• Announcements

    • Budfred

      IE 11 copy/paste problem

      It has come to our attention that people using Internet Explorer 11 (IE 11) are having trouble with copy/paste to the forum. If you encounter this problem, using a different browser like Firefox or Chrome seems to get around the problem. We do not know what the problem is, but it seems to be specific to IE 11 and we are hopeful that Microsoft will eventually fix it.
Sign in to follow this  
Followers 0
imperialforge

Someone HELP!!!!!

4 posts in this topic

My browser has been hijacked by res://vbart.dll/index.html#96676. :grrr: I ran AdAware – it did not notice anything suspicious. I ran Spybot S&D – it keeps finding and deleting the same 5 files. The problem is, that every time I reset my homepage to my yahoo, the blasted res://vbart.dll/index.html#96676 comes right back up as home page after I close and reopen IE. That happens even after Spybot destroys those 5 files it keeps finding. I ran Hijack This and here are the results:

 

Logfile of HijackThis v1.97.7

Scan saved at 3:37:50 AM, on 6/18/2004

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE

C:\Program Files\ABBYY FineReader 5.0 Sprint\CAgent.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\WINDOWS\system32\crpe.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Exif Launcher\QuickDCF.exe

C:\Program Files\Lexmark X125\LEX125SU.exe

C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe

C:\WINDOWS\System32\GEARSEC.EXE

C:\WINDOWS\system32\netwp.exe

C:\Program Files\Network Associates\VirusScan\VsStat.exe

C:\Program Files\Network Associates\VirusScan\Vshwin32.exe

C:\Program Files\Network Associates\VirusScan\Avconsol.exe

C:\Program Files\Network Associates\VirusScan\Webscanx.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe

C:\Documents and Settings\Artem\Desktop\Hijack\HijackThis.exe

C:\Documents and Settings\Artem\Desktop\Hijack\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vbart.dll/sp.html#96676

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://vbart.dll/index.html#96676

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://vbart.dll/index.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vbart.dll/sp.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://vbart.dll/index.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\vbart.dll/sp.html#96676

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {FA38A758-CFC4-D24D-B315-464B349FD577} - C:\WINDOWS\winaa.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe

O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE

O4 - HKLM\..\Run: [ABBYY Community Agent] C:\Program Files\ABBYY FineReader 5.0 Sprint\CAgent.exe

O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

O4 - HKLM\..\Run: [crpe.exe] C:\WINDOWS\system32\crpe.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKLM\..\RunOnce: [netwp.exe] C:\WINDOWS\system32\netwp.exe

O4 - HKLM\..\RunOnce: [mfctf32.exe] C:\WINDOWS\system32\mfctf32.exe

O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\Exif Launcher\QuickDCF.exe

O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\System32\toolbar.dll/SEARCH.HTML

O8 - Extra context menu item: SnipeIt! eSnipe - http://www.esnipe.com/SnipeIt/SnipeItOpen3.asp

O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll

O12 - Plugin for .MPG: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll

O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll

O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - file://C:\install.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cab

 

My understanding is that the problem is these:

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vbart.dll/sp.html#96676

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://vbart.dll/index.html#96676

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://vbart.dll/index.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vbart.dll/sp.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://vbart.dll/index.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\vbart.dll/sp.html#96676

 

Yet, after I fix them in Hijack This, and change the settings in IE back to yahoo being my homepage, the changes are good for that session only. After I close IE, or reboot my PC, the blasted res://vbart.dll/index.html#96676 IS AGAIN SET AS MY HOMEPAGE!

 

Another thing: when I tried to fix the problem through Add/Remove programs utility in Control Panel, I see that I have Home Search Assistant listed among programs. When I try to remove it, I am automatically taken to some Russian porn page and the Add/Remove is frozen while IE with that page is open. When I close it and attempt again, the same story repeats. :rofl:

 

I am at a loss here. Any help will be appreciated!!!

Share this post


Link to post
Share on other sites

Can sympathize with you. I'm a novice and currently waiting for someone to help with similar problem, but I wanted to ask a dumb question.....Have you disabled restore before you run the fix?

Share this post


Link to post
Share on other sites
Sign in to follow this  
Followers 0