Jump to content


Photo

Hijacked browser. . . same as the guy below.


  • Please log in to reply
7 replies to this topic

#1 spiTTfire

spiTTfire

    Member

  • Full Member
  • Pip
  • 7 posts

Posted 14 June 2004 - 04:30 PM

After checking the board it looks like I have the same problem as several other people here but with a different file name. Here's the output from HijackThis that shows where the problem is:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\vhrlg.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://vhrlg.dll/index.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://vhrlg.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\vhrlg.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://vhrlg.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\vhrlg.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:7212

If I change my homepage it always changes back to res://vhrlg.dll/index.html#96676. I've noticed other people have different file names but the reg entries all look about the same. If you change the homepage when the browser is closed it will retain that setting when you open the browser. But, you then get a pop-up titled 'Only the best'. After that pops up the browser homepage changes back to the res:// etc.

Can I just delete these reg entries in HijackThis??

#2 Cirruz

Cirruz

    Member

  • New Member
  • Pip
  • 1 posts

Posted 14 June 2004 - 04:37 PM

Hi, do you see any entry with the string "wingu" or "wingu.dll" in it?

Cirruz

#3 Screaminghell

Screaminghell

    Member

  • New Member
  • Pip
  • 4 posts

Posted 14 June 2004 - 04:40 PM

hey, none of the things you can remove with HJT will fix it...i think it is in the registry but i have no idea where.....as i need help with this too anybody know a fix??

#4 spiTTfire

spiTTfire

    Member

  • Full Member
  • Pip
  • 7 posts

Posted 14 June 2004 - 05:46 PM

No, do not see anything with wingu or wingu.dll.

And this is definately a problem that starts with the reg. The .dll referenced in the reg will be located in Windows/system32. Renaming that .dll doesn't help the problem, a new one was created.

May remove the reg lines and the .dll itself???

Need help though.

#5 spiTTfire

spiTTfire

    Member

  • Full Member
  • Pip
  • 7 posts

Posted 14 June 2004 - 08:12 PM

Bump.

Can't somone help? There's 4 or 5 other people here with a similar problem.

#6 spiTTfire

spiTTfire

    Member

  • Full Member
  • Pip
  • 7 posts

Posted 15 June 2004 - 04:09 PM

Bump

#7 spiTTfire

spiTTfire

    Member

  • Full Member
  • Pip
  • 7 posts

Posted 16 June 2004 - 09:02 AM

Bumped

#8 DIGIWIBBS

DIGIWIBBS

    Member

  • Full Member
  • Pip
  • 17 posts

Posted 16 June 2004 - 09:13 AM

what's the problem you're having




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button