Jump to content


Photo

hijacked home page


  • Please log in to reply
4 replies to this topic

#1 mikester8

mikester8

    Member

  • Full Member
  • Pip
  • 16 posts

Posted 29 June 2004 - 07:57 PM

:unsure: someone please help me with this...ive had my homepage hijacked for a while now....im dying to get my computer back to normal....iv'e downloaded hijackthis and CWShredder.......id appreciate any help....thanks

#2 WicKeR

WicKeR

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 29 June 2004 - 08:00 PM

run hyjackthis and post the log.

(run it, save log, (ctrl)+a, (ctrl)+C, reply to post, (ctrl)+V, so it can be reviewed

#3 mikester8

mikester8

    Member

  • Full Member
  • Pip
  • 16 posts

Posted 29 June 2004 - 10:01 PM

Logfile of HijackThis v1.97.7
Scan saved at 11:00:43 PM, on 6/29/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\CTsvcCDA.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\winfq.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\WINDOWS\system32\apiql.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Support.com\bin\tgcmd.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HistoryKill\histkill.exe
C:\Program Files\BellSouth\Connection Manager\CManager.exe
C:\Program Files\HistoryKill\hkPopupKiller.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Michael Menendez\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\pbrzi.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://dbahw.dll/index.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://pbrzi.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\pbrzi.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://pbrzi.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\pbrzi.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = home.netscape.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {24817430-5142-4C7E-9CFF-0DCF7AC3D4C9} - C:\WINDOWS\system32\sysvf32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [apiql.exe] C:\WINDOWS\system32\apiql.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /nosystray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe files\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] /L:ENG
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [HistoryKill] C:\Program Files\HistoryKill\histkill.exe /startup
O4 - HKLM\..\RunOnce: [winhc32.exe] C:\WINDOWS\winhc32.exe
O4 - HKLM\..\RunOnce: [winfq.exe] C:\WINDOWS\system32\winfq.exe
O4 - HKLM\..\RunOnce: [syswx.exe] C:\WINDOWS\system32\syswx.exe
O4 - HKLM\..\RunOnce: [winss32.exe] C:\WINDOWS\winss32.exe
O4 - HKLM\..\RunOnce: [atlmn.exe] C:\WINDOWS\atlmn.exe
O4 - HKLM\..\RunOnce: [ntni32.exe] C:\WINDOWS\system32\ntni32.exe
O4 - HKLM\..\RunOnce: [appyb.exe] C:\WINDOWS\system32\appyb.exe
O4 - HKLM\..\RunOnce: [addwm32.exe] C:\WINDOWS\addwm32.exe
O4 - HKLM\..\RunOnce: [d3tv.exe] C:\WINDOWS\d3tv.exe
O4 - HKLM\..\RunOnce: [d3yv32.exe] C:\WINDOWS\system32\d3yv32.exe
O4 - HKLM\..\RunOnce: [ipbn.exe] C:\WINDOWS\ipbn.exe
O4 - HKLM\..\RunOnce: [netzg32.exe] C:\WINDOWS\netzg32.exe
O4 - HKLM\..\RunOnce: [iehl.exe] C:\WINDOWS\iehl.exe
O4 - HKLM\..\RunOnce: [d3nw32.exe] C:\WINDOWS\system32\d3nw32.exe
O4 - HKLM\..\RunOnce: [apppa32.exe] C:\WINDOWS\apppa32.exe
O4 - HKLM\..\RunOnce: [mfctu32.exe] C:\WINDOWS\system32\mfctu32.exe
O4 - HKLM\..\RunOnce: [iewm.exe] C:\WINDOWS\system32\iewm.exe
O4 - HKLM\..\RunOnce: [ipdp.exe] C:\WINDOWS\system32\ipdp.exe
O4 - HKLM\..\RunOnce: [winco.exe] C:\WINDOWS\system32\winco.exe
O4 - HKLM\..\RunOnce: [sdkbr.exe] C:\WINDOWS\system32\sdkbr.exe
O4 - HKLM\..\RunOnce: [ntxy32.exe] C:\WINDOWS\ntxy32.exe
O4 - HKLM\..\RunOnce: [sdkyv.exe] C:\WINDOWS\sdkyv.exe
O4 - HKLM\..\RunOnce: [croq32.exe] C:\WINDOWS\croq32.exe
O4 - HKLM\..\RunOnce: [d3kv32.exe] C:\WINDOWS\d3kv32.exe
O4 - HKLM\..\RunOnce: [ieix32.exe] C:\WINDOWS\ieix32.exe
O4 - HKLM\..\RunOnce: [msst.exe] C:\WINDOWS\system32\msst.exe
O4 - HKLM\..\RunOnce: [d3mz.exe] C:\WINDOWS\system32\d3mz.exe
O4 - HKLM\..\RunOnce: [crzo32.exe] C:\WINDOWS\system32\crzo32.exe
O4 - HKLM\..\RunOnce: [ipvl32.exe] C:\WINDOWS\ipvl32.exe
O4 - HKLM\..\RunOnce: [winrf32.exe] C:\WINDOWS\winrf32.exe
O4 - HKLM\..\RunOnce: [ieha32.exe] C:\WINDOWS\system32\ieha32.exe
O4 - HKLM\..\RunOnce: [d3lk.exe] C:\WINDOWS\system32\d3lk.exe
O4 - HKLM\..\RunOnce: [iefb.exe] C:\WINDOWS\iefb.exe
O4 - HKLM\..\RunOnce: [ieur.exe] C:\WINDOWS\system32\ieur.exe
O4 - HKLM\..\RunOnce: [systt.exe] C:\WINDOWS\systt.exe
O4 - HKLM\..\RunOnce: [crcq.exe] C:\WINDOWS\crcq.exe
O4 - HKLM\..\RunOnce: [atlhx32.exe] C:\WINDOWS\system32\atlhx32.exe
O4 - HKLM\..\RunOnce: [d3ad32.exe] C:\WINDOWS\system32\d3ad32.exe
O4 - HKLM\..\RunOnce: [sysoj.exe] C:\WINDOWS\sysoj.exe
O4 - HKLM\..\RunOnce: [mfcvs.exe] C:\WINDOWS\system32\mfcvs.exe
O4 - HKLM\..\RunOnce: [netmh.exe] C:\WINDOWS\system32\netmh.exe
O4 - HKLM\..\RunOnce: [crsv.exe] C:\WINDOWS\crsv.exe
O4 - HKLM\..\RunOnce: [atldm.exe] C:\WINDOWS\system32\atldm.exe
O4 - HKLM\..\RunOnce: [appyd.exe] C:\WINDOWS\system32\appyd.exe
O4 - HKLM\..\RunOnce: [iele32.exe] C:\WINDOWS\iele32.exe
O4 - HKLM\..\RunOnce: [ipwr32.exe] C:\WINDOWS\ipwr32.exe
O4 - HKLM\..\RunOnce: [ipui.exe] C:\WINDOWS\system32\ipui.exe
O4 - HKLM\..\RunOnce: [windr.exe] C:\WINDOWS\windr.exe
O4 - HKLM\..\RunOnce: [appyv.exe] C:\WINDOWS\appyv.exe
O4 - HKLM\..\RunOnce: [mfcwx.exe] C:\WINDOWS\mfcwx.exe
O4 - HKLM\..\RunOnce: [mshk.exe] C:\WINDOWS\mshk.exe
O4 - HKLM\..\RunOnce: [netuz32.exe] C:\WINDOWS\netuz32.exe
O4 - HKLM\..\RunOnce: [appgy32.exe] C:\WINDOWS\system32\appgy32.exe
O4 - HKLM\..\RunOnce: [appuh32.exe] C:\WINDOWS\system32\appuh32.exe
O4 - HKLM\..\RunOnce: [winbb.exe] C:\WINDOWS\system32\winbb.exe
O4 - HKLM\..\RunOnce: [crpd.exe] C:\WINDOWS\crpd.exe
O4 - HKLM\..\RunOnce: [netwj.exe] C:\WINDOWS\system32\netwj.exe
O4 - HKLM\..\RunOnce: [mfcpw.exe] C:\WINDOWS\system32\mfcpw.exe
O4 - HKLM\..\RunOnce: [systd32.exe] C:\WINDOWS\system32\systd32.exe
O4 - HKLM\..\RunOnce: [iptn32.exe] C:\WINDOWS\system32\iptn32.exe
O4 - HKLM\..\RunOnce: [ntic.exe] C:\WINDOWS\system32\ntic.exe
O4 - HKLM\..\RunOnce: [msby.exe] C:\WINDOWS\msby.exe
O4 - HKLM\..\RunOnce: [netmk.exe] C:\WINDOWS\system32\netmk.exe
O4 - HKLM\..\RunOnce: [mfcpx.exe] C:\WINDOWS\mfcpx.exe
O4 - HKLM\..\RunOnce: [d3jm.exe] C:\WINDOWS\system32\d3jm.exe
O4 - HKLM\..\RunOnce: [addti32.exe] C:\WINDOWS\addti32.exe
O4 - HKLM\..\RunOnce: [appjo.exe] C:\WINDOWS\system32\appjo.exe
O4 - HKLM\..\RunOnce: [d3rf.exe] C:\WINDOWS\d3rf.exe
O4 - HKLM\..\RunOnce: [ieea32.exe] C:\WINDOWS\ieea32.exe
O4 - HKLM\..\RunOnce: [d3ir.exe] C:\WINDOWS\system32\d3ir.exe
O4 - HKLM\..\RunOnce: [d3xt.exe] C:\WINDOWS\system32\d3xt.exe
O4 - HKLM\..\RunOnce: [appzx.exe] C:\WINDOWS\appzx.exe
O4 - HKLM\..\RunOnce: [ntsb.exe] C:\WINDOWS\system32\ntsb.exe
O4 - HKLM\..\RunOnce: [crxn.exe] C:\WINDOWS\system32\crxn.exe
O4 - HKLM\..\RunOnce: [ipvp32.exe] C:\WINDOWS\system32\ipvp32.exe
O4 - HKLM\..\RunOnce: [d3xx32.exe] C:\WINDOWS\system32\d3xx32.exe
O4 - HKLM\..\RunOnce: [mspf32.exe] C:\WINDOWS\system32\mspf32.exe
O4 - HKLM\..\RunOnce: [syssh32.exe] C:\WINDOWS\system32\syssh32.exe
O4 - HKLM\..\RunOnce: [iebl32.exe] C:\WINDOWS\system32\iebl32.exe
O4 - HKLM\..\RunOnce: [winxd32.exe] C:\WINDOWS\winxd32.exe
O4 - HKLM\..\RunOnce: [apipz.exe] C:\WINDOWS\system32\apipz.exe
O4 - HKLM\..\RunOnce: [sdkcl32.exe] C:\WINDOWS\system32\sdkcl32.exe
O4 - HKLM\..\RunOnce: [addix.exe] C:\WINDOWS\addix.exe
O4 - HKLM\..\RunOnce: [mfckm.exe] C:\WINDOWS\mfckm.exe
O4 - HKLM\..\RunOnce: [ntdx32.exe] C:\WINDOWS\ntdx32.exe
O4 - HKLM\..\RunOnce: [atluf.exe] C:\WINDOWS\atluf.exe
O4 - HKLM\..\RunOnce: [nteb.exe] C:\WINDOWS\system32\nteb.exe
O4 - HKLM\..\RunOnce: [d3rx32.exe] C:\WINDOWS\system32\d3rx32.exe
O4 - HKLM\..\RunOnce: [addih32.exe] C:\WINDOWS\system32\addih32.exe
O4 - Startup: Connection Manager.lnk = C:\Program Files\BellSouth\Connection Manager\CManager.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com...ex/qtplugin.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,20/mcgdmgr.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab

#4 mikester8

mikester8

    Member

  • Full Member
  • Pip
  • 16 posts

Posted 01 July 2004 - 11:14 AM

anyone interested in helping?....anyone?

#5 Fireflyer

Fireflyer

    Spyware Scorcher

  • Retired Staff
  • PipPipPipPipPip
  • 571 posts

Posted 03 July 2004 - 05:50 PM

Download About:Buster from Here http://www.downloads...AboutBuster.zip

Unzip it to your desktop. Double click it and hit Ok, then Start, then Ok to start the scan. The scan should take a few seconds. Once it is done save the report. Paste the report and a new HijackThis log as a reply in this thread.
How did I get infected in the first place?
Online Virus and Trojan Scanners
Panda Software . . . Trend Micro . . . Bitdefender . . . Sygate Trojan Scan . . . Trojan Scan
Tools for Fighting Spyware
Spybot S & D . . . Ad-aware . . . CWShredder . . . HijackThis . . . PeperFix
Tools for Prevention
SpywareBlaster . . . SpywareGuard . . . IE-Spyad . . . avast! Free Anti-Virus . . . AVG Free Anti-Virus
Zone Alarm Free Firewall . . . Kerio Personal Firewall
Help support this site! Click here to learn how.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button