From: Rudy on 05/13/2004
I found the same problem. I have a WinMe system. In this case, Windows Media Plaer was hijacked.Symptoms of this problem were:
1. Look in the registry under HKEY_CURRENT_USER.
2. Find Software - Microsoft - Internet Explorer - Main
3. You will see an entry called SEARCH PAGE with the entry www.coolsearch.biz.
4. If you edit or delete this entry, it will return to the coolsearch location.
5. Do a file search on WMPLAYER. You will probably find two entries for WMPLAYER.EXE.
6. Do a Ctrl-Alt-Del and look at the running processes. Is the running process Windows Media Player or WMPLAYER. The correct process is Windows Media Player.
7. Look at the Media Player ICON. Is it a generic icon or the Media Player icon? It should be the Media Player icon.
8. If the icon and process are incorrect, the WMPLAYER.EXE file has been hijacked. You can end the process, edit the registry setting for your desired home page and test it.
9. If you no longer receive the coolsearch page, then delete ALL references to Media Player and reinstall it from the Microsoft Windows Update location.
I am not sure what vulnerability Media Player has, but this is how I cleared the coolsearch mess. Sorry for the late response...but I only recently had and resolved the problem.
If you have questions contact me at rjfox01@yahoo.com.
Rudy
