Tech Problem Aggregator

automatic IE start and startup page changed

Q: automatic IE start and startup page changed

I have the following problem: Two days ago while browsing a pop-up window caused my Internet Explorer to freeze. Since I was almost done browsing I chose to shut down the PC altogether and only a few hours later realized I had caught some kind of spyware or virus:
Whenever I boot IE is opened automatically.
The startpage was changed to some kind of websearch with different entries already given (and named "about: blank".
Whenever I changed that into my standard it was changed back as soon as I closed the IE and at every reboot.Also at one point when I was online something should have been downloaded, but I just canceled that request, not having a closer look at what that may have been.

Since then I took the following actions:
manually looked for files that had been added to my system at the time of that frozen IE. I found some and moved them to a different folder.
They were: javaqh32.exe, oirqw.txt, netis.dll, d3ue32.exe in the C:\WinNT folder, mswb32.dll, yqarj.dll, wmaa.dll, sdkud.exe, sysnk.exe, syspj32.exe in the C:\WinNT\System32 Folder. Since I manually moved them I thought I?d better mention them in case your hijackthis will overlook them.
I remember that javaqh32 was in the loaded processes, as well as d3ue32 and I managed to get them out of there and to different folders by starting my system under DOS and move them then.
After that I also updated my Adaware (was 6.0, but I also downloaded your named SE 1.06 version today), updated it and run it.
It found some problems that got fixed.
After that I started my updated Spybot S&D and it also found a few entries in the registry (Oh I remember I took a look there too and manually removed two entries that I think were mentioned in another post, something starting with 11? or the like, some hieroglyphs – anyway, I had that deleted already before starting Spybot).
Spybot tried to fix the problems, but there was one problem regarding a "Trek Blue Error Nuker" that needed a reboot to have it removed.
I did so and apparently Spybot managed to remove it, BUT whenever I rebooted, all the other problems had come back !!!
So I ran through this procedure three times yesterday, without getting it fixed. Somehow I managed to at least have that offline-saved quick online Search removed to my IE now always starts on about:blank without having some resident page loaded.
Please apologize if I am not making sense with some statements, I am German so I might translate some things not as good as it might be.
Okay, so today I read your post here in the forum about what I have to do before posting.
As I said, I downloaded and updated Adaware 1.06 and run it, it fixed some more problems. After the reboot I think they did not reappear.
Then I tried that Online-Scan.
But, apart from the fact that your instructiuons should be adapted to the new versions (some buttons at adaware have changed or disappeared that I should have clicked), I was NOT ABLE to perform that scan. As soon as the components were loaded so that I could pick my drives and click on start, a few seconds later my IE closed with an error message that IE had "caused problems and will be closed" (Well, I think you know that kind of message).
I tried it three times with the same results.

So here I am, followed the instructions for hijack this, although I had another problem while downloading it: my kerio personal firewall informed me that a programm called ljsm (I think that was the name, not sure) wanted to start something else, three or four different programs with similar names. I blocked that via kerio but since that kept on and on again I went to my task-manager and shut off that process ljsm. It might be that this will then not have been "seen" by hijack this ? I don?t know, but I thought it best to mention it.
Alright. So then I used the HijackThis Analyzer program to get the "new" log and so here we go.

I am not so sure about what additional info you need, I suppose mainly of my software-system: I am using MS Windows 2000 professional (NT, the German version). Additional security software: Adaware 1.06 (updated 1 hour ago), Spybot search & destroy (updated yesterday evening), AVPersonal Antivir (that has not been updated for months due to a blockade it created when updated – I was only able to go online for 30 minutes then my internet connection was shut off, don?t ask me how that worked but it definitely had to do with Antivirs update mechanism – but I will update that as next move now), I am using Kerio personal firewall (but I am not too sure about how well it is configured), that?s it.

So here?s the hijack this log:

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 6/3/05

***Security Programs Detected***

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 18:11:51, on 24.06.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Zubeh?r\Kerio PF\Personal Firewall 4\kpf4ss.exe
C:\Programme\Zubeh?r\Kerio PF\Personal Firewall 4\kpf4gui.exe
C:\Programme\Zubeh?r\Kerio PF\Personal Firewall 4\kpf4gui.exe
C:\Programme\Creative\SBLive2k\AudioHQ\AHQTB.EXE
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Creative\ShareDLL\CtNotify.exe
C:\WINNT\twain_32\B12U12K\WATCH.exe
C:\WINNT\ntob32.exe
C:\Programme\Microsoft Office\Office\MSACCESS.EXE
C:\WINNT\ipmj.exe
C:\Programme\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {029122D8-4CF7-507C-99FE-A99E0A18B0AE} - C:\WINNT\system32\sysar32.dll
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [AudioHQ] C:\Programme\Creative\SBLive2k\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [Disc Detector] C:\Programme\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Programme\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [ipmj.exe] C:\WINNT\ipmj.exe
O4 - HKCU\..\Run: [SDC] C:\Programme\Zubeh?r\change.exe
O4 - Global Startup: Watch.lnk = C:\WINNT\twain_32\B12U12K\WATCH.exe
O8 - Extra context menu item: &Feedback Filter - file://C:\Programme\Zubeh?r\FBFilter\FBFilter.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\Programme\Zubeh?r\Outpost Firewall 1.0\trash.exe (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\Programme\Zubeh?r\Outpost Firewall 1.0\trash.exe (file missing) (HKCU)
O12 - Plugin for .mid: C:\Programme\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .UVR: C:\Programme\Internet Explorer\Plugins\NPUPano.dll
O12 - Plugin for .wav: C:\Programme\Internet Explorer\PLUGINS\npqtplugin.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O15 - Trusted IP range: 206.161.125.149
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.140/code/PWActiveXImgCtl.CAB
O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://ftp.hp.com/pub/automatic/player/isetupML.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1EE86091-D0A4-4964-87C7-BD2639F5501B}: NameServer = 62.104.191.241 62.104.196.134
O17 - HKLM\System\CS1\Services\Tcpip\..\{1EE86091-D0A4-4964-87C7-BD2639F5501B}: NameServer = 62.104.191.241 62.104.196.134
O23 - Service: Workstation NetLogon Service ( 11F??#????I) - Unknown owner - C:\WINNT\ntob32.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Verwaltungsdienst f?r die Verwaltung logischer Datentr?ger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Programme\Zubeh?r\Kerio PF\Personal Firewall 4\kpf4ss.exe

End of KRC HijackThis Analyzer Log.
====================================================================

I really hope you can help me here. I will now save some of my most important data and then update Antivir and hope for your help.

A: automatic IE start and startup page changed

Greetings, and welcome to TSF!

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. If you have Windows XP, the search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Right click on this link http://www.greyknight17.com/spy/DelO15Domains.inf and choose Save As. Save it to your desktop. Right click on that file and choose Install. It will run immediately (you won't be able to see anything happen). You may delete it afterwards.

===============

The version of Internet Explorer your currently using is out of date, and should be upgraded to the newest version as soon as possible.

===============

-

1. Click "Check For Update"

4. Exit the program.

1. Click "Update".
2. Click "Check For Update"

4. Exit the program.

===============

Reboot your computer into "Safe Mode"

===============

1. Click "Fix ->"

===============

1. Click "Start".

(Wait for the initial ADS scan to complete.)

2. Click "Yes", to shutdown any IE session currently open.

(Wait for the about:blank scan to complete.)

3. Click "Ok", to scan once more.
4. Click "Yes", to shutdown any IE sessions currently open.
5. Click "Yes", to begin the second pass.

6. Click "Save log", and post this log back along with your new log.
7. Click "Exit".
8. Click "Exit".

===============

===============

Let's look for, and delete, any program segments(prefetches) that might be present, and are associated with the 'problems' we're trying to remove from this system. To do this, let's:

1) Click "Start | Search", then search for each of these program's base name(s), in all files and folders:

2) Then if any are found in the 'prefetch' folder, delete them.

Look closely, since the 'base' name will have a bunch of random numbers and letters attached to it.

===============

Next, Open a command prompt by:

1. Clicking "Start", then "Run...".
2. Enter "cmd" (without the quotes).
3. Enter "services.msc" (without the quotes).

-

Now, locate and 'stop' the following services, if present:

Workstation NetLogon Service ( 11F??#????I) owner ... (C:\WINNT\ntob32.exe)

Look carefully, since the name of the service (above) can be anywhere in the entry; also be careful not to 'stop' any required system services.

===============

Run HiJackThis then:

1. Click "Config..."
2. Click "Misc Tools"
3. Click "Open Process manager"

-

Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:

C:\Programme\AVPersonal\AVGNT.EXE
C:\WINNT\ntob32.exe
C:\WINNT\ipmj.exe

Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.

===============

Now, let's open a command prompt and unregister the dll(s) we're going to remove, by entering the following:

regsvr32 /u sysar32.dll

It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to the command prompt to save on the typing.

===============

Run HiJackThis and click "Scan", then check(tick) the following, if present:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\drkzn.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\drkzn.dll/sp.html#55135

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {029122D8-4CF7-507C-99FE-A99E0A18B0AE} - C:\WINNT\system32\sysar32.dll

O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [ipmj.exe] C:\WINNT\ipmj.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=

O15 - Trusted IP range: 206.161.125.149

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.140/code/PWActiveXImgCtl.CAB

O17 - HKLM\System\CCS\Services\Tcpip\..\{1EE86091-D0A4-4964-87C7-BD2639F5501B}: NameServer = 62.104.191.241 62.104.196.134
O17 - HKLM\System\CS1\Services\Tcpip\..\{1EE86091-D0A4-4964-87C7-BD2639F5501B}: NameServer = 62.104.191.241 62.104.196.134
...(Verify that these ip addresses are for your isp's DNS Servers, if so, don't 'fix' these.)

O23 - Service: Workstation NetLogon Service ( 11F??#????`I) - Unknown owner - C:\WINNT\ntob32.exe

Now, with all windows closed except HiJackThis, click "Fix checked".

===============

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

folders...

C:\Programme

files...

C:\WINNT\ntob32.exe
C:\WINNT\ipmj.exe
C:\WINNT\system32\drkzn.dll
C:\WINNT\system32\sysar32.dll

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them from "Safe Mode".

===============

Post back a new log, and let us know how everything goes.

13 more replies

My startup page is www.yahoo.com.sg
But everytime its changed to

http://searchweb2.com/passthrough/index.html?http://www.yahoo.com.sg/

Even if i change it, it will automatically changed back by itself. I have run ad-aware and spybot. And removed everything thats suspicious. But when i retart my pc, its back again.

Any help?

A:Startup page changed in IE6

2 more replies

http://67.132.177.100:8000/cgi-bin/mark.cgi

Has anyone seen this before? I'm running Windows 98 with Internet Explorer. MSN is my home page and hadn't changed in my tools folder. When I clicked 0n the home page button, I went to MSN. I can't tell anything is wrong, yet something changed my opening page.

You need to go here http://www.majorgeeks.com/download3155.html and download hijackthis to its own folder away from the desktop,like for instance in my documents,then post back the log that it produces for analysis ......

1 more replies

My browser, AT&T Yahoo, has been opening and logging in on computer startup. When the browser home page opens I get this message.
I.E explorer script error

line: 5
char: 5348
error: undetermined string constant
code: 0
url: http://att.my.yahoo.com

The browsing is sometimes slow and sometimes times out when directing to a page. I have run the Norton AT&t supply and periodically clean with atf. Here is my HJT log.

Logfile of HijackThis v1.99.1
Scan saved at 9:02:08 PM, on 12/26/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\System32\MsPMSPSv.exe

More replies

My start page changed some how from google to Ask.com. How do I restore the google start page? This happens about once a month or so. Can you assist?

Have good read of these two post; as they deal with all - and likely how it happened too...http://www.computing.net/answers/se...http://www.computing.net/answers/se...cwshredder used to be first port of call as it were to resolve it; and it may still work...?Regardless - suggest you run the cleaner utils as posted in the above; and likely you will find you have more than other pests of which you are completely unaware...And then afterwards - pay heed in future to what you download/install; the "helpful offer to install it automatically for you - which from now on you will decline (and instead do a customised install)?

2 more replies

Hi,
Thank you in advance to anyone who is willing and able to guide me through a possible virus. As the title states, my computer has begun acting strangely and I fear it is infected.
Normally, my start up page is Google, when I use my Chrome browser, however, after searching and downloading a movie, things began to get weird. My computer is acting generally slow, and suddenly my start up browser has changed to Yahoo. I fear these are signs of a virus and I would like to take care of this situation before things get worse.
I am fairly inexperienced with virus removal, and I am not sure how to best approach such a vague situation. I ran a Trend Micro Titanium    internet Security, but no threats appeared. I would like to go for a general thorough examination of my computer.
I am using a Windows 8 Operating system.
Thank you again.

A:Start Up Page Changed. Computer Is Slower. What Did I Do??

1 more replies

I have accidentally changed the Icon for the Picture Viewer on the Start Metro Screen.

I opened a Scan image and by default it used the Picture Program that was bundled on the Start Screen.

Somehow I made the Scan the default new icon, which looks awful. How can I get the Icon back to its original?

Thanks,

Rory

A:Accidentally changed Start Page Icon for Picture Viewer

Hello Rory, and welcome to Eight Forums.

If you mean your user account picture, then the tutorial below can help show you how to change it back to what you want.

User Account Picture - Change in Windows 8

The default user account picture images are in the hidden system folder below.
C:\ProgramData\Microsoft\Default Account Pictures
Hope this helps,
Shawn

1 more replies

Thank you for looking and offering any suggestions to cleanse my system.
This is my symptoms:
Sometimes is not possible for me to shut down the computer.
My wallpaper on my XP Home Edition (version 5.1) w/SP2 has changed to a reddish background with three reddish wishbone imags. It also says YOUR PRIVACY IS IN DANGER! DOWNLOAD PRIVACY PROTECTION SOFTWARE NOW!
http://www.ucleaner.com/main.php?wmid=6010&mid=MjI6Mjo4OQ==&lndid=2
More over I found dangerous: XVORFWBD.DLL in C:\WINDOWS
I tried to manually delete the same, but could not do the same.
On startup I receive a dialog box stating the following:
Windows has detected an Internet attack attempt....
Somebody's trying to infect your PC with spyware or harmful viruses. Run full system scan now to protect your PC from Internet attacks, hijacking attempts, and spyware! Click here to download spyware removal for total protection.
When I am not connected to the Internet a box appears asking me if I want to work offline or try again.
After he scanning, it created log file. I am pasting the entire log file here:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:21: VIRUS ALERT!, on 24/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:

The latest addition to the problems is: The 'All Programs' has disappeared from the 'Start Menu'.

1 more replies

I've been using Opera as a #2 browser for awhile, have it set to start up with a few different web forums that I regularly visit.

Recently I upgraded to Opera 11. Until now, at startup Opera would go check and load the current versions of my Start pages. Since switching to Opera 11, now at startup I get the cached version, which is a pretty lousy way to begin a session, looking at the same page you finished reading when you logged off last time and not seeing what's new. And then needing to go refresh each tab just to get the up to date content.

I've hunted all through preferences and can not find anything to change this setting.

Does anyone know where that one can be changed? I've looked at Opera's "Help" but it doesn't list this one under anything I would think are obvious keywords to identify it.

Oh and finally, their own Community Support forum is not online today -- can not connect to it at all.

thanks for any help!

Hi,

There are several ways in Opera for multiple websites to load at startup, can I ask how exactly you have set this up? E.g. using Sessions, bookmarks, speed dial etc.

The only thing I can think of that would fit your problem is that Opera is "Continuing from Last time". If you check the startup preferences in settings, it might be set to do this. Otherwise if you wanted several homepages that would reload on startup, the best way to do this would be using the Sessions feature.

Load the tabs you want at startup in the browser, Click Menu>Tabs and Windows>Sessions and save it as a new Session. When I tested it this worked fine, the sites were reloaded rather than bringing up cached pages.

The Opera community site is working fine for me at the moment. Check again to see if you still get that problem.

1 more replies

Hi !
I'm actually using mozy. No problem with this cloud.
I just had like to change the day of the online backup because it's only every month and i'm wanted one, every week.
Did someone use it ?

More replies

A:My update setting was changed to automatic!

Dont worry you havn't been hacked.
SP1 reset the WU settings, just change it back to your choice, it should not happen again.

Roy

2 more replies

I am having serious issues with my gaming computer. It all started when i was due for a windows 7 update but my computer failed to do this update and from then on my computer would try to install the update everytime it started. It woild always fail and took my pc about 20 mins to fully launch and compared to the usuall 5 mins. I ignored this issue until about a month later when i had enough, i went to my control panel and stopped windows from automatically updating . This has given me serious issues and now i cannot complete simple tasks without the application stopping responding or freezing my computer completely. Also i can only shut my computer down by pressing the power buttom on the case as otherwise it goes through the normal process but then leaves me with a black screen and just my cursor. I cannot change my windows update back to automatically update as my control panel will just become iresponsive. I have have a copy of windows 10 preordered and i thought a clean wipe and a new update could fix my issues however i cannot go through the process without it becoming iresponsive. Please help asap , many thanks , Jack

A:Windows update , changed from automatic, serious problems

Hi Jack,
Windows 10 - Clean Install - Windows 10 Forums

From what you have said it sounds more like malware.
As you have a custom build
Just use your original Retail install disks to re-install W7.

Roy

2 more replies

Hello,

This issue already happened in Consumer Preview of Windows 8, but after installing the Release Preview I still see this.
I have a WeTab 32GB tablet to run Windows 8.

After installing Windows 8 CP I had to install Mobile Partner software in order to connect to 3G. After connecting once the connection showed up in the "Networks" part of the "Settings" charm. Is was shown as a broadband connection. Tapping it once enabled me to connect and check the box to connect automatically. If I choose the "Properties" I was able to set it as a metered connection. This all happened in the Metro UI.
If I went to the "Wireless" tab of the "PC Settings" the connection was showing up as "Mobile Broadband" device.

For some reason (I am not sure what changed) at some point I don't see the connection in the "Wireless" tab of the "PC settings" anymore. Next to that the icon in the "Networks" charm has changed (it shows a phone). Tapping it once only enables me to connect. Tap and hold to view the connection properties sends me to the classic Windows desktop where a classic properties screen is being displayed.

I am not able to select to connect automatically.

I was hoping this would have changed after installing the Release Preview. But after doing so and installing the Mobile Partner software it automatically included my settings. So I still have this issue. How can I change this back?

More replies

Hi all
I have discovered if I change my homepage in IE, no matter how i changed my settings in firefox, the startup page will be the same as IE. Only if i set IE about:blank, then firefox can start up as about:home. I have tried resetting firefox, it is no use. Since i have reset FF, there are no addons. I even reinstall firefox, still useless. Is there a solution to this problem? Anyone got the same problem as me?

More replies

Does anyone know if it is possible to set a window in IE to automatically refresh after x seconds or x minutes? Say I want to keep the Vista Forums main menu page open but want it to refresh automatically every 30 seconds so I don't have to keep pushing the refresh button to do so and thus be able to notice new posts faster (as I don't refresh manually anywhere near that often).

Thanks in advance for any assistance you can provide. I'm using IE9 Beta, but suspect the procedure, if it exists, will exist and be the same or similar in IE7 or IE8.

A:Automatic page refresh in IE

How can I turn ON auto refresh in Internet Explorer 7 | Computer Tips And Tricks, Gadgets, How-To, Life - 2.0 Style

11 more replies

So the problem is that internet pages are being opened automatically with this sites<http://cc-student-loans.blogspot.com/><http://ci-resources.blogspot.com/><http://ccard.blogspot.com/><http://smart-antivirus.blogspot.com><http://www.google-analytics.com><http://scripts.addpub.com><http://phone-mobile.blogspot.com>www.c.la/<http://pourinfo.c.la><http://smartgame.uni.cc><http://smart4.my10gb.com><http://realmoviezone.com><www.pharmacyonlineshop.com><http://hosting-domains.blogspot.com><http://hugevideozone.com><http://www.hugevideozone.com>Logfile of Trend Micro HijackThis v2.0.2Scan saved at 23:25:40, on 26-03-2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Programas\Avira\AntiVir PersonalEdition Classic\avguard.exeC:\Programas\Avira\AntiVir PersonalEdition Classic\sched.exeC:\Programas\eBoostr\EBstrSvc.exeC:\Programas\CDBurnerXP\... Read more

A:Automatic Web Page Opener

Hello tonecas,

Welcome to Bleeping Computer

Sorry about the delay. If you still need help, please post a new HijackThis log to make sure nothing has changed, and I'll be happy to look at it for you.

Thanks,
tea

2 more replies

I can go onto a web page With MS Explorer Ver 6.02900 w/sp 2 and if there is an automatic forwarding it doesn't work on my computer. What setting do I have that I should change?
Thanks

A:Automatic forwarding within web page

Noooooooobody knows the trouble I've seen, Nooooooobody knows the sorrow, HUM, Hum, HUM .........
OK OK corny but it got your attention didn't it? Huh? Huh?

1 more replies

I have loaded Spybot, CW Shredder and Hijack This! and have also used the coolsearch killer V1/2 but cannot stop my homepage from changing to www.solanges.com or something similair. Everytime I run Spybot I also get the following being identified :-
CoolWWWSearch: IE start page (Registry change, nothing done)

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-21-3403473811-972506294-598665437-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

Below is a log report from Hijack This! :-
Logfile of HijackThis v1.97.7
Scan saved at 15:54:22, on 21/06/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.0... Read more

More replies

I'm not sure what to make of this, however, I'm a paranoid person so what the heck!

This is something I've ignored because it doesn't really seem to have changed the operation of my computer.

What happens:

First Issue: When I start my computer I will see the windows start screen (where the progress bar shows its status), but sometimes when it does the transition to the login page I get a blank screen (like the video card is not detected) and have to shut down and try again. After which, it starts fine the second time around. However, I kind of think this is a hardware conflict with Windows...don't know really.

Second Issue: Normally after a fresh install of Windows the login screen will show the cursor already in the input box. However, after some time the normal login changes and I have to click on the login area to get the input box to show. My paranoid thoughts are that some kind of rootkit has gotten a hold of my system...again not sure just don't have a lot of time to chase down phantoms...
Thanks for any help and sorry if this is vague.
Steve

Neither of these issues sound malware/virus related, at all.

The first could be explained by quite a few things, and we can pursue it further if you like.

The second sounds like a setting that was changed back to default after a fresh install of Windows. You should be able to find the solution in Control Panel > User Accounts. Either that or an update with a Service Pack. Is the PC fully updated?

1 more replies

My home page gets changed at the start-up to res://mshp.dll/index.html#37049. I have changed done a few things including running spybot, but at the restart or if you push "default" it resets to that web page.HELP.

Hi and welcome to TSG,

http://www.spywareinfo.com/~merijn/files/CWShredder.exe

Close all browser windows, open cwshredder.exe then click "Fix" and let it run.

Then restart your computer and post another log.

IMPORTANT! To help prevent this from happening again, you should install all the security patches and critical updates.

Then download Hijack This and post a scan log for the experts to look at.

Close all open windows and open HIJACK THIS. Click “Scan”. When the scan is finished (it only takes a second), the scan button will change to “Save Log”. Click on “Save Log” and save it to NotePad. Copy the entire log and paste it here.

DO NOT FIX ANYTHING YET most items that appear in the log are harmless or even needed. Wait for someone to analyze the scan and advise.

1 more replies

Hi there.
When I enter an incorrect address, instead of it querying the default search page (in either IE or firefox), it looks up http://64.28.178.4/index.php and redirects me to a random website, varying from adult entertainment to adult learning.
I have tried using Spybot, Spyware Doctor, Ad-Aware, and looking through hijackthis myself, but cannot find anything unusual.
I'll post a HJT log. Hope someone can help.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 19:53:03, on 24/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\ehome\RMSvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

A:Search page changed (I think :P)

http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

Note: You must have an active Internet connection when running this fix, in order to download the Brute Force Uninstaller (BFU).

Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish.
Once the desktop loads please post the text that will open (report.txt) and a new Hijackthis log.
=====================================
Fix these with HiJackThis – mark them, close IE, click fix checked

O17 - HKLM\System\CCS\Services\Tcpip\..\{EEE2FE52-4BA1-4103-9307-FD5173011990}: NameServer = 85.255.116.101,85.255.112.184

2 more replies

I am using windows 98, and everytime I log onto the internet it tries to change my home page and my search engine when I use google. I have installed Spy Sweeper, which protects my home page, and lets me know when they are trying to change my search engine. But I get a search page 'Searching the Search pages' that keeps popping up. Can this be fixed. I have run hijackthis and got the following log:Logfile of HijackThis v1.97.7
Scan saved at 6:38:22 PM, on 9/15/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2919.6304)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\ATLQE.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\xqntp.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\... Read more

8 more replies

i was working on a project when a video would not down load so i down loaded uniblue registry booster said i had something like 550 errors and corrected them some time after that my adobe
wouldnt open. did our taxes it wouldnt let us print them out and its not because of our computer and printer configurations

More replies

Everytime I open up my browser, it goes to the following site:

res://eihjb.dll/index.html#44272

I can go to internet properties and switch the home page but it does no good. I am constantly removing 10-30 adware items from the Ad-ware scan and have picked up a few viruses with symantec. How do I get rid of this mess? Thanks for any help.

13 more replies

Dell Intel Core 2 Duo Processor E7500 Computer
Inspirion 545s 00
6GB Memory
Antivirus: Avast; Spyware Prevention: Spybot, Spyware Blaster. MalwareBytes, CCleaner, and Super AntiSpyware

I'm not sure if this is a Windows situation or something with a program I use called Paint Shop Pro (PSP), but the page has changed that I view when saving a file within PSP. My apologies for posting if it's not windows related, but thought I'd try here first.

When I save a file, the page save dialog box comes up for me to tell it where to save it. It used to be that the page underneath that box would show the files and folders in the right pane, and in the left pane would be the Explore tree showing what's on computer. Now, when I save something in PSP, I only see the files and folders and not the tree.

If I save a Works document, I do see what I'm used to seeing, so that's what made me think it may just be a malfunction of my PSP program.

I have tried to resize the window as it comes up full screen and it will not let me grab any side to resize. The 2 small black arrows show up only on the left-hand side and won't appear on any other side of the page. However, even with that, it just won't budge.

It just started appearing in this format in the past week -- until then, I saw the Explore Tree as well. It's no biggie and I can live with it, but just wondered why it changed and if there was a way to get it back to what I was used to seeing.

A:Save page has changed

In the Save as dialog, click on Organize, Layout then check Navigation Pane.

9 more replies

Try changing the home page settings on your browser, close the browser down and then open it back up again and see what happens.

6 more replies

I realise that I was infacted by hijack. I run the program HiJackThis and got this log file. what to do next?
Thanks.
Uri.
logfile:
--------
Logfile of HijackThis v1.97.7
Scan saved at 01:00:54, on 08/05/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
D:\NORTON~1\navapw32.exe
C:\WINDOWS\essspk.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\my programs\babylon\Babylon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Interwise\Student\pull.exe
D:\My Programs\Fax\v3CallCenter\V3faxecp.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\rundll32.exe
D:\office\Office10\WINWORD.EXE
C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\HPZipm12.exe
D:\My Programs\WinRAR\WinRAR.exe

Go to www.merijn.org/files/CWShredder.exe and run. Click on CWShredder.exe Click on FIX not SCAN ONLY>

Install the program and launch it.

First in the main window look in the bottom right-hand corner and click on Check for updates now and download the latest reference files.

Make sure the following settings are made and on -------ON=GREEN

From main window: Click Start then Activate in-depth scan (recommended)

Click Use custom scanning options then click Customize and have these options selected: Under Drives and Folders put a check by Scan within archives and below that under Memory and Registry put a check by all the options there.

Now click on the Tweak button in that same window. Under Scanning engine select Unload recognized processes during scanning and under Cleaning Engine select Let windows remove files in use at next reboot

Click proceed to save your settings.

Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it. (Right click the window and choose select all from the drop down menu and click Next)

http://tomcoyote.com/SPYBOT/index1.php

1 more replies

I have a new installation of Windows XP.
The homepage constantly resets to MSN.
I am reluctant to alter the registry without clear, explicit instructions.
I have tried to reset and before I can close IE it has reset to MSN homepage.

3 more replies

When reboot XP Spywareguard gives Warning: IE homep age has been changed, do you wish to restore old homepage.

I just ran adaware and spyware doctor in safe mode.

Just ran hijack this

Any takers?

Logfile of HijackThis v1.98.2
Scan saved at 8:48:50 PM, on 11/14/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Frank Rabzel\My Documents\My Received Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/

More replies

I have changed versions of IE browser attempting to get rid of the following page. It comes up automatically each time I open IE. I'd prefer to have IE open to a blank home page, which used to work, but for some reason this search page keeps reappearing, no matter what I do.

I've run a full system scan, thinking this might be some type of malware but my system is clean. I don't know how I picked this up but I'd like to rid myself of it. Does anyone recognize this and if so, how do you remove it? I've added a couple of spaces in the URL to keep it from showing as link.

http:// www. default-search.net/?sid=503&aid=100&itype=n&ver=13986&tm=516&src=hmp

MEL

A:IE Browser ver 10 - Getting rid of an automatic search page

Hi and welcome to SevenForums,
What did you use for these scans ?

Quote:

Aztec Media develops software used by millions of Internet users worldwide. We believe the wonderful things on the Internet should be accessible to all users, regardless of their technical expertise level.

We develop downloadable PC applications, social services based on platforms such as Facebook, and mobile applications with the goal of providing users with fun, easy to use applications that help them get the best out of their online experience.

If you would like to contact us, send us email at [email protected] or send an old-fashioned snail mail to Aztec Media Inc., Attention: Privacy Policy Administrator, Post Office Box 51968, Limassol, Cyprus.

Review Jacee’s instructions to run Adwcleaner here post #7,
Ignore the title of the thread,
Instant Savings App
You can use these free tools to see if they find anything,
Manually Update them before running full scans,
Try not to use your computer while the scans are running, (one at a time of course).
Malwarebytes Anti-Malware Free
Also use the Custom scan option not the Threat scan,

Please Do Not clean/ Delete or Remove Any detections before posting the scan results first before review especially Malwarebytes,
http://www.malwarebytes.org/products/malwarebytes_free
SAS is safe to r... Read more

9 more replies

I'm looking for an automated system to log onto a web page daily, capture the page and email a screen capture (or PDF?) to me. I'm really looking for something web-based - that function outside of my computer.

Any ideas?

Thanks!

A:Automatic Web Page Capture - does it exist

There is no way to do what you are describing legally.
You can take screen shots of a website your self manually.
But, there is no program that can log on a website automactically.
Those type of programs are called 'robots' they are illlegal, and most wesbites block them for security issues.

But, Good Luck with what you are trying to do.

3 more replies

MS word will, for some unkown reason, not automatically insert a page break. You can manually input a page break but word will not do it on its own. I have never seen this problem before. I am running MS office 2003 on a Dell XPS 4100 with Vista.

I have already uninstalled office and reinstalled it to no effect.

I am open and happy for any suggestions

A:automatic page break not working

10 more replies

Hi,
Im using windows 10.

Is there any way to make this thing automatic? Like via url username password or anything within the internet options?
Im attaching a screenshot to clarify how is it.

More replies

Dear all, today I plugged off my laptop by mistake during re-start. Since then it doesnt boot anymore, and I dont have access to any of F- keys. When I press the start botton, it seems to run regularly, but the HP logo does not show up, just a black screen. If I leave it, after a while it restarts by itself, with the same result. I tried to reset, but with no results. I have two drives, one with Winodws 8 and anotherone with Ubuntu. I tried to disconnet them in sequence but nothing changes, even when both are disconnected. Thanks!

More replies

Suddenly I can't hold my desired home page in default. Instead it goes immediately to "blank" or www.protectionways.com and the screen warns me of the vulnerability of my Windows XP system, citing malware, etc. In particular it mentions mozilla/4.0 and W32.Myzor.FKyf. I have no clue what all that means, but I have not downloaded anything from that site which wants me to download some anti-viral software, cleaners, etc. It's a site that gets bad reviews from McAfee, and I can find no documentation on it that it's in anyway connected w/ Microsoft or McAfee or any other reputable outfit I recognize.
I'm assuming I am infected, but don't know what it is or how to recover from it. I'm a novice, folks, so if you can help me, I'd be grateful.
-pamikemy-

See the following Bleeping Computer removal guide:How to remove the Smitfraud / Generic Zlob / Quicknavigate / Virtual Maid

4 more replies

It said every thing I was doing was being read from another location and that I should down load their security thing to stop it. I think it was http://www.newgrounds.com
And something about Saturn of Stamford. This computer was used at a Saturn dealership up to a month ago. The Saturn store closed and I did get the computer from there.

Can you take a look at this and suggest anything, thank you.

HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 9:20:29 AM, on 9/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\COSIDS\BIN\TbMux32.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

All right, Internet options, privacy, advanced. The “Prompt” was checked off on “Third-Party Cookies” I changed it to Block. I was getting a lot of prompts to allow cookies. I just assumed it was for the page I was on. The last one was from some site I never herd of before and I hit block.

2 more replies

Hello,

It appears that I am being hijacked similarly to other posts I have read in this forum and would like help analyzing my "Hijackthis.log". I am running Windows 2000 with SP4. I am using Internet Explorer v5.51 SP2 (5.51.4807.2300)

My homepage is being changed to "res://wridl.dll/index.html#37049" and my searchURL is changed to something similar. I am also getting a lot of popups. I have searched the windows registry for "wridl" and removed these entries but as soon as I open IE my homepage is changed again. I have run SpyBot and it is not finding anything significant (just a couple cookies) I previously had the CoolWebSearch hijacker about a week prior to this variant and CWShredder took care of it.

I am posting my Hijackthis.log below in hopes that someone can help me this problem. Thank you for your help.

--------------------------------------------------------------------
Logfile of HijackThis v1.97.7
Scan saved at 3:54:36 PM, on 6/19/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe

You need to go into your registry and into the hkcu\software\microsoft\internet explorer\main,serarch page and change the entry into which ever search page you wanna use....
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
is the default search string
and on the start page you should just change to what you want your start page to be, like either http://www.msn.com or whichever you decided
then look down a couple folders into the search url and change that setting to
http://home.microsoft.com/access/autosearch.asp?p=%s

in HKLM\software\microsoft\internet explorer\main, default_page_URL should be
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
which is the default string
and the default_search_URL should be
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
a couple settings down on the list you should see the search page again and it should be
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
and the start page is whatever you want it to be again
just basically go thru it all and find software\microsoft\internet explorer and look for all the start and search settings and change them to the default settings, then look in your add/remove programs and see if you have anything installed that you don't know about and take it off
this too is the default string

2 more replies

What should I do?

First tell us what your OPerating system is,the antivirus and spyware tools installed.

BTW welcome to the forum..

3 more replies

My home firefox page got hijacked to www.ask-yoda.com. and I cant get it back to www.google.com . theres also an add on on the browser of a yellow house that takes u to www.ask-yoda.com. I got rid of what did this but cant get my home page back normal . right now I have norton blocking www.ask-yoda.com. so when it pops up the homepage to www.ask-yoda.com it just comes up as page not found . so what should I do

thanx

Wanna send a special thanks out to all of the helpers who have read my post over and over but refuse to offer any help . thanks bunches

gonefishin

1 more replies

Hi All:
I've seen other posts with similar problems but here's mine. After my computer has been on for an hour or so Browser Hijack Blaster (BHB) informs me that my home page on Internet Explorer 6 SP1 (IE) has had an attempt to change it to blank. I tell BHB not to allow it and then IE won't start again when I click on it's desktop icon. When I turn off the computer and restart everything is O.K. with my old homepage and then the process starts again. I did have a cool search problem but CWShredder seemed to take care of it. AVG says no viruses, Ad-aware and Spybot find nothing as well. Here's my Hijack This log. Any help would be appreciated. Thanks.

Logfile of HijackThis v1.97.7
Scan saved at 10:21:50 PM, on 7/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\palm\HOTSYNC.EXE
C:\Program Files\Common Files\Skyscape\smARTupdate.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe

More replies

Help, pleaseMy home page has been changed to "http://asafetyprocedure.com/" and I also have a Security Toolbar 7.1 on my IE that I cannot get rid off. My hijackthis log is below:ogfile of HijackThis v1.99.1Scan saved at 15:51:11, on 14/10/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16544)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Ahead\InCD\InCDsrv.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exeC:\Program Files\Common Files\Symantec Shared\DJSNETCN.exeC:\Program Files\Common Files\EPSON\EBAPI\SAgent... Read more

Please download SmitfraudFixExtract the content (a folder named SmitfraudFix) to your Desktop.Open the SmitfraudFix folder and double-click smitfraudfix.cmdSelect option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).Please copy/paste the content of that report into your next reply.Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.http://www.beyondlogic.org/consulting/proc...processutil.htm

7 more replies

Can going to a website change your desktop wallpaper ? I have a photo on the main screen that is on my hardrive . One day the main wall paper changed and I put it back and it is ok .
Weird I scanned with freeAVG spywear ,adware ,., spybot I have Norton 2008 IS it was free Aslo protected with free spywearblaster .
No sign of infection. Should I be concerned and can you tell in hijack if there is a problem ?

I am not as computer literate as a lot on this forum and would appreciate what the experts think.
Thanks

Logfile of HijackThis v1.99.1
Scan saved at 12:58:52 PM, on 3/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe

More replies

Method - open IE > Tools > Internet Options > General Tab > Choose 'Blank Page' > click Apply and OK.

I reboot and the IE Home Page has changed to the desired Blank Page.

But when I reboot again, the IE Home Page is back to where it was before.

How can I make the change permanent?

Best wishes. whatapalaver

Method - open IE > Tools > Internet Options > General Tab > Choose 'Blank Page' > click Apply and OK.I reboot and the IE Home Page has changed to the desired Blank Page.Have you actually typed in an address that you want IE to use as your Home page?eg...... http://www.hotmail.comBut when I reboot again, the IE Home Page is back to where it was beforeExactly what is this page..... what's IE taking you to?

10 more replies

I got a brand new laptop yesterday, spent the entire night transfering all files, installing all apps/updates and unninstalling bloatware (unninstalled McAfee that came with the laptop and installed Bitdefender).

In the middle of all this, I went to open Chrome and suddently I noticed my Google page looked something like this (not a PrtScreen):

And whenever I search something, the results look nothing like they normally look.

Obviously Google doesn't look like this, so obviously I must've got some infection somehow. So I installed Bitdefender and MalwareBytes, and combined they found like 4 or 5 issues that were easily fixed (can't remember the names exactly, but I know one of the infections was a "INetCookie" or something like that in my AppData folder). After that it still shows google like that...

It can't be the USB drives I used to transfer files and apps, because I used Bitdefender on another computer to scan for viruses and found nothing. I also tried clearing cache, history and cookies...nothing. Formatting OS is not an option, this happened while I was preparing everything to make the backup like I wanted it to be...which was probably my biggest mistake, now that I think about it

Random thoughts:

Did you set Chrome with a desired homepage after installation ? Was Chrome part of the file transfer or a new download of Chrome ?

Or uninstall Chrome and run a scan. Should be able to save your Chrome data. Then reinstall.

2 more replies

Hello I'm trying to find out how to remove this spyware.

IE 9 seems to be stuck on About:Blank for my home page and I can't change it.

I'm thinking I've been infected which seems odd because I an A/V and Malwarebytes pro.

Some how it got in...

Should I just wipe out my hard drive. I wish I could just remove it but this gmer scanner will not work correctly.

I ran a combofix log though.

It shows the spyware I think.

Quote:

.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Wayne\AppData\Local\Temp\{53BB7233-569B-49AB-8AA2-CBFAF8AF0200}\fpb.tmp
c:\users\Wayne\AppData\Roaming\vso_ts_preview.xml
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_NPF
.
.
((((((((((((((((((((((((( Files Created from 2012-04-03 to 2012-05-03 )))))))))))))))))))))))))))))))
.
.
2012-05-03 23:07 . 2012-05-03 23:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-03 21:23 . 2012-05-03 21:38 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-05-03 21:23 . 2012-05-03 21:26 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2012-05-03 21:16 . 2012-05-03 21:16 -------- d-----w- c:\program files (x86)\VS Revo Group
2012-05-03 07:10 . 2012-05-03 07:10 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-05-03 07:10 . 2012-05-03 07:10 476960 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2012-05-03 07:10 . 2012-05-03 07:10 -------- d-----w- c:\program files (x86)\Java

1 more replies

When I try to pull up my start page this is what I get...

res://C:\WINNT\System32\shdoclc.dll/navcancl.htm

I've run Adaware, Spybot S&D, and CWShredder but it's still there. Can anybody tell me where to go from here.
I have included my Hijack Log file...

Logfile of HijackThis v1.99.0
Scan saved at 5:07:19 PM, on 12/23/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\System32\ScsiAccess.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\ups.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\WINNT\System32\PROMon.exe
C:\WINNT\System32\CTHELPER.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\AccessRamp\ARMon32.exe
C:\Program Files\PhoneTools\CapFax.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe

Hi and Welcome to TSF

Before attacking an adware/spyware problem with hijackthis make sure you have already run ad-aware SE with VX2 add-on cleaner, Spybot Search & Destroy (with updated database) and CWShredder as these programs will clean a lot of the crap out first. All links to programs are in my signature. Ok..on to the log?..

Go to My Computer->Tools->Folder Options->View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System Files and Folders are showing/visible also. Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore.

Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Check and fix the following in HijackThis if they still exist (make sure you do not miss an entry)

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=n-bon
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=n-bon
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://s-redirect.com/?a=2&b=n-bon
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://s-... Read more

1 more replies

Run the following and post the logs:

Double click on the icon to run it, Vista or Windows 7 users right click and select Run as Administartor. Make sure all other windows are closed and to let it run uninterrupted.
In the lower right corner, checkmark "LOP Check" and checkmark "Purity Check".
Under the Custom Scan box paste this in

Code:

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
eventvwr.exe
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your reply

Kevin

1 more replies

Somehow I've been what I guess is hijacked. I'm not sure how but my start page is constantly changed to http://start-search.com/ from my normal google, the same half a dozen porn sites reappear as favorites even though I repeatedly delete them, and all of a sudden, an open page while online will redirect itself to some site beginning in to.teen.com/

I'm a bit bewildered and not the most computer literate person, but I've followed some advice found online to other users with similar problems but with no luck (downloading and running Hijack This, Spybot Search & Destroy, Ad-aware 6.0).

What follows is my Hijack This scan. Hopefully some generous soul will take pity on me and help me get rid of this junk.

Roque
Logfile of HijackThis v1.97.7
Scan saved at 12:58:40 PM, on 19/12/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe

Roque again...

When I printed my Hijack This scan it included an item that didn't come up when I cut and pasted details in the previous post. The item is as follows:

017 - HKLM\System\CCS\Services\Tcpip\..\{E970FF2C-69DA-4B06-94A4-96A0AB4418AB}: NameServer = 203.134.6466 203.134.65.66

Regards...

2 more replies

Is there a way to disable the Windows XP "feature" that sometimes grabs my IE browser when I first start it -- this is the reroute from my normal home page that happens whenever Microsoft wants to send me to the windows update website instead.

Thanks

A:Windows Update Automatic Web Page Reroutes

Welcome to BCIs it the official Windows Update page?http://www.update.microsoft.com/Or something else? You've probably have been HijackedMark

3 more replies

Logfile of HijackThis v1.99.1
Scan saved at 8:22:23 PM, on 5/26/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atmclk.exe
C:\WINDOWS\system32\dcomcfg.exe
C:\WINDOWS\System32\fast.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hphmon05.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\PROGRA~1\Webshots\webshots.scr

9 more replies

Sorry for the long title, and this has probably happened numerous times to others.

I clicked on a link when searching for an item in a search list for my son, the web page instantly changed to a security screen stating that the computer was being infected and there were malware and trojens infecting several areas, C drive, my documents etc. a pop up appeared indicating that to clear them click on the protect button which then showed a dialogue button for run or save, I selected save (although for the life of me I could not remember where it saved it to). Then I noticed that it was part of the browser I was in as one of the tags, it suddenly clicked that the McAfee had not come up with any warnings and imediately I started the lock down firewall associated with McAfee and did a full scan, nothing was in the results, I also checked the search facility looking for entries that were on the 22nd august 2009, and other than an entry for autocad with a picture of a family in a jpeg and an entry for 2019 nothing that would spring to mind, all were deleted.

The search was for a cake called an ICED FINGER (long current bread like cake with a sugar icing top)

Is this a common way of infecting someone or new, what should I look for, the HJT log showed very little that would be classed as a problem etc and the McAfee has not come up with any warnings yet, your comments would be appreciated.

Phil

A:web page changed to security infection screen

16 more replies

I have changed the description and meta tags in the html of my index webpage.

How long do I need to wait for the description to change on the various search engines results pages.

Thanks

More replies

Greetings to all,
I removed the dreaded google redirect using Comfix and re-installing Firefox. A side-effect is that the Default Code page for the display of fonts in DOS windows has changed, and I can't find where to change it back. Full screen DOS is OK. It is only a problem when displayed in a window. (they use different methods)I have tried editing HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CodePage in the value OEMCP and neither the values 850 (windows default) or 437 (old IBM fonts)makes any difference. (system restart after edit) I have also tried using CHCP in AUTOEXEC.NT. I am missing something and I just can't see what it is.

Thanks
MrTester.

Comfix log:

ComboFix 12-02-10.03 - Fred 12/02/2012 9:45.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1542 [GMT 10:00]
Running from: c:\tempzip\stuff.exe
Command switches used :: /killall
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\1.bat
c:\documents and settings\All Users\Application Data\TEMP
C:\install.exe
c:\windows\system\oeminfo.ini
c:\windows\system32\config\software.bak1
c:\windows\system32\GroupPolicy\Machine\Registry.pol
c:\windows\system32\setup.ini
c:\windows\system32\spool\prtprocs\w32x86\ActPrint.dll
.
.

A:Code page default changed by Comfix

2 more replies

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-02-2015 01
Ran by LizzieS (administrator) on LIZZIES-PC on 27-02-2015 23:02:12
Loaded Profiles: LizzieS (Available profiles: LizzieS)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSv... Read more

Hello, Welcome to BleepingComputer.I'm nasdaq and will be helping you.If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.===Using the Add/Remove programs applet delete this process in bold.SupplementPro (HKLM-x32\...\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{23afdfe}) (Version: - Software Publisher) <==== ATTENTION===Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
start

CreateRestorePoint:
CloseProcesses:

(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe
() C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [3033112 2015-02-27] ()
HKU\S-1-5-21-3205690185-1226381487-526044824-1000\...\Run: [Itibiti.exe] => C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3205690185-1226381487-526044824-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={BA7F367E-FF34-4DD2-A696-78D52072E23E}&mid=7e554bd70f4947d1b8a8cd3c4e3b7cac-c0abbc4fe6dc8ff5c2e9f541d3176252c2e5713e&lang=en&ds=AVG&coid=avgtbavg&cmpid=0215av&... Read more

10 more replies

A friend of mine has a windows 8 laptop and his isp has changed his home page and shortcuts etc. I do not have physical access to the computer but he says he has tried the usual way to change home page in IE

Would hijack this show the problem. I ran hijack this on my computer to see what is shows and it shows my home page in the registry. Could his page be changed back in the registry

Hello DOPEY13 and welcome to Bleeping Computer.
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:
Please DO NOT run any scans other than those requested.

===================================================

Is there some reason why your friend can't start their own topic? I'll supply some instructions assuming that that is the case.

12 more replies

Our CEO is having a problem where his home page keeps changing to some sort of directory page: res://mshp.dll/index.html. Weird. Also, he keeps getting a popup blocker ad. I suspect he's been hijacked (he had the ehttp problem a couple of months ago). Can anyone suggest a fix? I've attached the log below...thanks!

Roy

Logfile of HijackThis v1.97.7
Scan saved at 2:26:56 PM, on 1/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\[email protected]\[email protected]
C:\Program Files\Intuit\QuickBooks Premier\Components\QBAgent\qbdagent2002.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Treo Mail\vma.exe
C:\Program Files\Handspring\HOTSYNC.EXE
C:\WINDOWS\System32\wuauclt.exe
X:\Utilities\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.lookfor.cc/sp.php?p=10213
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start ... Read more

9 more replies

When I hit home it goes to this: http://www.claro-search.com/?affID=114506&tt=4112_8&babsrc=HP_clro&mntrId=c43bea1b000000000000001372384e07

Steps I've taken. I updated SAS and ran a quick scan and found nothing. I updates MBAM and ran a full scan and found 70 plus problems.

I deleted the stuff labeled CLaro in the program removal section of Control Panel. But there must be more. Here are the logs from MBAM.

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.06.16.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512

6/15/2012 9:06:31 PM
mbam-log-2012-06-15 (21-06-31).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 351006
Time elapsed: 3 hour(s), 5 minute(s), 50 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 5
HKCR\CLSID\{22222222-2222-2222-2222-220022462239} (PUP.CrossFire.SA) -> Quarantined and deleted successfully.
HKCR\CLSID\{33333333-3333-3333-3333-330033463339} (PUP.CrossFire.SA) -> Quarantined and deleted successfully.
HKCR\Interface\{66666666-6666-6666-6666-660066466639} (PUP.CrossFire.SA) -> Quarantined and deleted successfully.

14 more replies

Home Page keeps returning to about:blank despite repeated changes to my desired weather related site. Also, several items are added to my favorite list, mostly porn related sites. I have repeatedly deleted these added sites but the return again and again. I have used the "Preparation Guide for use before Posting a Highjackthis Log" and tried using some other Spyware products without total success. Any additional help would be appreciated.Logfile of HijackThis v1.99.1Scan saved at 3:33:33 PM, on 1/14/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\STOPzilla!\SZServer.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\ewido anti-mal... Read more

Please follow the instructions provided, you may want to print out these instructions and use them as a reference.Please download ewido anti-malware it is a free version of the program.Install ewido security suiteWhen installing, under "Additional Options" uncheck..Install background guardInstall scan via context menuLaunch ewido, there should be an icon on your desktop, double-click it.The program will now open to the main screen.When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
You will need to update ewido to the latest definition files.On the left hand side of the main screen click update.Then click on Start Update.The update will start and a progress bar will show the updates being installed.
(the status bar at the bottom will display ("Update successful")If you are having problems with the updater, you can use this link to manually update ewido.ewido manual updatesOnce the updates are installed do the following:Reboot into Safe Mode, you can do this by restarting your computer, then contiunally tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. Run Ewido:Click on scannerClick on Complete System Scan and the scan will begin.You will be prompted to clean the first infection.Select "Perform action on all infections", then proceed.Once the scan has completed, there will be a button located on the bottom ... Read more

1 more replies

Hi all, Sorry, previous log seems to be not full. Here's my full log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 9:21:54 PM, on 10/2/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\acluie.exeC:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exeC:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exeC:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exeD:\Program\Common Framework\FrameworkService.exeD:\Program\NetworkAssociates\mcshield.exeD:\Program\NetworkAssociates\vstskmgr.exeC:\WINDOWS\system32\nvsvc32.exeD:\Program\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\WFXSVC.EXEC:\WINDOWS\Explorer.EXED:\Program\Winfax\Symantec\WinFax\WFXMOD32.EXEC:\Program Files\Java\jre1.5.0_11\bin\jusched.exeD:\Program\NetworkAssociates\SH... Read more

14 more replies

Hello my computer is infected or something every time I log into windows a get an error message and my home page was changed. I was told to fix this entries:R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about-blank.inO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O4 - HKLM\..\Run: [KOfcpfwSvcs.exe] C:\WINDOWS\system32\KOfcpfwSvcs.exeand erase this fileC:\WINDOWS\system32\KOfcpfwSvcs.exebut I was unable to find it, I tried to kill with fileassissin but it didnt find the file and everything stills the same Can you please help me???Here is my log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 09:59:50 a.m., on 27/12/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16574)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\AntiVir PersonalEdition Classic\avguard.exeC:\Program Files\... Read more

Welcome to the BleepingComputer HijackThis Logs and Analysis forum. My name is Richie and i'll be helping you to fix your problems.Apologies for the late response,as i'm sure you can appreciate we are absolutely snowed under with logs.If you still require help,please post a new Hijackthis log into your next reply.

9 more replies

Hello all,
A few days ago my interenet explorer starting coming up REALLY slow and would try to go to idgsearch.com instead of my normal Yahoo page. I have changed my homepage back to yahoo several times and it keeps getting changed back to that idgsearch page?????
When I see that idgsearch page coming up when I open IE, I immediately hit stop. When I do this I can't do anything with IE for about 45 seconds (as though it locks up). Then It's good to go after that, Until I try to bring up another one, (I am notorious for having several IE windows open at once).
Ok, I just ran the Hijack thing I see on here and this is what I cam up with,,,,Any advice?

Thanks!!

Logfile of HijackThis v1.97.3
Scan saved at 11:27:58 AM, on 11/6/2003
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe

16 more replies

A:Ahh Www.systemwarning.com! It Has Changed My Home Page And Possibly Done More!

HiDownload WindPFindExtract WinPFind.zip to your c:\ folder.Open c:\WinPFind and double-click on WinPFind.exe.When the program is open, click on the Start Scan button to start scanning your computer. Be patient as this scan may take a while.When it is done, it will show a log and tell you the scan is completed. Post the contents of c:\WinPFind\WinPFind.txt as a reply to this topic.Please post also a fresh HijackThis log.

7 more replies

I have run spybot, ad-aware, noadware and Norton about 30 times and have fixed everything that has shown up but I still get pop-ups from xlime optimizer. Also every time I load IE my home page gets changed no matter how many times I set it back to blank. Here is my Hijack This log file.

Thanks for the help

13 more replies

This question is about using "Page {PAGE} of {NUMPAGES}."

I've read many solutions for this online and in MS's help files. None of them are working, and it really has me perplexed because I consider myself an advanced user.

My document is a book:

The first page of my book is a cover page. It shouldn't be counted in page numbering.
Beginning on the second page, my book has a TOC and then 9 chapters.
The TOC and each chapter are set up in their own sections. (I do this because I include the chapter's name - which is the section name - in the footer along with page numbers. It also facilitates creating the TOC)
I want the TOC to be counted as Page 1
All of that works fine for the {PAGE} page number. To accomplish it, I told Word to start counting page numbers from 0, and I suppressed displaying the number on the Cover. Then for subsequent pages I selected "Continue from previous section."
My issue is that I really want to show both the current page and the total number of pages ("Page {PAGE} of {NUMPAGES}") in the footer.

When I try that, {PAGE} displays correctly, but {NUMPAGES} shows one too many. It is obviously counting the cover page.

Evidently what I did in #5 above only affects the count for {PAGE} and not for {NUMPAGES}.

All over the web I find the simple solution of using a formula field for {NUMPAGES} as follows:
=1+{NUMPAGES}

Actually, I think that would do the opposite of what I want. I would probably have to... Read more

A:Solved: Word 2007 Page Numbering: Make {NUMPAGES} start counting from Page 2?

I was just messing with the same issue and found a solution:

{={NUMPAGES}-1}

This may look exactly like something you tried already but here is the difference:

Instead of typing in the curly braces ( { ) manually, you have to hit "Ctrl-F9" to insert a field, then do the same for the braces around "NUMPAGES". You wind up with a field inside a field. That way it interprets the "NUMPAGES" as your document property, returns a number like "42", then the next field takes the equation "= 42 - 1" and returns "41". If you don't use "CTRL-F9" to enter the "NUMPAGES" field, it sees the first curly brace and stops, seeing it as a syntax error.

Hope it works for you! It worked for me!
-cheers

2 more replies

I'm running a Lenovo Y500 Ideapad with Windows 8. I've had it for just over a year now, with no problems really whatsoever. Until now. I was playing Fallout: New Vegas, and my computer crashed and I had to turn it off using the power button. Once that happened, it got stuck into a "Preparing to Repair" loop. However, somehow, it eventually got to the troubleshoot menu. I tried to refresh it, but it said it didn't have access to the drive. I'd (obviously) rather not restore my pc to factory settings (and I'm not even sure if it would let me). I tried the other options in troubleshoot, but the System Restore, System Image Recovery, and Automatic Repair didn't work.

I do have access to the Command Prompt and UEFI Firmware Settings. I've done some googling, but I don't exactly know what I should do with either of these at this point, and I'm kind of nervous about making the situation worse by just trying stuff that worked in similar situations that I don't fully understand.

Any help would be greatly appreciated. Thanks.

More replies

Suddenly, Yahoo and Yahoo mail are out of whack. Everything is in a list on the left side, no pictures, all in a plain font like this:
Web
Images
Video
Local
Shopping
More
Search:
Web Search

Open Search Assist

My Yahoo!

Hi,
lori
Profile
Contacts
Account Info
You are signed in as:
loriacb

What are you do&#8230;
Sign Out

Page Options

Close

When I go to yahoo/mail I get this message:

If you are using a screen reader and having problems using Mail, it might help to disable automatic page updates. Please note, this will also disable chat and text messaging within Yahoo! Mail. You can toggle automatic updates on and off using the link below

And the page looks somewhat like this:
Inbox

View:

All|
From Contacts|
From Connections|
Flagged
Messages 1-100 of 261 Go to First page | Go to Previous page | Go to Next page | Go to Last page

SubjectDate
Tech Support Guy Forums
Welcome to Tech Support Guy Forums!

Clicking the link does nothing. I can get to my email but the font is huge and everything is in a list.

It is only happening in Yahoo and does not matter what browser I use. My son can get into my email just fine on his laptop. I've spent all day on it and have made it worse if anything. Thanks for helping!

A:Solved: yahoo - automatic page update message

I finally figured out that BeSecure filter was blocking yimg.com which is yahoo images.

3 more replies

I recently changed computer and now use Windows 7 with IE. After I installed FaxTalk Communicator, it automatically starts up each time I open the computer (icon is on bottom right of screen).

Since I only want to use the fax to send letters from MS Word of WP documents, I'd rather it not be automatically started up (I click to print a document, then choose the fax instead). At the moment, to close it, I have to manually close it by right clicking on it and exiting the program.

I've looked into the FaxTalk - Configure options under programs, but nothing is checked off there that might indicate why it starts up (example, 1. under the general tab, "automatically answer all calls" is not checked, 2. under the announce tab, "flash control icon" and everything else there is not checked). Also, in my windows - all programs - startup - nothing is written as an automatic startup with windows.

How can I delete it from always popping up as an icon on the bottom right?

A:fax automatic startup

I recommend WinPatrol. I've been using the free version for years, but if you can afford it, upgrade to Plus! to support this wonderful tool. It not only allows you to monitor the programs that start with windows but has many other security features.

Slainte

midders

2 more replies

Hi All,

Is there a way in which I can boot up my PC and it automatically logs in to my account without me having to enter my password and/or click on my icon?

BTW - I am NOT (repeat - NOT) asking for a way to bypass the Windows log in process. I know my log in details but find this a pain in the *** to type this every time I start my PC.

If this is not possible, is there a way to have my password remembered so that all I have to do is click on the icon instead?

Cheers,

C h r e d g e.

windows xp?

see http://www.microsoft.com/windowsxp/using/setup/learnmore/tips/knox2.mspx

and http://support.microsoft.com/kb/315231

1 more replies

Hi, I've recently been searching around the internet for some speed accelerators, etc., and tried a few. The next day I turned on my computer and my firefox loaded with a totally different webpage. This site called turbo-search101.com replaced my regular jpopasia.com/charts. So as anyone would do I'm sure, I opened up the options and changed it back. I clicked the home page button but the same page popped up! I checked my options again and it indeed said turbo-search101.com. So I tried it again. turbo-search101.com popped back up. I checked my antivirus and the "block any home page changes" was on, interestingly enough, the "alert me if an attempt is blocked" as also on. I uninstalled any software i might have downloaded but still came up with the same result.

13 more replies

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:19:15, on 03-Feb-2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

getting warning for Zafi.B

1 more replies

I have noticed that if I mistype a website address or if it cannot be found, then I get taken to this page instead of the MSN page:

http://hit.lookupanything.biz/apps/...eq=1bc53765ef482508c7d127e01285e2f3&prt=NN100
Now I know me or my Boyfriend didnt accept to change anything, which only leaves my Dad as he is daft when it comes to things like this even though I have told him to be bloody careful.

Please can someone take a look at my Hijack This report and see if there is anything dodgy on it? The PC is generally running insanely slow aswell (nothing to do with the Find A Drug thingy we have running as we only installed that a couple of days ago and it has been like it for the past week or so)

Thanks guys

Logfile of HijackThis v1.97.7
Scan saved at 14:37:11, on 12/11/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.exe

A:Search page has changed and comp running slow

Go to control panel, add/remove programs and remove new.net if that fails go here and follow procedure 4 to remove it.
http://www.newdotnet.com/removal.html

Reboot.

1 more replies

I was trying to help this person which had her home page changed. It got me curious as to how this can happen.....did they do it with activeX and does she have to change a registry setting to get back the ability to restore her homepage. Thanks

My home page was changed to something that says duolaimi.net (You probably shouldn't go there unless you want problems too) with my old home page url following it.

When I click properties to change it back to my home page the section that allows home page selection is 'greyed' out and does not respond..Click to expand...

16 more replies

Hi
my home page was changed after my computer detected a virus.I deleted it,scan with several antivirus programs and the problem still exists.Moreover it added some pages in my favorites ( 7 days free porno ......, lookcc........stuff like that).My home page is changed to about:blank.I try to change it from the settings but it is still changing by itself.This is my hijackthis log file.PLEASE HELP ME!!!

Logfile of HijackThis v1.99.1
Scan saved at 3:00:01 &#956;&#956;, on 30/6/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\RSCMPT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\POPROXY.EXE
C:\WINDOWS\NETXO.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SPYSUB.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\IPOX.EXE
C:\WINDOWS\SYSTEM\ATLSJ.EXE
C:\WINDOWS\SYSTEM\ATLSJ.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\ATLSJ.EXE
C:\WINDOWS\SYSTEM\ATLSJ.EXE
C:\WINDOWS\SYSTEM\ATLSJ.EXE

9 more replies

Hi,

Just wanted to know if anyone has had this problem and how they fixed it. I used my Pocket PC to access my yahoo mail account. When it opened the account, it told me that it could not display the page properly unless I had internet 6.0. It gave me the option to revert back to a view that Pocket IE could view. Now when I access yahoo mail from my desktop computer, the view of the mail page is "primitive" like it is on the PDA. Anyone know how to change the setting in yahoo mail to give me back the old view of the mail page (ex. how the inbox and folders look). It is like it was designed for IE 4.0. Somehow Yahoo has permanently changed how it displays my account. I used Pocket IE in Window Mobile 2003 SE. My desktop computer has IE 6.0. This only happened to the yahoo accounts I access from the PDA. My other yahoo mail accounts still look like they are supposed on IE 6.0. Please help.

Thanks

A:Yahoo WebMail page changed after view with Pocket IE

Hi geekout2,

Give this a try and hope that it'll resolve your issue.

Click on Options on the top-right portion of the screen,
Under Personalization, look for "General Preferences",
Under General Preferences, look for the Messages part,
Set your Screen Width:to default (72 and 55)
Click on save at the bottom part.

I hope that will do the trick

2 more replies

Wow this is strange,

I then went to my bro's room to check out on his.
And it was different there. Just the normal old one.

I'm making this post to check if i am being redirected by a virus or not.

FireFox: http://s8.postimage.org/5gl8mrdj7/wth1a.png
Chrome: http://s14.postimage.org/g4toajrof/wth2a.png

My brothers computer (Same Network):
http://s7.postimage.org/jq9g31s7t/firefox.jpg
http://s1.postimage.org/p0pxms2ou/chrome.jpg

Greets,

WTH

1 more replies

Hello all. First time post.

My McAfee virus scan keeps telling me I have the trojan FakeAlert-B. I can't seem to get rid of it. I also now have a security toolbar in IE that I didn't install and my hame page was changed to about.blank. I go into Internet Options and change it but it goes right back to about.blank. I have ran McAfee, Ccleaner, and Ewido. I have cleaned all files they each recommended. I have a copy of my Hijack log:

Logfile of HijackThis v1.99.1
Scan saved at 9:47:59 AM, on 4/29/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\SYSTEM32\GEARSEC.EXE
C:\WINDOWS\system32\drivers\KodakCCS.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\atmclk.exe
C:\WINDOWS\system32\dcomcfg.exe

Launch ewido, there should be an icon on your desktop, double-click it.
The program will now open to the main screen.
When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.

You will need to update ewido to the latest definition files.On the left hand side of the main screen click update.
Then click on Start Update.

The update will start and a progress bar will show the updates being installed.
(the status bar at the bottom will display ("Update successful")
Exit Ewido, do not run the scan yet!
If you are having problems with the updater, you can use this link to manually update ewido.

Click "Next"
In the box to choose where to extract the files to,
Click "Browse"
Click on the + sign next to "My Computer"
Click on "Local Disk (C:) or whatever your primary drive is
Click "Make New Folder"
Type in BFU
Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".
Save it in the same folder you made earlier (c:BFU).

Do not do anything with these ye... Read more

1 more replies

You might try Spybot. AVG is an anti-virus package that's better than a lot of commercial a-v software, and it's free! ZoneAlarm has a good, free firewall that you may want to take a look at, also.

5 more replies

It's now February 20th. On February 12th, I changed my website to a new host and rebuilt it using WordPress. For a few days, using my main computer, I was able to see the new site on my PC (running Windows 7, Chrome, Firefox), but I could not access the WordPress admin logon page (It was set up and installed from a different location/network). I was getting a 404 File Not Found message.
Then by about Feb. 15th, my web browsers were no longer displaying the new webpage, but rather the old web page on the old host.
I cleared the cache in Chrome and Firefox, but that didn't fix it.
I contacted the new hosting company, and they advised me to use custom name servers, which I did.
This had no effect on the issue.
I downloaded Opera and typed in the url to the freshly-installed browser. It displayed the old site on the old host.
I then used a different computer, but still on my home network, and on typing the in the URL, the new site/new host, as well as the WP logon page came up on the browser.
This suggests that a file in my main computer is storing an old IP address.
I have done an ARP search, but did not see the website's IP address in that list.
I have accessed the Internet Options in my Windows 7 Control Panel and deleted temporary internet files.
All without success.
Does anybody have any suggestions on what else I might do to resolve this?

More replies

I finally got windows to update. Everything was great. I changed the settings to "Let me choose..... ". Everything was still great. Then I unticked the box about getting Microsoft Software updates because I didn't think I would need software updates. It flashed a warning at me but I thought it was just about the software so hit OK anyway. I then lost the last two boxes you normally see on that update page. Got them back by installing Silverlight again. Have them ticked again. But now, when I go to the Windows Update page it constantly shows me a big red X. I got to change settings and put it to fully automatic, hit ok... but it won't save that change. It shows me the red X again.

Yet, when I look at the GWX panel it shows I have updates set on Automatic (photos attached). So I have no idea what is going on. I"ve tried a few fixes..... did a Windows update trouble shoot thing through Microsoft that said it had fixed 3 issues (don't know what now didn't take a screen shot sorry) and that made the update page look even worse. Now is says I've never updated etc (photo attached). I even saw a post about doing something in the registry but when I got to the right place my computer didn't even display the two things supposedly it should have so I couldn't do the last two steps of that post (from Win 7 Forums) Please Help.

A:Windows Update Page Won't Save Changed Setting

7 more replies

Logfile of HijackThis v1.99.1Scan saved at 12:16:53 AM, on 2/23/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\AOL\ACS\AOLAcsd.exeC:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exeC:\Program Files\Norton AntiVirus\navapsvc.exeC:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeC:\WINDOWS\System32\nvsvc32.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Ideazon\Zboard Software\Driver\Zb... Read more

Please follow the steps in this topic and then post a new hijackthis log as a reply to this topic.How To Remove Spyfalcon And Dxmpp.dllAlso post the c:\smitfiles.txt log as well.

1 more replies

6 more replies

Please can you tell me how to get rid of this web page it is deep in my registry and I can't remove it. It is in R0 called www.leeman-automatisering.nl/startpagina
Ihave tried hijack this and adware professional.
Logfile of HijackThis v1.97.2
Scan saved at 00:09:22, on 20/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\Explorer.EXE
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\ehome\ehtray.exe
G:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
G:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
G:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
G:\WINDOWS\system32\rundll32.exe
G:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
G:\WINDOWS\system32\tbctray.exe
G:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
G:\Program Files\Messenger\msmsgs.exe
G:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
G:\WINDOWS\system32\cisvc.exe
G:\WINDOWS\eHome\ehRecvr.exe
G:\WINDOWS\eHome\ehSched.exe
G:\WINDOWS\system32\inetsrv\inetinfo.exe
G:\WINDOWS\System32\snmp.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\ups.exe
G:\WINDOWS\system32\ZoneLabs\vsmon.exe

A:Solved: Start page in explorer has bogus web page

16 more replies

Hello.

A while back, I had a malware issue where all google links got redirected and the computer didn't connect to any of the major malware protection sites. A very frustrating issue, to be sure, as I suspect you all remember.

I seemed to have been one of the lucky early ones to get it, and there was very little information about it on-line at the time. I finally found instructions that seemed to work: going to Device Manager, finding TDSServ.sys, and selecting disable, then restarting and running anti-malware software.

I didn't notice it at the time, but apparently I'm still not getting automatic windows updates and when I go to windowsupdate.com or windowsupdate.microsoft.com, I get a blank webpage -- whether I enter the site as a url or as an ip address. I've tried updating and running Malwarebytes' Anti-Malware, Spybot Search & Destroy (but not TeaTimer), and Microsoft Windows Malicious Software Removal Tool, but even on full scans, none of them is finding any problems. I looked in the hosts file and didn't see any redirects for those URLs (though there are a lot of entries that I presume came from Spybot immunization). I also checked Device Manager now -- there's no TDSServ.sys.

I'm on a laptop running Windows XP Home Edition 2002, with Service Pack 2, connecting to the internet wirelessly, running Zone Alarm but no Antivirus software.

-Eric

A:Windows update page is blank, no automatic updates happening

Microsoft Update Solution Center (includes a list of update issues)How to troubleshoot common Windows Update, Microsoft Update installation issuesTroubleshooting: Automatic UpdatesYou receive a scripting error or a blank page when you visit the Windows Update...Errors when you use Windows Update or Microsoft Update to install updates[quote]Re-install Windows Update fileMicrosoft Online Assisted Support: E-mail Support (no-cost for issues related to getting updates)

3 more replies

I'm trying to print a mail merged document of about 160 letters and MSWorks automatically inserts page numbers when I go to print or preview the document. How do I stop the insert of page numbers?

Message: You have added the Insert Page Number field to the merge document. Each entry in the merged document will be marked sequentially. Click OK to number each entry sequentially.

A:Printing unwanted automatic insert of page numbers in MS Works

instead of using works which is incompatible with most other word processors and not fully functional, use openoffice which is and is free and can save in MANY formats.

www.openoffice.org

1 more replies

I tried putting the Firefox application file under Startup in Windows Explorer, but the program still does not start automatically when I start Windows or turn my computer on. How do I do this?

Thanks for any help.

A:Automatic Startup of Programs

Is it showing in your Start > Programs > Startup menu. If not, then you put it in the wrong startup folder. You can drag it right into your startup there on your start menu programs.

2 more replies

I recently bought a used Dell Optiplex for my niece. It came w/o an OS. I installed Win98 w/o problem. The computer is running great w/one exception. Every morning at 6:30 it powers on by itself and scares the daylights out of my niece. She thinks it's possessed. I thought I found something in the task scheduler and deleted it, but that didn't work. I don't see anything in the BIOS, but I could be overlooking something obvious. Can anyone help? Many thanks.....

A:automatic computer startup

There are a lot of different optiplexes can you post the model or service tag (serial number)?

3 more replies

I tried putting the Firefox application file under Startup in Windows Explorer, but the program still does not start automatically when I start Windows or turn my computer on. How do I do this?

Thanks for any help.

A:Automatic Startup of Programs

Put the shortcut to the executable file in C:\Documents and Settings\All Users\Start Menu\Programs\Startup

3 more replies

Hi,

I was wondering if it is possible for a computer to automatically turn on from a total off state at a certain time of the day.

My Computer details:
- Dell Dimension 4550
- Pentium 4 2.00 GHz
- 512 MB of RAM
- OS: Windows XP Home Edition SP2

Thanks.

A:Automatic System Startup

There are a couple of ways to do this. One is to use WOL (Wake On LAN) and have another system somewhere wake it up. Another is to use the BIOS capability that some systems provide to wake it up based on time. Finally, you can find timer products made to plug into the power switch on the MB and power up at a specific time. I suspect in your case the BIOS may not offer any capbility, so you'd be looking at WOL or a 3rd party device.

3 more replies

I manage a small network of four WinXP machines that I'd like to back up after hours. To facilitate this, I'd like the computers to start themselves up, run Norton Ghost, and then shutdown at times of my choosing. Ideally, I'd like to stagger this so that only one client is doing it at once.

Any idea how I do this?

A:Automatic Shutdown/Startup

most auto power on abilities are features ofspecific motherboards... though with ATX computersyou can get software to automatically shut downthe machine.there are automated backup packages,retrospect is a good one, but sometimes difficultto get set up properly.Dantz, the maker of RetrospectandNorton's Ghost Solutions Suite i am going toget to try out next week (or three) and i believeit might have the ability...Symantec's Ghost sitegood luck!--rex

3 more replies

Hello eight forums.

I've searched by the forum for a solution to make automatic log on on windows startup.
(like local account just as Microsoft account)

So I took the tutorial Log On User Account Automatically at Windows 8 Startup .

And after doing the steps, I'm having the setting set up for using automatic log on.

Thanks for any help,
Max.

A:Automatic Startup Windows 8.1

Hi Max,
You may not have pressed "Apply" button, just a guess.

6 more replies

My mother's computer is running slow and I think it is because I went to some naughty sites in the past. I ran malwarebytes and it is a little better but wondering if it is still on her computer. It seems like the programs open slower than before. Also, Whatever it was it changed my homepage to searchnu.com/406. I ran the HJT, DDS and GMER and pasted them below. Thank you in advance for any help you give.
HERE IS THE HJT LOG:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:35:59 PM, on 12/4/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17114)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\WZCBDL Service\WZCBDLS.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe