Tech Problem Aggregator

Solved: Desktop and home page hijacking

Q: Solved: Desktop and home page hijacking

I've worked on this problem for quite a while with no success. Desktop has a mirror image of an about:blank web page that is also set as my homepage. I have not been able to get rid of the desktop image (which says my machine is being watched and I need new spyware software - nice). IE is a little messed up too. Has some kind of tracking going on. Any help would be greatly appreciated.

Here's a copy of my HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 9:09:11 AM, on 8/30/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe
C:\Program Files\ScanSoft\OmniPagePro14.0\Opware14.exe
C:\Program Files\ScanSoft\OmniPagePro14.0\OpScheduler.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Timeslips\TSTimer.exe
C:\Program Files\QUICKENW\QWDLLS.EXE
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {02DCA195-602B-4B1F-83FF-381B7E804BDB} - C:\WINDOWS\system32\HDBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [WorkFlowTray] "C:\Program Files\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe"
O4 - HKLM\..\Run: [Opware14] "C:\Program Files\ScanSoft\OmniPagePro14.0\Opware14.exe"
O4 - HKLM\..\Run: [OpScheduler] "C:\Program Files\ScanSoft\OmniPagePro14.0\OpScheduler.exe"
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [c32cef96860] C:\WINDOWS\System32\c32cef96860.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [TSTimer] C:\Program Files\Timeslips\TSTimer.exe
O4 - HKCU\..\Run: [c32cef96860] C:\WINDOWS\System32\c32cef96860.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: Reminder.lnk = office3\groups\Melanie\Chklogin.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {60EFC337-15C2-4369-B2A0-3429B071D8B8} (Hewlett-Packard Printer Diagnostics) - http://ispe.sdc.hp.com/awebui/jsp/answerweb/applets/HPISWebManager.CAB
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: WindowInstallSystem (c32cef96860svr) - Unknown owner - C:\WINDOWS\c32cef96860.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\hpzipm12.exe

A: Solved: Desktop and home page hijacking

7 more replies
Answer Match 82.74%

my homepage keeps getting hijacked and i can't stop it! please help. heres my hijack this before i run anything else...tell me whats wrong please i really need help!
 

A:[SOLVED] SOMEONE PLEASE HELP ME! home page hijacking! :(

13 more replies
Answer Match 81.9%

Help anyone,
This should be simple but... . I want to use att.yahoo.com as my home page but Google keeps hijacking me. I have gone to Tools, Internet Options, changed from google to https://att.yahoo.com, clicked apply then OK and proceeded to surf. Coming back to my home page att is gone replaced by Google. What am I doing wrong?
Please help,
Jim
 

A:Solved: Google keeps hijacking my home page

16 more replies
Answer Match 72.66%

I've been on Road Runner for about 24 hours before my home page got hijacked. I was not prepared for this because I had been using Compuserve for several years and never had any problems. Anyway, I downloaded and ran Spybot Search and Destroy and Adware SE Personal. I ran each of these several times in succession. Each time it seems to find numerous things (always including CoolWWWSearch), but it never seemed to get rid of the problem--my home page was reset every time. I stumbled onto this site and if I understand the drill correctly, I downloaded Hijack This and used it to scan, output the log file and it is attached below. Any help would be greatly appreciated. This is really frustrating.

Thanks, Tim

Logfile of HijackThis v1.97.7
Scan saved at 7:13:07 PM, on 8/10/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\PackethSvc.exe
d:\program files\ca\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\suppo... Read more

A:Yet another home page hijacking

You might try CWShredder. It is a free tool for removing some variants of the worm you are infected with. It may or may not help, but it won't hurt...doc
 

1 more replies
Answer Match 72.66%

Previous Thread: "Persistent BHO needs Removal" newdogdad 05-Sep-2007 12:58 PM
by sjpritch25. Did not know that I should set a new Restore Point until I checked the Thread this a.m. Now SPYWARE GUIDE and SPYBOT are reporting that something wants to change the Home Page.
NEW LOG File is below:

HiJackThis Log:
Logfile of HijackThis v1.99.1
Scan saved at 12:05:13 PM, on 9/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\NetRatingsNetmeter\NetMeter\NielsenOnline.exe
C:\Program Files\a-squared Anti-Dialer\a2service.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\MMK2\memokeys.exe
C:\Program Files\Spybo... Read more

More replies
Answer Match 72.24%

Hello There!This is my first post as I am a new member to this forum and I have a problem that I hope someone out there can help me with.In the last couple of days I have appeared to pick up a nasty little homepage hijacker. Everytime I start IE my home page is set to aboutblank. Any changes I make to reset the default homepage back to the one I normally use does not work. Also, periodically I get pop-up ads even though I am using Ad-Adware Pro with Ad-Watch turned on. I also use Norton IE Security 2005. I've tried scanning and cleaning with Spybot, Ad-Aware, Norton and CWS Shredder but with no success. It finds some things, removes them, but my problem is still there.Attached is my HJT log. I'm running XP Pro. Can someone look at it and guide me? I would REALLY appreciate it!Logfile of HijackThis v1.99.1Scan saved at 12:03:11 PM, on 7/7/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Ahead\InCD\InCDsrv.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Norto... Read more

A:IE Home Page Hijacking Issues

PLEASE PRINT OUT THESE INSTRUCTIONS BEFORE PROCEEDING.(Click on Print this topic in the upper RH corner.)STEP 1:Please make sure that you can view all hidden files. Instructions on how to do this can be found here.STEP 2:Please download Trend Micro? CWShredder? here.Save it to its own folder named CWShredder and place it at the root of your C:\drive along with HijackThis.Don't run it yet, we will use it later.STEP 3:Download AboutBuster from RubbeR DuckY hereSave it to its own folder named AboutBuster and place it at the root of your C:\drive along with HijackThis.Double-click AboutBuster.exe and press Update to make sure you have the latest reference file version.NOTE: You might want to view this AboutBuster tutorial here first before running the tool.Don't run it yet, we will use it later.STEP 4:Download and install the latest version of Ad-Aware SE hereNOTE: If you are still using the older Ad-Aware 6, go to Add/Remove Programs in the Control Panel and uninstall it now before installing Ad-Aware SE.Please configure the program by following these instructions here.Before scanning click on "Check for updates now" to make sure you have the latest reference file.Don't run it yet, we will use it later.STEP 5:Download the eScan Antivirus Toolkit here.Save it to the desktop. This program is 10MB in size.Don't run it yet, we will use it later.STEP 6:Download and install the Ewido Security SuiteNOTE: The Ewido Security Suite utility will not install on Window... Read more

1 more replies
Answer Match 72.24%

After installing ie8 (completely) and assuring my home page was still what I wanted I shut my computer down for the night. Upon resarting I clicked on the Explorer button and the following came up http://www.google.com/toolbar/ie8/done.html I then went to my home page but noticed that google had placed things in my favorites folder so I deleted them. Off and on when ever I would go on the internet this same google page would come up. I then thinking it had something to do with ie8 and being very annoyed by it I uninstalled ie8. But the was surprised that I continued to get this google page every once in awhile of when staring my computer and then clicking on explore. I have gone into my registry and removed everything even closely related to either google or ie8 but I am still being hijacked by google. I have tried thre different anti virus programs and also some spyware programs but with no luck.
 

A:ie 8 home page hijacking, sort of?

6 more replies
Answer Match 72.24%

I have a Gateway computer with an Intel Pentium 4 2400 MHz chip, 512K RAM, and 80G HD. I use Norton AntiVirus and Zone Alarm. Recently, I have had trouble with my Home Page being Hijacked by different Web sites. I run Spybot Search and Destroy as well as Spyhunter regularly. But my Home Page keeps getting Hijacked. Can someone look over the HJT logfile below and offer me some suggestions as to what I should do?

Also, it looks like more things are running on my PC than should be. Any suggestions would be appreciated.

Thanks

Logfile of HijackThis v1.97.7
Scan saved at 7:06:50 PM, on 6/18/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\SK9910DM.... Read more

More replies
Answer Match 72.24%

undefined
We are having the same problem that we can`t get rid of of a browser hijack each time i open IE6, it always brings me to the searchportal web site (searchportal.info/10039) I read the forum and printed it but I feel that I will not be allowed by my computer to download index.dat suite or hijack this as once I get to a website I can not get into it and then I receive a message that the page can not be opened etc and it closes on us. I am at work now since I know I can not do this at home. I am not a computer pro and do not want to mess things up. Any help?

A:searchportal hijacking of IE home page

Hi and welcome to TSF

Please go into Windows Explorer, click on C:\ > File > New Folder and call it HJK , or another name of your choice. Go to this Site and download Hijack This. Install the program into the folder you created then run it. Click Scan. Save the log file to Notepad , then copy and post it back here. Make sure to include the System information at the top of the log as well.

9 more replies
Answer Match 70.56%

Hello, tried everything I could to figure this out. My homepage keeps getting put on the URL above, entitled "Home Search". I've done scans with Norton (shows nothing), Spybot (shows a Data Source Object exploit), Adaware 6.0(said it was a CWS trojan), and tried the CWS shredder. Spybot referred me to http://security.greymagic.com/adv/gm001-ie/, and I tried that fix to no avail. I've ran "hijack this" and here's my log. Any help on this one would be deeply appreciated.Logfile of HijackThis v1.97.7Scan saved at 4:07:47 PM, on 6/16/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Norton AntiVirus\navapsvc.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\system32\addqc32.exeC:\WINDOWS\... Read more

A:Home page hijacking to:res://bxwdr.dll/index.html#

Firs tthing you need to do is create a directory on your c: drive called c:\hijackthis and move the download and run HijackThis from that location. This is one is a pain to clean so bear with me with the process.I want you to fix some of those entries. Please do the following:Please make sure that you can view all hidden files. Instructions on how to do this can be found here:How to see hidden files in WindowsPlease put a checkmark in the box for each of these entries, close all other windows, and click the fix button:R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\bxwdr.dll/sp.html#96676R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://bxwdr.dll/index.html#96676R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://bxwdr.dll/index.html#96676R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\bxwdr.dll/sp.html#96676R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://bxwdr.dll/index.html#96676R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\bxwdr.dll/sp.html#96676O2 - BHO: (no name) - {602C3D03-C6C8-CE58-094E-67D08A6CADCB} - C:\WINDOWS\msbg.dllO4 - HKLM\..\Run: [addpy32.exe] C:\WINDOWS\... Read more

15 more replies
Answer Match 62.58%

I've run into a hijacking thats got me stumped.
I've already cleaned up most of the junk that was on the pc.
Wintools
180solutions
Internet optimizer
My daily horoscope
Bxxs5
Proscan
Just to name a few...

The hijack log is after I worked on it using adaware, cws, hjt and Lsp fix.
The host file entries suddenly appeared after I connected back to the net.
They weren't in any of the previous logs I ran while cleaning the pc.

I was asked to look at the computer because something was trying to access
the net. They use AOL dialup. A dialog box appears every 30 seconds to a minute
stating " No connection found , would I like to work offline or try connecting again."
( I can't remember the exact phrasing) I always chose work offline.

So just to see what would happen I got the pc online thru aol.
I brought up IE ( he doesn't use IE to surf the net, he uses aol's browser ).
Went to google and within a few seconds IE was redirected to....I'm not quite sure.
See Attachment...( I shortened up the image to make the file smaller )

Of course that dialog box that kept appearing every 30 seconds or so stopped
so I'm guessing its related to what redirected IE.

Let me add that I had 2 screenshots I was going to post but one file got corrupted.
In essence it was very similar to the one I attached except in the address bar
instead of saying NetworkD at the end, it said Cydoor.

Everytime I went to google, within a few seconds IE was redirected... Read more

A:Solved: Odd hijacking + page fault error

13 more replies
Answer Match 60.48%

I have ascertained that Home Search Assistent is located within my computer. I have gotten Hijack this and About:Buster but I am not sure which files to deal with. Posted are my hijack this logs.

Logfile of HijackThis v1.99.0
Scan saved at 12:06:39 AM, on 3/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Linksys Wireless-G USB Wireless Netwo... Read more

A:Solved: Home Search Assistent hijacking

7 more replies
Answer Match 60.06%

I am getting 'updatescenter.com' as my homepage. I cannot change my homepage. Also, there is an exclamation point icon on my task bar that intermittently displays a bubble message informing me that my PC is infected and that I should download PSGuard, Spy Trooper, et cetera. Also, my desktop is displaying a similar message about my PC being infected and I can't change my desktop back. Also, I'm getting a message to the affect of 'Norton AV does not support Repair function' when Windows initially starts up. After doing some searches on these great forums, I have come across a few similar scenarios, but nothing exactly matching mine. I did download 'hijackthis', but have yet to really do anything with it. From what I'm seeing, I will need to run 'hijackthis' and post a log here to the forums. Is this a good first step? Should I do anything else?

My setup is as follows ....

Windows XP
Two (2) User Accounts on PC
Using Norton AV

Thanks in advance for any help anyone may be able to give me on this.

Eric
 

A:Solved: Help w/ Desktop/IE/Taskbar Hijacking

16 more replies
Answer Match 60.06%

Hi there to whomever!

Have been having problems with a trojan downloader, noticed first that Zone Alarm disappeared out of system tray and could not get it to come back up, even deleting and reinstalling. Tried sygate instead and am still having the same problem. Have also had my desktop highjacked with the "Danger:Spyware" red background, black box, have deleted it off system many times but it keeps coming back and when I do get it cleaned off, I can not change my wallpaper or use my right click option on mouse. Have attached HJT log with hopes of someone being able to help me out here. I have run Ad-Aware, Spybot Search & Destroy, Trojan Hunter, & CWS Shreadder. Any help on this will be great
 

A:Solved: Problems with Desktop Hijacking & more

8 more replies
Answer Match 59.22%

Hi guys and gals,
was on the web yesterday, one wrong move and... bam.
my desk top has turned black with a big yellow warning, also my home page was hijacked.
ran spy bot, and ad-aware se, managed to get my home page back, desk top still messed up, computer is running slow also. downloaded hjt here are the results, any help is appreciated.Logfile of HijackThis v1.99.1
Scan saved at 9:30:53 PM, on 12/19/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\acs.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\WINNT\system32\drivers\KodakCCS.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\ptssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\PRPCUI.exe
C:\... Read more

A:desktop and home page hijacked

7 more replies
Answer Match 59.22%

If anyone could give my Hijack this Log a lookover, I would sure appreciate it. My desktop was hijacked and replaced with a red ground and ad for Smart Security. I've managed to get rid of the actual ad on the desktop but any icon you add to the desktop shows up twice and right click is disabled. I can't remove an icon for the verizon installer. And when I go to the display properties, I cant change the desktop, all the options are grayed out except for customize desk top. I am running XP sp1, McAfee virus scan, firewall and privacy service. I have also run Ad Aware many times until it found nothing.

Here is my most recent HJT log Any suggestions appreciated. Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 12:00:21 AM, on 4/7/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\wina... Read more

A:Solved: Another Smart Security Desktop Hijacking

16 more replies
Answer Match 58.8%

Hello guys

I have experienced some errors, let me provide the details:

Acer Laptop,
OS: XP 2002, SP3, IE8, I have set a webpage as home page, but when ever I click to open new web page it come blanks showing a glob and saying:
" Internet Explorer cannot disply the webpage"
underline saying:

What you can try:
and displaying an icon saying: "Diagnose Connection Problems"

under this icon: showing an arrow with discription: More information...

it's really borhting.. and I tried even to change the home page website but still comong the same, will disply the website online when I type in the address bar and select from the favourites menu,

I will appreciate if any advises,
thanks
 

A:Solved: Internet Explorer opens a black page instead of the home page site

14 more replies
Answer Match 57.96%

I would like to set my website home page as my desktop background for my Windows 7 Home Premium on my Acer 5250. I did it in earlier versions of Windows. There should be a way besides upgrading to Win7 Pro...

More replies
Answer Match 57.96%

The picture i`ve included shows an orange edge on the sides. Is this normal or can it be changed?http://img378.imageshack.us/my.php?image=screensizeik0.jpg
 

A:Solved: Home page not filling page on sides

6 more replies
Answer Match 57.54%

EDIT: After doing the Panda scan, it appears my IE home page is no longer hijacked, but my desktop still is and the other problems still persist, although I haven't seen a Norton alert since after I restarted my computer after the Panda online scan, which hasn't been too long now. However, before restarting my computer but after the Panda scan, I was getting the Norton alerts described below.

Hello,

Just today my PC has been under attack from a bombardment of virus popups, my desktop being hijacked, and slowdowns. My Norton Antivirus has automatically deleted some stuff, and I did a scan with that as well as Panda Online scanner, AVG Antivirus and Ad-Aware. I'm still getting some Norton alerts, and my desktop and IE home page are still hijacked. Most noticeably, my PC is running slow, and oddly some things aren't working properly, like I can't open notepad (used Word to view the logs below), and when I right-click on my desktop and hit properties, no window comes up. To combat this, I tried going to the Control Panel and double-clicking Display, but again no window came up. Then out of curiousity, I tried the other Control Panel functions, and none of them were popping up windows when I double clicked them. This is really annoying, and I hope some of you great people can help me out!

The main alerts I've been getting from Norton are W32.Virut.B!dam (http://securityresponse.symantec.com...030710-0506-99), which is scary, since the description s... Read more

A:My PC is infected, running slow, and my desktop and IE home page are hijacked

16 more replies
Answer Match 57.54%

Can somebody help me out please? Everytime I scan my PC with Ad Aware SE, Spysheriff returns when I restart.

Logfile of HijackThis v1.99.1
Scan saved at 8:43:17 PM, on 19/06/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Daily Weather Forecast\weather.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CyberLink\PowerVCRII\Agent.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Opera75\opera.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Jean2\Desktop\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {3781F2A8-4A36-5D9E-3D87-65830BB5AAEC} - C:\WINDOWS\System32\flaq.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: (no name) - {ADE7F439-13F6-5801-F2FB-6213328666E2} - C:\WINDOWS\System32\mogat.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C908... Read more

A:Solved: Error -- 0028:C0011E36 -- Spyware + Spysheriff hijacking PC & desktop

8 more replies
Answer Match 56.28%

I uninstalled adobe reader and reinstalled it, now computer locks up after desktop loads and goes to a blue screen error message. I can get to safe mode but can not uninstall adobe reader.
 

A:Home page loads desktop then locks up with blue screen error mesage

7 more replies
Answer Match 52.92%

This morning I turned on my computer and found that I had numerous issues. First one being that there was a trojan virus in java that I used my EZ AV software to clean up. Secondly, my web page in IE 6.0 had been hijacked to where it opens up with "about:blank" as the home page. I can change it back to my home page but upon rebooting, it comes right back. Show below is the hijack log that I copied after using AdAware with the full scan. I attempted to use the online virus scan page that you directed me to but it is for the Netscape browser and would not run. I used another virus scan page and found no viruses. I ran the hijackthis.log through the Hijack this analyzer and this is the posted log text I came up with. Please help me through this mess. I am using a Mozilla Firefox browser as an alternate means of looking at the web.

===========================================================================================================================
Log was analyzed using HijackThis Analyzer - Updated on 12/27/04
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.... Read more

A:Hijacking of My Web Browser Page

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

You have an outdated version of HijackThis. Click here to get the latest version of HijackThis.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. Restart your computer. After we are finished with your log file and verified that it's clean, you may turn it ba... Read more

4 more replies
Answer Match 52.92%

My start page is constantly being changed to msn. I like it to be blank. How can I stop this hijacking? Thank you, in advance for you help.
 

A:Start page hijacking. Help, please?

16 more replies
Answer Match 52.5%

I have been experiencing this issue on both a desktop and a laptop, running XP and Vista, respectively. When I click on results in a Google search, I am redirected to unwanted and incorrect sites. There is also a hijacking issue. When I am on a webpage that I have chosen, sometimes I am spontaneously forwarded to a different, unwanted and unrelated site, often without clicking any links. Let's concentrate on the desktop first. I read through a couple posts of folks experiencing similar issues and I have already run TDSSKiller.exe. It didn't find anything. I am including the log below:
2011/01/26 14:24:45.0210 TDSS rootkit removing tool 2.4.15.0 Jan 22 2011 19:37:53
2011/01/26 14:24:45.0210 ================================================================================
2011/01/26 14:24:45.0210 SystemInfo:
2011/01/26 14:24:45.0210
2011/01/26 14:24:45.0210 OS Version: 5.1.2600 ServicePack: 3.0
2011/01/26 14:24:45.0210 Product type: Workstation
2011/01/26 14:24:45.0210 ComputerName: STEAMBOAT
2011/01/26 14:24:45.0210 UserName: Bear
2011/01/26 14:24:45.0210 Windows directory: C:\WINDOWS
2011/01/26 14:24:45.0210 System windows directory: C:\WINDOWS
2011/01/26 14:24:45.0210 Processor architecture: Intel x86
2011/01/26 14:24:45.0210 Number of processors: 1
2011/01/26 14:24:45.0210 Page size: 0x1000
2011/01/26 14:24:45.0210 Boot type: Normal boot
2011/01/26 14:24:45.0210 ================================================================================
2011/01/26 1... Read more

More replies
Answer Match 52.5%

Hi all, when i turn my comp on it opens up with the site i was on the last time i used my computer not my home page (Google), can anyone sort this out for me? thanks

A:[SOLVED] HOME PAGE

If your using IE try this Change your home page in Internet Explorer - Microsoft Windows Help

5 more replies
Answer Match 52.5%

I can't get my homepage back. It keeps going into e-machines google search page. I went to the control panel, internet options and click to have the homepage applied. Well it won't work. What can I do?
 

A:Solved: Home Page

I solved it. Had to go into ad & remove. Something about e-machine redirector kept coming up. My homepage is back.
 

1 more replies
Answer Match 52.5%

This morning my Win 8 IE 10 default home page (xfinity.comcast.net) comes up as a blank page. My list of favorites are still usable. My wife's computer (Win 7 IE 9) is showing normally so I know the problem is not with Comcast. I have rebooted and everything seems ok except when I start my browser I'm greeted with a blank white page.
I have also tried using Firefox (Ver 16.0.2) and I get the same blank white home page.
 

A:Solved: My IE 10 home page is gone

.....and now suddenly after about an hour of trying, it's back to normal again!
 

1 more replies
Answer Match 52.5%

Another problem. CBSNews has been my home page forever. Yesterday when I opened, Google was there. I can't remember where to go to bring back my original CBSNews and I don't know what happened. I have Windows 7. Thank you, patwannabe
 

A:Solved: home page

if it's internet explorer, tools > internet options and on the dialog box that pops up, you can just hit 'use current' (but obviously you need to be on the cbs site for that to work).
 

3 more replies
Answer Match 52.5%

This computer has Windows 7 on it. When I click to open Internet Explorer or Chrome browser, it does not go to the home page. I went to Control Panel and set the home page to http://www.msn.com, clicked Apply then OK. But when I open the browdser it stilll does not go to that home page. Internet Explorer shows nothing but a white page below the bar at the top, and Chrome goes to a Google page with boxes for different web sites such as Amazon.com.
But when I open Control Panel it stlll shows msn.com as the home page.
 

A:Solved: Will not go to home page.

9 more replies
Answer Match 52.5%

Just purchased a new computer with Windows 7 and cannot seem to set my home page. I had a homepage on Windows XP that I had customized. (my.msn.com) but when I entered that in the URL window it brought up the following:

uk.my.msn.com.

fiddling around I somehow retrieved my previous customized my.msn.com home page and set it as my home page. Next time I logon to the internet the uk.my.msn.com page loads. Every so often I can get the correct home page but I go through so many tries that I forget when I found it. Why do I keep getting the uk prefix that brings up the homepage with info from Great Britain? Any help is appreciated.
 

A:Solved: Can't Set Home Page

7 more replies
Answer Match 52.5%

My Gson just got a refurbished Dell .. XP pro ... And I'm taking a look at it.

I think I have Google setup as a home page ..
But IE7 always opens with the attached.
How do I stop it and open in Google ???

Thanks
 

A:Solved: IE7 Home Page

11 more replies
Answer Match 52.5%

OS XP Home. IE 6.0
For some reason I cannot set my home page to www.startium.com. I used to be able to but not anymore. I have two pc's and on one I can, the other I can't. I've tried shifting some settings around but not sure. I can set any other home page but that one. I WANT THAT ONE, AGAIN ! Thanks for any help on this. B-72
 

A:Solved: IE Won't let me set a home page

9 more replies
Answer Match 52.5%

I have just had a problem with IE solved here.
Now I have another.
My IE 10 is loading with a blank homepage.
I have tried using Internet Options as is normal to fix this, but no good.
Can someone help, please?

A:[SOLVED] No Home Page

In IE - Tools - Internet options under the Advanced tab, try resetting to Default which should revert the home page to MSN and then you can re-enter your preferred home page.

If you haven't changed any settings to where the page opens with a blank page, it's possible that you've picked up a malicious add-on and booting IE without add-ons would confirm that if after it boots, you get your home page when you click on the Home page icon - but let us know how you get on with either of those should you require further assistance.

To boot IE without add-ons - go Start - All Programs - Accessories - System Tools - Internet Explorer (No Add-ons)

7 more replies
Answer Match 52.5%

I set up my gateway computer yesterday and now it has a new operating system of Dell. There is one little problem. I can't set my home page. I went to control panel and internet options and I typed a website and comfirmed it and still does the homepage about: blank. Please help!
 

A:Solved: Home Page Won't Set

11 more replies
Answer Match 52.08%

OK, I just want to run this one by all of you in case there's something that Microsoft Support and I missed. For the last month or so almost all of the links from my.msn.com (my former home page) have led to a "this page is not available" page, usually MSN's, but occasionally a standard IE error page. This is all links in the new, tech, entertainment and weather sections(theirs) and 2/3's of my personal links, the only exceptions being my bank log-in, one of my two credit cards, PayPal and Check Free Web. I can't get to my library links, EBay, a local TV news web site, this forum or GetSkinned. Both of the credit card pages are secure log-in sites.

I actually got an answer from support the first time I contacted the. It read:
Hello Sara,

Thank you for contacting MSN.com Customer Support.

This is Joan and I’m sorry that you are having a “the requested page is temporarily unavailable” error message upon accessing most of the links on your My MSN page.

We have also encountered the same issue on our end yesterday and we're happy to inform you that the homepage is now back to normal. The page has encountered some minor glitch a few hours ago and our Product Specialist Team has already been notified about this at once. The homepage is now back to normal and you may now start accessing it once again. We do appreciate your patience about this matter.

In the meantime, I would suggest doing some possible workaround on your computer’s sy... Read more

A:Solved: Solved: Most links not working on MyMSN home page

9 more replies
Answer Match 51.66%

I was installing some software the other day and made the mistake of clicking the next button too many times, accepting a couple of those "click here to get malware" offers they always throw in there. I knew immediately I had made a mistake.
 
The symptoms are as follows: Upon opening a new tab in google chrome I am automatically redirected to an extremely long, garbled URL, which redirects me to Yahoo! search. If I go to google and perform any search, after a small delay an additional section of the page is filled with links to questionable sites and the text line "More Results Hub ads" is displayed nearby. If I click any link and press back I am brought to the same search but on Yahoo! instead.
 
 I followed a removal guide on this site. Here's what I've tried so far: I searched through the list of installed programs to remove it but it was not listed, closed all programs, ran rkill which found nothing to terminate, ran MBAM which found the bug, removed everything it found, restarted, ran adwcleaner, restarted again, then opened chrome to find that it was still there and nothing had changed. I re-scanned with MBAM which found the exact same problems as before. I removed them and restarted three times, the problem persists.
 
FRST Logs:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-11-2015
Ran by Konkurada (administrator) on KONKURADA-PC (05-11-2015 19:01:07)
Running from C:\Users\Konkurada\Desktop
Loaded Profiles: Konkurada (Available ... Read more

A:"More Results Hub ads" Hijacking my new tab page and search engines.

Hello konkurada and Welcome to the BleepingComputer.   
 
My name is Yılmaz and I'll help you with the cleanup of malware from your computer.
Before we move on, please read the following points carefully.
Please complete all steps in the specified order.
Even if tools don't find malware, I want you to post the logfiles anyway.
Please copy and paste the logfiles directly into your posts. Please do not attach them unless you are instructed to do so.
Read the instructions carefully. If you have problems, stop what you  were doing and describe the problems you encountered as precisely as  you can.
Don't install or uninstall software during the cleanup unless you are told to do so.
Ensure your external and/or USB drives are inserted during always the scan.
If you can't answer for the next few days, please let me know. If  you haven't answered within 5 days, I am assuming that you don't need  help anymore and your topic will be closed.
I can not guarantee that we will find and be able to remove all  malware. The cleaning process is not instant. Please continue to review  my answers until I tell you that your computer is clean
Please reply to this thread. Do not start a new topic
As my first language is not English, please do not use slang or idioms. It could be hard for me to understand.
Please open as administrator  the computer. How is open as administrator  the computer?
Disable your AntiVirus and AntiSpyware applicatio... Read more

12 more replies
Answer Match 51.66%

My wife clicked an Active X install. I have been running AVG 7 (fully updated, scanning daily) but had no spyware protection. After the incident I installed Spybot, but still encountering continued issues. Any help or direction would be greatly appreciated. Thank you!

Deckard's System Scanner v20071014.68
Run by Kevin on 2008-05-26 20:47:26
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
108: 2008-05-27 01:47:32 UTC - RP565 - Deckard's System Scanner Restore Point
107: 2008-05-27 01:21:03 UTC - RP564 - Software Distribution Service 3.0
106: 2008-05-26 19:37:03 UTC - RP563 - Removed Disney Mix It Plug-in
105: 2008-05-26 19:36:14 UTC - RP562 - Removed Disney Mix It Plug-in
104: 2008-05-26 04:13:27 UTC - RP561 - System Checkpoint


-- First Restore Point --
1: 2008-05-14 22:15:32 UTC - RP458 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Kevin.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:50:34 PM, on 5/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlo... Read more

A:http://softwarereferral.com hijacking start page

Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Don't guess. Stop and ask. Please don't run any tools on your own or make any additional system changes while we're working together, unless I request it.

Thanks.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery mode if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

As part of installing the Recovery Console, ComboFix will begin to run. Follow the prompts to install the Recovery Console. Your desktop may disappear. This is normal. It will return.

Once the Recovery Console is ... Read more

1 more replies
Answer Match 51.66%

My google home page has disappeared, replaced by BING as the default browser. I can't even log; the messgae says my profile is corrupted.
How do I restore My home page?
 

A:Solved: Home page has disappeared

11 more replies
Answer Match 51.66%

I was used to having the choices of search options right above the bar, but now it seems they all moved to the upper left corner. Is this how it looks for everyone?

I didn't know where else to post this, so I figured i'd post it here since I use Firefox.

A:[SOLVED] What is with the new Google home page?

That's the way google looks now.
Looks like that in Firefox, Opera and IE for me.

4 more replies
Answer Match 51.66%

I have a HP 510w, and I did a destructive recovery, as my hard drive was full of junk, from the last few years, and everything seems to be fine, except that I can't set my homepage in Internet Explorer! It keeps going back to a HP AOL homepage, no matter what I do! I down loaded Firefox, as that is my primary browser, but I want to clear this other up, if I can! I am posting a Hijack This file to see if someone can tell me anything! I believe some of the entries about hpwis,com is the culprit, but I don't have enough experience to be sure! Any help would be appreciated!
Logfile of HijackThis v1.99.1
Scan saved at 6:40:55 AM, on 11/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_09... Read more

A:Solved: Home page trouble

Rescan with HijackThis, close all browser windows except HijackThis, put a check mark beside these entries and click fix checked.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us4.hpwis.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4.hpwis.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us4.hpwis.com/
Reboot and reset your home page.
Also, please read this on MarketBrowser and then decide if you want to keep it:

http://www.castlecops.com/o9list-62.html
 

3 more replies
Answer Match 51.66%

Both the 32-bit & 64-bit IE9 browsers fail to connect to my home page (www.msn.com). I can't access the Tools feature (not available) when trying to connect and have to add a tab then go to Tools and see that the correct home page is shown. The initial try at connecting to my home page results in the first tab showing the MSN progress wheel in motion but nothing loads and the site it shows trying to connect to is HTTP://hp.notebook.us.msn.com which is what I suspect the problem is but can't seem to change it. I've posted two .jpg's that show the problem.
Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows 7 Home Premium, Service Pack 1, 64 bit
Processor: Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz, Intel64 Family 6 Model 26 Stepping 5
Processor Count: 8
RAM: 16384 Mb
Graphics Card: NVIDIA GeForce GTX 295, 896 Mb
Hard Drives: C: Total - 945015 MB, Free - 483775 MB; D: Total - 4690 MB, Free - 4637 MB; E: Total - 281459 MB, Free - 281358 MB; F: Total - 715362 MB, Free - 525903 MB; K: Total - 476937 MB, Free - 392454 MB; Y: Total - 476927 MB, Free - 364082 MB; Z: Total - 476937 MB, Free - 362871 MB;
Motherboard: Alienware, 0H869M
Antivirus: Norton 360, Updated and Enabled
 

A:Solved: IE9 Win 7 not accessing home page

15 more replies
Answer Match 51.66%

I was alarmed today because when I logged onto the internet, I was not directed to my home page, I was taken here:
http://www.microsoft.com/windows/downloads/ie/getitnow.mspx

Under Tools/Advanced, my home page is still the same. Can anyone tell me if I should be worried about a virus , or is it something that Windows did? I already have IE 7 and I am running Win XP home ed service pack 2. Is this a new update for sp 2 ? I just don't recall Microsoft doing this before.
Thanks for the help in advance!
ALSO!!!! Is the spell checker broken? or do *I* have a problem? When I used it just now it took me here:http://forums.techguy.org/vbspell.php which seems ok, but it did not highlight any of MY words, and it offered weird choices, like "mousepox" etc !! Im not kidding! Help!
 

A:Solved: Home page change

If you have reset the defaults in IE it will take you to that page, mine did that just yesterday.

Spell check seems fine and has been working for me today.
 

3 more replies
Answer Match 51.66%

IE home page shows this C:\WINDOWS\SYSTEM32\msblank.html. I'm also having some other problems. Tried to run CleanUp and it won't run completely, same with Ad-aware SE. CWShredder (v2.19 ) did OK and found CWS.Msconfd Oh and I tried to run Windows Explorer and after a minute it shuts down and wants to send an error report to Microsoft.

Very frustrated, thanks in advance
 

A:Solved: IE home page hijacked - need help

16 more replies
Answer Match 51.66%

I was having problems with IE 7 and used the button for Reset Internet Explorer Settings in Internet Options. Now, my Home Page is a Dellnet (actually the computer can't connect to it) web address and I have not been able to set it back to 'blank page.' I have used the Internet Options and the 'Home' button and have even re-started the computer but it still keeps the Dellnet address. I've run SpyBot and SpySweeper but still can't get the Home Page to be 'blank page.'
 

A:Solved: Can't change Home Page

12 more replies
Answer Match 51.66%

I recently redownloaded firefox and its not the same as it was it comes with the homepage ask which i dont like but have been unable to remove and replace with google. Can anyone help.

A:[SOLVED] how do I change my home page

homepage ask.com? strange. it's always been google in firefox. I downloaded firefox 3 and it was google alright. anyways, if you need to change it:
Tools->Options-> "main" tab-> type in your address.

if you want google, simply type in www.google.com,
if you want google firefox start page, type in http://www.google.com/firefox
if you want iGoogle, type in http://www.google.com/ig?hl=en&source=iglk

11 more replies
Answer Match 51.66%

I am trying to get my neighbor's puter straightened out and every thing is working good now except under internet options when I change the home page to msn and go back into it it keeps reverting back to some search page (it won't stay changed) also he has some sex sites in his favorites that we can delete and empty put of recycle bin but the next time he starts the computer they are back. he had a bagel worm and we got rid of that using stinger and also ran spybot. but the problem is still there, can anyone help? running win xp home
 

A:Solved: home page won't change

6 more replies
Answer Match 51.66%

Hi'
I'm convinced my home page has been hijacked. Through a little research I can see that I.m not alone. Here is the problem:

When I log on to Internet Explorer I am directed to www.safetydefender.com which is not my original home page. No matter how many times I've tried to reset to my original, or other home pages, it reverts back to this page. I am also getting numerous pop-ups and alerts which tell me I have major security issues and direct me to download thier spyware, malware, ect, which at least I know enough not to do since I have no idea who these so-called security experts are. I have my IE pop-up filter levels set to high and also have pop-up blocking through my Cox Security Suite, but this has not stopped them. Below is the basic text of the page I am directed to when I log on to IE:
Attention! Your system is under control of remote computer with IP address 227.4.167.118. The remote computer has access to the following folders on your PC:
- \WINDOWS\System32
- \Program Files\Internet Explorer
- \My Documents
- Drive C:\ files
Click here to download official anti-spyware software

Your private info is collected by [email protected]
Your IP address: 68.230.135.72

Your Country: US, United States

They know you're using: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)

Operation System: OS Windows

Risk status for futher investigation: VERY HIGH RISK

Time of investigation: Sun Apr 30 15:44:05 PDT 2006

... Read more

A:Solved: My Home Page has been Hijacked!!!

9 more replies
Answer Match 51.66%

I have a friend that has older HP desktop with vistal Vista and IE9 . I had to install a sata controller because the one on the board in the nividia 9100 chipset failed from over heating. Well his hard drive wouldn't boot to the new controller so I had to reinstall every thing. I set his home page to google becase I was searching a lot. After he got it back he tried to change it and every time he closes it after changing it goes back to google. ?? Ran malware bytes and didn't find anything. Google is hijacking his homepage!

A:[SOLVED] IE 9 home page won't stay

Looks like Home Page is being HiJacked:
We recommend that you read this article…
NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help
follow the instructions very carefully; then, post all the requested logs and information; as instructed, in the Virus/Trojan/Spyware Help section of the forum.
(Simply, click on the colored links to be re-directed.)

Please ensure that you create a new thread in the Virus/Trojan/Spyware HelpForum; not back here in this one.

When carrying out The Malware Removal Steps, if you cannot complete any of them for whatever reason, just continue on with the next one until they are all completed.
However,it is extremely important to make mention of the fact that you could not complete any of the steps in your post to the Virus/Trojan/Spyware Help Forum; where an Analyst will assist you with other workarounds.

Once done, please be patient, as the Security Team Analysts are usually very busy; one of them will answer your request as soon as they can.

2 more replies
Answer Match 51.66%

Operating system is: Windows XP Home edition
Computer is: Gateway 556GE Intel Pentium 4 Processor 630 200GD SATA HD

Problem: in IE 7, whatever home page I set via Internet Tools is changed to: http://go.microsoft.com/fwlink/?LinkId=69157

Does anyone have any suggestions on how I can set my home page and hot have it moved or hijacked to the above http:// address?

I am a novice in re: computers. I am good at following directions.
 

More replies
Answer Match 51.66%

This is the EXACT same thing that's happening to me. I posted about it down in another thread and am waiting for some help too! Maybe someone can kill 2 birds with one stone with us.

My hijack log:

Logfile of HijackThis v1.99.1
Scan saved at 8:25:27 PM, on 4/30/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\dcomcfg.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\NetZero\exec.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\NetZero\qsacc\x1exec.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer... Read more

A:Solved: Home page hijacked

16 more replies
Answer Match 51.66%

I am stumped.

My home page keeps changing to this wierd search thing and ever so often, my browser will just randomly change to another website, like a casino one.

I have run Ad-aware. I have run CWShredder. I have run Spybot.

I have HiJack This downloaded... but the thing is, I am not too sure how to use it. I know how to scan and save the log, but I am not sure which entries are bad. Any help would greatly be appreciated.
Logfile of HijackThis v1.97.7
Scan saved at 6:17:39 PM, on 7/3/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\runservice.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\rundl... Read more

A:[Solved] I have a virus that changes my home page and causes many pop ups...

12 more replies
Answer Match 51.66%

about every third time I log onto the internet my home page doesn't come up instead I get http://hp-desktop.aol.com/ instead.. if I click on home button I get my home page. I would like to stop this but don't know how, I've done a search for anything aol and deleted it, there is always a cookie in my temp files after this page comes up and I delete it but then in a day or two it comes up again. can anyone help solve this, I have run adaware and spybot and I am using avast
 

A:Solved: home page problems

if you are on aol as your isp you will get this come up,minimise then use internet explorer or firefox which ever u use.assume u on aol so no way of preventing the start up page as this one however if u not on aol then try internet options to alter your home page.
 

3 more replies
Answer Match 51.66%

A page called safeprojects.com has taken over as my home page. Also, it appears to be the cause of frequent pop-ups relating to security as well as some porn sites, etc. There is now a flashing yellow triangle in the tray along with a shield that alternates between red and blue. I have tried without success to re-set the default hompage, and even listed this site as a restricted site. Not being a geek, I am at a loss as to what to do. Can anyone help? Thanks much.
 

A:Solved: Home Page Takeover

15 more replies
Answer Match 51.66%

Good Evening:
I have run Adaware, spybot cwshredder and ccleaner
I have also tried to go right into the registry and change the home page NOTHING
Attached is my current HIJACK THIS LOG

I really could use your help again. Cnn has a terrible home page because the text is always blurry(don't ask me why-but its only on this website)

Logfile of HijackThis v1.99.1
Scan saved at 10:16:19 PM, on 12/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus... Read more

A:Solved: Cannot change IE 6 home page

bump - AM I POSTING THIS IN THE WRONG FORUM. UNUSUAL NOT TO GET ANY ASSISTANCE THANKS
 

2 more replies
Answer Match 51.66%

Sometimes when i try to open my Firefox browser the home page doesn`t show and the screen is blank except for the toolbar, and when i try again the home page comes up. I`m on Windows XP and Firefox 3. Any clues?

A:[SOLVED] Home page blank

Hi Julie,

Try clearing firefox's cache.
Go to Tools > Clear Private Data.

From here, I normally check all items except 'Saved Passwords'.

10 more replies
Answer Match 51.66%

It's a search page from Conduit. How Can I get rid of it?
 

A:Solved: Something downloaded a New home page on my PC.

15 more replies
Answer Match 51.66%

Every time I start up my machine my IE explorer makes my home page "awesomehomepage.com". I don't know what did this. The most recent thing I did was upgrade google earth on my PC so that I could use google sky feature. I believe I did not check any options to install a toolbar/homepage but I can't guarantee that. I've run spybot with the most recent detection library/rules about two days ago and nothing removed this. I've included a hijack this! log and I can see the entry that does this but I don't know how to remove it. Can you help me out?

Here is a hijack this! log I just ran:

Logfile of HijackThis v1.99.1
Scan saved at 3:26:12 PM, on 8/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Pure Networks\Network Magic\nmapp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\D... Read more

A:Solved: Need help removing home page

7 more replies
Answer Match 51.66%

I have some spyware i cant get rid of, it also is stopping me from getting my e-mails, every time i log in to them the search screen pops up. here is my Hijack log, hope someone can help me ?
Thanks Chris
Logfile of HijackThis v1.98.1
Scan saved at 14:49:01, on 07/08/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\AOL 8.0\WAOL.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PCI AUDIO APPLICATIONS\MIXER.EXE
C:\WINDOWS\SYSTEM\SISTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\LXAMSP32.EXE
C:\WINDOWS\SYSTEM\PRINTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\ptsnoop.exe
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\PROGRAM FILES\SIBER SYSTEMS\AI ROBOFORM\ROBOTASKBARICON.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAM FILES\AOL 8.0\AOLTRAY.EXE
C:\PROGRAM FILES\EXIF LAUNCHER\QUICKDCF.EXE
C:\PROGRAM FILES\LEXMARKX63\ACBTNMGR_X63.EXE
C:\PROGRAM FILES\LEXMARKX63\ACMONITOR_X63.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\AOL 8.0\SHELLMON.EXE
C:\WINDOWS... Read more

A:[Solved] home page hijacked

16 more replies
Answer Match 51.66%

I know ALT+Home sends me to my homepage in the latest version of explorer (9?), but it doesn't work in the version right before that. A friend of mine does not like the new IE and was wondering if there was a shortcut key to return him to his homepage.

Thanks again.
 

A:Solved: Home page shortcut key?

ALT+Home takes you to the homepage in IE7 . . what's not to like????
 

3 more replies
Answer Match 51.66%

Hi,

I would appreciate it if someone couldhelp me with the problem that i have which is my home page is hijacked by a site that tells me that my computer's privacy has been compromised and i need to click on to a link to resolve the problem. Everytime i tried to set my home back to mine, it automatically go back to the message.

I have run the HijackThis and the log is:

Logfile of HijackThis v1.99.1
Scan saved at 10:50:15 AM, on 6/5/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\BLSTAPP.EXE
C:\PROGRAM FILES\CREATIVE\COLORIF\PROGRAM\HGCCTL95.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\ZONE ALARM\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM32\SVCNUT32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://C:\WINDOWS\system32\shdocpa.dll/security.htm#subID=PRFV;6784
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://shdocpa.dll/asst.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D... Read more

A:Solved: Home Page Hijacked

16 more replies
Answer Match 51.66%

This morning my computer (Windows Vista) changed my home page from Yahoo.com to "mx.yahoo.com" and I cannot find a way to change it back. I do live in Mexico, but have always used yahoo.com as I like the English version news, etc. Can someone please help me. I was told to click on a US flag, but there is not one except in the Answers.Yahoo.com which is NOT my home page and does nothing to change my yahoo.com back to its normal stage. Thanks in advance.
 

A:Solved: IE 8 with Yahoo.com as home page

7 more replies
Answer Match 51.66%

A while back I had this same problem, asked for help and got it on this site. Now, I cannot find the help with a search of the site so have to post asking for help again.

Everything was running fine on both my computer and then one day it started giving this message again on both computers. The computers are not on a network.

This is the message;

"Right now, your browser's settings are configured to disable cookies and/or javascript. In order to access your account, you must change your browser's settings to accept both cookies AND javascript".

I have checked and reset all of my privacy and security settings and there was nothing wrong when I started and nothing wrong with them now.

Any ideas on what to do next?

Thanks
 

A:Solved: Home page problem again

The quickest solution is to use firefox if you aren't already
http://www.getfirefox.com - if you ARE using that, then try it with Internet Explorer.

In my opinion FireFox is easier to configure, and you will probably get to like it more than Internet Explorer FAST
 

3 more replies
Answer Match 51.66%

My home page keeps changing, it just started today. I ran Adaware, Spybot S&D, CCleaner, and Norton AV and found nothing. The page keeps changing from https://webmail.earthlink.net/wam/login.jsp?redirect=/wam/index.jsp&x=950565919 (which is the page I want) to http://www.dejazzd.com/ or http://www.windowsmarketplace.com/category.aspx?bcatid=834&tabid=1&WT.mc_id=0207_07.

Would someone mind checking out my HJT log and let me know if you see a problem? TIA!

Logfile of HijackThis v1.99.0
Scan saved at 1:14:01 AM, on 2/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HP\KBD\KBD.EXE
C:\windows\syst... Read more

A:Solved: home page keeps changing

This is driving me crazy........I did a system restore, ran more scans, downloaded Windows Defender, and the home page still keeps changing. Here's a new HJT log from this morning........

Logfile of HijackThis v1.99.0
Scan saved at 7:30:01 AM, on 2/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\snmp.exe
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\VIRTUA~1\SMARTB~1\SprintDSLAlert.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\NoAds\NoAds.exe
C:\WINDOWS\system3... Read more

1 more replies
Answer Match 51.66%

res://eqpfa.dll/index.html#31377

my home page has been changed and i can't seem to get rid of the problem and neither can computer tech.

any ideas on the eqpfa.dll file

thanks
ace
 

A:[Solved] home page problem

16 more replies
Answer Match 51.66%

When I try to access the web I am taken to a different page: http://win-eto.com/hp.htm?id=31403

I have Adaware SE and Spybot both updated and Hijackthis. This is what I have done:

1.- I updated all programs
2.- I turned off system restore
3.- I restarted in safe mode
4.- I deleted all temp files and IE internet temp files
5.- I runned spybot and deleted 7 spywares
6.- I runned Adaware and deleted 20 malaware
7.- I runned hijackthis to see if there were any malicious programs such winlogin or something referencing to this new page, but I didn't see anything.
8.- I restarted my computer and tried to access the intertent but I still have the same problem.

Can you please help me or guide me as to how can I get rid of this spyware. I am attaching my hijackthis log for your riview.

Thanks

Logfile of HijackThis v1.98.2
Scan saved at 4:36:53 AM, on 11/27/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\TPSMain.exe
C:\WINDOWS\system32\TFNF5.exe
C:\TOSHIBA\IVP\ISM\pinger.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\Syst... Read more

A:Solved: Home page hijacked

7 more replies
Answer Match 51.66%

Hello I'm trying to find out how to remove this spyware.

IE 9 seems to be stuck on About:Blank for my home page and I can't change it.

I'm thinking I've been infected which seems odd because I an A/V and Malwarebytes pro.

Some how it got in...

A:[SOLVED] IE9 home page can't be changed.

Should I just wipe out my hard drive. I wish I could just remove it but this gmer scanner will not work correctly.

I ran a combofix log though.

It shows the spyware I think.


Quote:




.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Wayne\AppData\Local\Temp\{53BB7233-569B-49AB-8AA2-CBFAF8AF0200}\fpb.tmp
c:\users\Wayne\AppData\Roaming\vso_ts_preview.xml
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_NPF
.
.
((((((((((((((((((((((((( Files Created from 2012-04-03 to 2012-05-03 )))))))))))))))))))))))))))))))
.
.
2012-05-03 23:07 . 2012-05-03 23:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-03 21:23 . 2012-05-03 21:38 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-05-03 21:23 . 2012-05-03 21:26 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2012-05-03 21:16 . 2012-05-03 21:16 -------- d-----w- c:\program files (x86)\VS Revo Group
2012-05-03 07:10 . 2012-05-03 07:10 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-05-03 07:10 . 2012-05-03 07:10 476960 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2012-05-03 07:10 . 2012-05-03 07:10 -------- d-----w- c:\program files (x86)\Java
2012-05... Read more

1 more replies
Answer Match 51.66%

Hi
I had a adware program that I could not remove even after finding and zapping everything in the reg that mentioned CONDUIT, so I ran a program called AdwCleaner which found and removed the pesky blighter, unfortunately it also removed my homepage which left a blank page with just the Chrome Web Store logo on it and the bookmarks and address bars above.
I have tried opening the Google Chrome Browser and checked the "Show home Button" which does show underneath it my home page address, I have also opened the Control Panel and checked the "Internet Properties box" which also displays my home page address.
Am I missing something that is turned off? and is AdwCleaner a safe program to use? Regards Robert.
 

More replies
Answer Match 51.66%

Home pages changes to: http://news.bbc.co.uk/2/HI.HTML

Non urgent.

EDITED: To remove hjt log.

The Joke is on Me, ref: #4
 

A:Solved: Hijacked home page

11 more replies
Answer Match 51.66%

IE otherwise works fine. HP is www.tamu.edu. It will load from AOL. Have run Avast scan, Adaware, Spybot, all ok. HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 8:08:36 PM, on 6/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\ESPNRunTime\DIGServices.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Fil... Read more

A:Solved: Home Page won't load

9 more replies
Answer Match 51.66%

I miss it. How can I get it back? Thanks.

A:[SOLVED] iGoogle home page went away!

Open your browser's options and change the Home Page setting to http://www.google.com/ig

4 more replies
Answer Match 51.66%

hi a have a few issues involving my home page.

the problem occurs when I connect to the internet it takes me straight to this site
http://thesecureservice.com/

and not my specified home page
also when I type anything in the address bar it takes me to this site
http://www.serial99.com/?www.google.co.uk
not the one I want

I would be most gratefull if some one could help me with this issues I have also outlined the problems that my virus scanner finds and have done a hijack this log if you could look over this it might help as I do not know what to fix with this

thanks

virus scanner
NOD32

Erros
pleas see atachment there is also a virus report I get from the internet here

anyway hear is my hijack this log

__________________________________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:48:15, on 2007/11/04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Common Files\... Read more

A:Solved: home page takeover

11 more replies
Answer Match 51.66%

I have a problem where I change my home page to www.yahoo.com (what i want) but when ever i restart my computer and go to my homepage it changes to about:blank. I run adware and spy bot and cw shredder but it doenst seem to fix this. Any ideas? Also is there anything i should remove with hijack.

Logfile of HijackThis v1.97.7
Scan saved at 3:12:57 PM, on 7/15/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\NDrv.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Internet Explorer\ie... Read more

A:[Solved] Home Page Help (Hijack this log)

14 more replies
Answer Match 51.66%

I use Firefox brouser and I go to the tools, options and under startup, I enter my desired start page or even say to 'use the current page'' My home page does not update. In this window I do NOT ever see an 'enter' button so I'm not sure how it gets the required info. I have tried it after disabling the AVG anti virus.

Here is my sys info
Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows XP Professional, Service Pack 3, 32 bit
Processor: Intel Pentium III Xeon processor, x86 Family 6 Model 23 Stepping 6
Processor Count: 2
RAM: 2001 Mb
Graphics Card: Mobile Intel(R) 4 Series Express Chipset Family, 1024 Mb
Hard Drives: C: Total - 112643 MB, Free - 70984 MB; D: Total - 1827 MB, Free - 1805 MB;
Motherboard: FUJITSU, FJNB1EB
Antivirus: AVG update module, Updated: Yes, On-Demand Scanner: Enabled
 

A:Solved: How to reset home page

On the lower right of this box are 3 buttons: OK, Cancel and Help. Click OK before you close the box with the red X at the top right corner.
 

14 more replies
Answer Match 51.66%

Below is my logfile. I ran a program to get rid of "safety alert 2006". Got rid of message on toolbar. But my IE homepage is hijacked with a page purporting to get rid of virus that I know is fraudulent. Can someone help? Here is my log:

Logfile of HijackThis v1.99.1
Scan saved at 5:20:32 PM, on 10/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VideosCodec\isamonitor.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell Photo AIO Pri... Read more

A:Solved: home page hijack

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted: "Registry cleaning - Do you want to clean the registry?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.

A text file will appear onscreen, with results from the cleaning pr... Read more

1 more replies
Answer Match 51.66%

hello all,today i turned on my puter,launched ie7,and my home page came up as aol,ive changed it to msnbc.com,and when i shut the web page down and relaunch ie7,aol comes back up,what gives with this?
 

A:Solved: home page keeps changing

16 more replies
Answer Match 51.66%

I did a RESTORATION of my computer resently. Now the Home Page is LOCKED to ...
http://hp-desktop.aol.com/.
No matter what I type in...that is what opens in IE. Even Blank Page does not work.
I have an HP a600n with Windows XP SP2. Any help will be appreciated on getting AOL off my Home Page.
 

A:Solved: Home Page Problems

16 more replies
Answer Match 51.66%

...and links have been added to my favorites. I have Mc Afee virus scan and spyware x-terminator. How come these things still get into my computer? I never had any problem with that until I purchased spyware x-terminator from a local store. Any advice would be greatly appreciated. I am running windows xp proffessional if that is any help to you. Thankyou in advance.

Rhonda
 

A:Solved: My home page has been hijacked...

7 more replies
Answer Match 51.66%

I have an Acer laptop running Vista.
Every time it loads IE, the Acer home page loads, in a separate tab, as well as my own designated homepage.

Is there a way of preventing the Acer tab from loading?
 

A:Solved: Remove home page

OK - should have checked first - just realised that Acer site was set as default which I did not delete, when setting my own home page.

Look before you post I guess.
 

1 more replies
Answer Match 51.66%

HI - everytime I do a restart I lose my home page. Vista with IE8 and it is set to always be igoogle and I lose it every time.
Any help would be appreciated.
 

A:Solved: Home Page Lost

What is your homepage being changed to? Sometimes viruses and malware will change your homepage.
 

2 more replies
Answer Match 51.66%

My daughter's computer does not load the defined home page i.e. www.google.co.uk. In Firefox it brings up a Firefox page which is not the Home page but a Firefox page with a keying in slot with the word search next to it. Keying anything in and hitting return does nothing. Please can anyone help please?
 

A:Solved: Home page not loading

6 more replies
Answer Match 51.66%

my homepage has been hijacked to http://www.security2k.net/. i have a friend helping and she referred me to your site. i have two suspicious icons, remove spyware and online dating. additionally, my windows theme was changed to a spyware theme.

i ran spybot as well as norton, as well as try to resolve the issues.

after running spybot i went ahead and ran regedit to delete the entries that spybot was unable to delete, i now receive the following error upon windows start - invalid backweb application id "137903" -

i have run an ewido scan in safe mode as well per her instructions.

she downloaded and ran hijack this, here is the log

can i please get some help cleaning this up, i am def a beginner but smart and can follow instructions well

---------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 8:37:42 PM, on 9/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\shnlog.exe
C:\WINDOWS\System32\msole32.exe
C:\WINDOWS\popuper.exe
C:\Program Files\Common Files\Real\Update_O... Read more

A:Solved: hijacked home page and MORE!

16 more replies
Answer Match 51.66%

I use igoogle in ie8 as my homepage. I use XP pro. in the shop, and Vista Home premium at home. Both have igoogle as home page. Both were trouble free till recently when the vista machine started changing the home page to either msn or bing. If I'm using explorer on and off all day, no problem. If I leave for a while either msn or bing will replace igoogle. I do NOT have an infection, I have scanned both machines thoroughly and they are clean. Any suggestions would be appreciated. gtwyuser

A:[SOLVED] ie8 home page changes randomly

If your preferred search engine has been changed to Bing, reselect Google and again select igoogle as your Home Page. All the "infection" connected to this problem redirect you to harmful sites which isn't happening to you, but it's worth running Ad-Aware anyway.

2 more replies
Answer Match 51.66%

I have a Dell dimension 4600 with windows XP, I am running Internet Explorer through a cable connection. My home page has been hijacked and my computer is running slow and hangs in wait alot. this also happens while connected to the internet. I ran a hijack this program and this is the log.
I also have Norton Anti-Virus running as well as Aluria's spyware removal, any additional info neded?

Logfile of HijackThis v1.98.2
Scan saved at 12:50:09 PM, on 8/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\sdkap.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\atlty.exe
C:\WINDOWS\System32\zcmfrh.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\wibnmywq.exe
C:\Program Files\Aluria Software\ASE\ASE Scheduler.exe
C:\WINDOWS\Syste... Read more

A:[Solved] hijacked home page

16 more replies
Answer Match 51.66%

Hiya

Does this look okay:

Logfile of HijackThis v1.97.7
Scan saved at 12:03:56, on 09/05/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\regprot\regprot.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Documents and Settings\Owner\My Documents\Programs\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.blueyonder.co.uk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by blueyonder
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - ... Read more

A:(Solved) Have something that keeps changing home page

16 more replies
Answer Match 51.66%

Hi,
For years www.yahoo.com has been my homepage and I liked it. Now Yahoo seems to have forced www.m.yahoo.com on me and even when I got rid of what I call the "M" version, it came back within a say or so. I hate it!

I am trying to find another homepage. Any and all suggestions will be appreciated. No, I don't like msn.com either.

Bill

A:[SOLVED] Home Page suggestions

Clearing the browser cache of cookies and temp files and then typing http://www.yahoo.com/ in the browser window returned the old familiar design in most cases.

m.yahoo is mail yahoo...

Are you signing out when you leave the site?

3 more replies
Answer Match 51.66%

I am using Firefox 21.0 as a browser and suddenly instead of opening my.msn.com (my home page) it opens the msn.com home page. I sign into my account and go to my.msn.com after clicking "remember me" and then select my.msn.com as my home page by dragging the butterfly logo to to home button. The next time I open Firefox I have to repeat the process. Can anyone shed some light on why this is happening?
 

A:Solved: MSN overrides my home page

6 more replies
Answer Match 51.66%

I am using Internet Explorer as my browser.I am having a yahoo problem for about a week and it is only one page. All other pages works fine. I have always used www.my.yahoo.com as my home page, now for past week when I go there the background opens up and then I get a little message as in this photo http://smg.photobucket.com/albums/v299/mamaw/?action=view&current=Image1.jpg. When I say ok to this message, it says "This page cannot be displayed". I emailed yahoo and have done everything they tell me,eg, empty temp files, empty cacch as well as deleted cookies. I have tried to restore my computer to a week ago, but it said it cannot be restored. Any help would be greatly appreciated.
PS. I installed Modzilla Firefox and the page works fine in that browser.

TYIA.

Lena
 

A:Solved: Problem with my home page

9 more replies
Answer Match 51.66%

My IE has been hijacked to a Home Search page. I run windows XP home edition and use Spybot to try to protect against this stuff but got zapped and need help getting rid of the crap that has invaded my system.

I went to tomcoyote and followed their quickstart instructions to produce the following hjt log:
Logfile of HijackThis v1.99.0
Scan saved at 1:28:55 AM, on 12/26/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\crir.exe
C:\WINDO... Read more

A:Solved: Help with Hijacked Home Page

9 more replies
Answer Match 51.66%

When Trying to Load Google and Use it for My Home Page it Comes Up But Disappears , Now a few days Ago Google was Working on I E 7, As You Can See Below and Error Has Come Up Displaying This > .


Internet Explorer cannot display the webpage

What you can try:

Diagnose Connection Problems

More information .........................................ERROR MESSAGE


HOW TO FIX IS THE QUESTION ?

A:[SOLVED] Google Home page

If you have Windows7 and IE7 your Windows Updates are way out of date. Update now!

8 more replies
Answer Match 51.66%

I am running Windows XP SP2 and IE7. I do have Norton Internet Security running.

Whenever I open up Internet Explorer it seems like it is looking for the homepage, but then says "Internet Explorer cannot display the web page". Here is the address that pops up http:///4.4.4%20FrontPage/5.0.2.2635...OpenSSL/0.9.7a .

I am able to view other pages and am able to get to the homepage by clicking the "HOME" button on IE. However, the homepage will not come up when I start IE.

Any ideas?

A:[SOLVED] Home Page will not come up. Everything else is fine.

Hello again

please do this:

http://blogs.msdn.com/ie/archive/2006/06/12/628499.aspx

3 more replies