Jump to content


Photo

homepage hijack


  • Please log in to reply
3 replies to this topic

#1 rcsoccer97

rcsoccer97

    Member

  • New Member
  • Pip
  • 3 posts

Posted 13 July 2004 - 05:26 PM

we have adaware and spy sweeper and it eliminated all problems except our homepage keeps changing and wont stay on what we set it. need help. beginers.



Logfile of HijackThis v1.98.0
Scan saved at 6:21:52 PM, on 7/13/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\system32\apilm32.exe
C:\WINDOWS\System32\ilgtjukk.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\bfm.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\mfcnv32.exe
C:\WINDOWS\addaa32.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Joseph Young\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\wyqeu.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://wyqeu.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\wyqeu.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\wyqeu.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {617458C6-6E17-07E1-3E8F-4F74E109BF8F} - C:\WINDOWS\netdb32.dll (file missing)
O2 - BHO: (no name) - {6E0F0093-EF04-1478-FE8A-D4B3176F0CE3} - C:\WINDOWS\system32\addpy32.dll
O4 - HKLM\..\Run: [apilm32.exe] C:\WINDOWS\system32\apilm32.exe

#2 jwbirdsong

jwbirdsong

    Slasher O' spyware

  • Emeritus
  • PipPipPipPipPip
  • 2,045 posts

Posted 13 July 2004 - 07:04 PM

Download the tool About:Buster created by Rubber Ducky. Atri's Stie or Sub's Site

Unzip it to your desktop.

Now start Hijack this and tick the boxes next to these items..

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {617458C6-6E17-07E1-3E8F-4F74E109BF8F} - C:\WINDOWS\netdb32.dll (file missing)
O2 - BHO: (no name) - {6E0F0093-EF04-1478-FE8A-D4B3176F0CE3} - C:\WINDOWS\system32\addpy32.dll
O4 - HKLM\..\Run: [apilm32.exe] C:\WINDOWS\system32\apilm32.exe


Now close ALL other windows and hit "fix checked".

Start About:Buster then hit OK>Start>Ok. Let it run; when done it will give you a log, save a copy of it.
Run About:Buster again save the log again (use a different name)

Restart your computer and post both reports and a new Hijack this log.
Make sure to get ALL of the new HijackThis ;pg..it look like you [i]may[/] be missing some of this one,
Things you need(all FREE)
Anti-Virus (Only One of these)
AVG Avast
Firewall (Only One here too)
Kerio(Direct Download) Zone Alarm
Misc. (Use all 3 together)
IE Spyads SpywareBlaster Spyware Guard
Windows Update (Once a week)
get all CRITICAL Updates

Things you want(Still Free)
Mozillia Firefox
Google Toolbar (stops pop-ups)
Ad-Aware
Spybot S&D
MS MVP Hosts file

Please donate to the site to help us help you. Info found HERE

Posted Image
PROUD member Since 2004

#3 rcsoccer97

rcsoccer97

    Member

  • New Member
  • Pip
  • 3 posts

Posted 13 July 2004 - 07:51 PM

thanks! ill try it! :D

#4 rcsoccer97

rcsoccer97

    Member

  • New Member
  • Pip
  • 3 posts

Posted 13 July 2004 - 07:59 PM

-- Scan 1 --------
About:Buster Version 1.26
Removed! : C:\WINDOWS\skpke.dat
Removed! : C:\WINDOWS\skpke.dll
Removed! : C:\WINDOWS\vroih.dat
Removed! : C:\WINDOWS\xumge.dll
Removed! : C:\WINDOWS\System32\ugjow.dll
Removed! : C:\WINDOWS\System32\wczet.dat
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!
-- Scan 2 --------
About:Buster Version 1.26
Attempted Clean Of Temp folder.
Pages Reset... Done!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button