# Odd Piece of Invasion-Ware

**URL:** <https://boards.straightdope.com/t/odd-piece-of-invasion-ware/223833>\
**Category:** Factual Questions\
**Created:** [January 10, 2004, 3:45pm UTC](https://boards.straightdope.com/t/odd-piece-of-invasion-ware/223833 "2004-01-10T15:45:49Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Polycarp](https://avatars.discourse-cdn.com/v4/letter/p/82dd89/32.png) [@Polycarp](https://boards.straightdope.com/u/Polycarp)\
**Post date:** [January 10, 2004, 3:45pm UTC](https://boards.straightdope.com/t/odd-piece-of-invasion-ware/223833/1 "2004-01-10T15:45:49Z")

</div>

I have and regularly use AdAware and Spybot Search and Destroy, have Panicware’s Pop-Up Stopper installed and functional whenever I’m online, and use Housecall every couple of months to locate any additional virus material.

However, I’ve run into one bit of invasion ware that doesn’t seem to be locatable or removable by any of the above.

This takes over my homepage and redirects it to “res:\mshp.dll\index#22776.” This produces a Google-like search page with supposed links to a wide range of resources. A system search shows MSHP in my WINNT directory, but deleting it from there is ineffectual – the program comes right back the next time I load MSIE.

Obviously I’m doing something wrong, or omitting a deletion step – but I cannot figure out what.

Any advice?

---

<div class="post-metadata">

**Author:** ![Brutus](https://avatars.discourse-cdn.com/v4/letter/b/91b2a8/32.png) [@Brutus](https://boards.straightdope.com/u/Brutus)\
**Post date:** [January 10, 2004, 3:56pm UTC](https://boards.straightdope.com/t/odd-piece-of-invasion-ware/223833/2 "2004-01-10T15:56:23Z")

</div>

Would you like to change your homepage to Rocket Search?

Errr, sorry. Try [this site](http://www.spywareinfo.com/~merijn/cwschronicles.html), which has some info on ditching it. I cleaned my parents computer using ‘CWShredder’, and it seems to have done a good job.

---

<div class="post-metadata">

**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\
**Post date:** [January 10, 2004, 3:56pm UTC](https://boards.straightdope.com/t/odd-piece-of-invasion-ware/223833/3 "2004-01-10T15:56:25Z")

</div>

Search Registry for mshp.dll as well, and delete any entyries that refer to it, then delete it from your WINNT directory. You can then go and set your homepage to whatever you want.

---

<div class="post-metadata">

**Author:** ![Toddly](https://avatars.discourse-cdn.com/v4/letter/t/22d042/32.png) [@Toddly](https://boards.straightdope.com/u/Toddly)\
**Post date:** [January 10, 2004, 4:26pm UTC](https://boards.straightdope.com/t/odd-piece-of-invasion-ware/223833/4 "2004-01-10T16:26:32Z")

</div>

This hijacker is referred to [here](http://computercops.biz/postt11035.html) It sounds like CWShredder works but I would also do the registry search just to make certain it was gone.

---

<div class="post-metadata">

**Author:** ![Mephisto](https://avatars.discourse-cdn.com/v4/letter/m/48db29/32.png) [@Mephisto](https://boards.straightdope.com/u/Mephisto)\
**Post date:** [January 10, 2004, 10:49pm UTC](https://boards.straightdope.com/t/odd-piece-of-invasion-ware/223833/5 "2004-01-10T22:49:16Z")

</div>

Hi. I’ve got the same problem. I downloaded CWShredder, but when I tried to use it I got a message that said: “A REQUIRED .DLL FILE, MSVBVM60 WAS NOT FOUND.” So what the heck I am I supposed to do about that? And when you answer, please consider that your average high schooler certainly knows more about computers than I.

---

<div class="post-metadata">

**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\
**Post date:** [January 10, 2004, 10:51pm UTC](https://boards.straightdope.com/t/odd-piece-of-invasion-ware/223833/6 "2004-01-10T22:51:48Z")

</div>

> [@](#):
>
> \*Originally posted by Mephisto \*  
> \*\*“A REQUIRED .DLL FILE, MSVBVM60 WAS NOT FOUND.” \*\*

[The fix.](http://www.idautomation.com/kb/vb-dll-errors.html)

---

<div class="post-metadata">

**Author:** ![Mephisto](https://avatars.discourse-cdn.com/v4/letter/m/48db29/32.png) [@Mephisto](https://boards.straightdope.com/u/Mephisto)\
**Post date:** [January 10, 2004, 10:55pm UTC](https://boards.straightdope.com/t/odd-piece-of-invasion-ware/223833/7 "2004-01-10T22:55:31Z")

</div>

Holy cow! That was fast! Thanks, **Q.E.D.**! 😃

---

<div class="post-metadata">

**Author:** ![Polycarp](https://avatars.discourse-cdn.com/v4/letter/p/82dd89/32.png) [@Polycarp](https://boards.straightdope.com/u/Polycarp)\
**Post date:** [January 10, 2004, 11:03pm UTC](https://boards.straightdope.com/t/odd-piece-of-invasion-ware/223833/8 "2004-01-10T23:03:04Z")

</div>

CWShredder did the job. Thanks!!!

---

<div class="post-metadata">

**Author:** ![Chimpy](https://avatars.discourse-cdn.com/v4/letter/c/a9adbd/32.png) [@Chimpy](https://boards.straightdope.com/u/Chimpy)\
**Post date:** [January 10, 2004, 11:09pm UTC](https://boards.straightdope.com/t/odd-piece-of-invasion-ware/223833/9 "2004-01-10T23:09:22Z")

</div>

Where can i get CWShredder?

---

<div class="post-metadata">

**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\
**Post date:** [January 10, 2004, 11:12pm UTC](https://boards.straightdope.com/t/odd-piece-of-invasion-ware/223833/10 "2004-01-10T23:12:23Z")

</div>

[CWShredder](http://www.spywareinfo.com/~merijn/files/cwshredder.zip).