CWShredder found this but it doesn't conform to the description of its
symptoms i.e. it hasn't hijacked my homepage."Variant 31: - CWS.Msconfig
Approx date first sighted: February 5, 2004
Symptoms: IE pages being hijacked to www.31234.com on system startup and
when changing homepage back, continuous errors about an invalid Registry
script in temp2.txt, extra item in right-click menu of webpages named
'??????'
Cleverness: 2/10
Manual removal difficulty: Involves a process killer, some Registry editing
and restoring a Windows system file from CD
This variant uses the filename msconfig.exe which overwrites the real
Windows file in Windows 98/98SE/ME. The temp2.txt file it drops is actually
a Registry script, but since it's in the wrong format, Windows 9x/ME will
throw up an error about an invalid Registry script. Windows 2000/XP will
import it without complaining, creating the '??????' item in the IE
right-click menu. The msconfig.exe file will always stay in memory,
reinstalling the hijack every 5 seconds. Killing the process, deleting the
file and restoring the IE homepages/search pages fixes this hijack."
Is it dangerous? How can I remove it?
Martynz