options - View tab) to show all files including protected operating > system files. Turn off System Restore (Right click My Computer - > Properties - System Restore tab - check Turn off system restore > checkbox). Using Windows Explorer or My Computer, navigate to > C:\Documents and Settings\All Users\Local Settings\Start > Menu\Programs\Startup. Look for winlogon.exe. Get rid of this file. > Delete it big time. Change your home page to your choice. Use the > settings in Spybot and Ad-aware to beef up anti-spyware security. I > remove the entries from the registry that load winlogon.exe. Restart and > download the Windows Updates for your computer. After your system is > well, turn System Restore back on and do whatever you to your view > settings. This particular problem is part of the CoolWebSearch chaos. ============= PCWorks Mailing List ================= Don't see your post? Check our posting guidelines & make sure you've followed proper posting procedures, http://pcworkers.com/rules.htm Contact list owner <[EMAIL PROTECTED]> Unsubscribing and other changes: http://pcworkers.com =====================================================
