| Live Chat & Podcast at 1:00PM Eastern on Sunday! |
Advertisement
Advertisement
 Search | |
| |
16-Jul-2004, 10:05 PM
#1 | ||||||
| [Resolved] My homepage keeps changing I'm using windows XP and I've been having some annoying problems. Internet Explorer's homepage keeps changing to "your-searcher.com". At first I thought "No big deal, I've dealt with Spy-Ware before" But whatever is causing it is really hard to kill. I monitored how long it takes for the homepage to change and it's about five minutes, and yes that's while the machine is on. I already did scans with Spybot S&D as well as Adaware and removed a lot of spyware and I even did a scan with Norton and got rid of five viruses that I didn't even know about. Although my more recent scans have come up negative I'm still having this problem. Oh yeah, and I also just reinstalled IE which didn't help any. I don't know what else I can do... save the unthinkable act of wiping my drive  If someone could help me out with this I would really appreciate it.If I'm not on when you see this thread just email me. Whoops, I am almost forgot that not does it change my homepage it also adds a bunch of Favorites. Last edited by raijah; 16-Jul-2004 at 11:01 PM.. Reason: Forgot Something |
17-Jul-2004, 01:53 AM
#2 | |||||||
| |
18-Jul-2004, 08:28 PM
#4 | |||||||
 Preliminaries: Have these instructions printed or in a convenient Notepad (or Wordpad) file so you can view them in Safe Mode. Have "show hidden (or all) files" checked in Folder Options > View in case you have to search for any hidden files to delete. Also ensure you do NOT have "hide file extensions..." enabled in Folder Options > ViewDownload and unzip to a convenient location the CoolWebShredder, CWShredder.exe available here: http://www.computercops.biz/downloads-cat-14.html Then: 1 >> Restart in Safe Mode: http://service1.symantec.com/SUPPORT...01052409420406 2 >> In Safe Mode run the CoolWebShredder and have it "fix" detected problems. Then run HijackThis and check and "fix" the following entries: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://your-searcher.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://your-searcher.com/index.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://your-searcher.com/index.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://your-searcher.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://your-searcher.com/index.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O4 - Global Startup: winlgn.exe 3 >> Navigate to the folder C:\Documents and Settings\All Users\Start Menu\Programs\Startup and delete the file winlgn.exe from there Additional cleanup instructions: Go to the Control Panel > Internet Options applet. Clear the Temporary Internet Cache, History and Offline Content. Go to the Programs tab and select "reset web settings", including your home page if it has been altered. You can reset that later to what you desire. 4 >> reboot and post a new scanlog after being online for about 20 minutes; some of these hijacks can reinstall themselves through a hidden dll which we will have to search for if this happens. |
19-Jul-2004, 09:40 PM
#6 | |||||||
20-Jul-2004, 05:22 PM
#7 | ||||||
| Actually I just realized that my homepage hasn't been changed for a while now, but I don't know if that means that I'm out of the woods or not, so here's the log: *** www10.brinkster.com/expl0iter/freeatlast/FNF/ *** --The directory 'junkxxx' is now included as a Subfolder in the FINDnfix folder and is the destination for the file to be moved.. -*Previous directions will no longer work... Microsoft Windows XP [Version 5.1.2600] IE build and last SP(s) 6.0.2800.1106 SP1-Q330994 The type of the file system is FAT32. C: is not dirty. Tue 20 Jul 04 14:02:15 2:02pm up 1 day, 1:02 *** Note! *** The list will produce a small database of files that will match certain criteria. You must know how to ID the file based on the filters provided in the scan, as not all the files flagged are bad. Ex: read only files, s/h files, last modified date. size, etc. The filters provided should help narrow down the list, and hopefully pinpoint the culprit. Along with that,registry scan logged at the end should match the corresponding file(s) listed. Unless the file match the entire criteria, it should not be pointed to remove! *For *Helpers/Mods and/or users that are not familiar with any of the items on the scan results- I recommend using an alternative, once you know what to look for! ***LOG!***(*modified 7/20) **Boards that are not personally authorised by me are not allowed to use this fix!** Scanning for file(s)... ********* (*1*) ......... Locked or 'Suspect' file(s) found... (*2*) ........ **File C:\FINDnFIX\LIST.TXT (*3*) ........ No matches found. unknown/hidden files... No matches found. (*4*) ......... Sniffing.......... Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. (*5*) **File C:\WINDOWS\SYSTEM32\DLLXXX.TXT (*6*) ********* Search by size... No matches found. No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512...) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450 Dumping Values........ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (NI) ALLOW Read BUILTIN\Users (IO) ALLOW Read BUILTIN\Users (NI) ALLOW Read BUILTIN\Power Users (IO) ALLOW Read BUILTIN\Power Users (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access BUILTIN\Administrators (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Read BUILTIN\Power Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM Member of...: (Admin logon required!) User is a member of group NA-JZ2M5GR7DTUE\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. Backups created... 2:06pm up 1 day, 1:06 Tue 20 Jul 04 14:06:20 A C:\FINDnFIX\keyback.hiv --a-- - - - - - 8,192 07-20-2004 keyback.hiv A C:\FINDnFIX\keys1\winkey.reg --a-- - - - - - 287 07-20-2004 winkey.reg *Temp backups... . .. keyback2.hi_ winkey2.re_ C:\FINDNFIX\ JUNKXXX Tue Jul 20 2004 2:02:12p .D... <Dir> 1 item found: 0 files, 1 directory. Performing string scan.... 00001150: ? 00001190: vk f AppInit_ 000011D0  LLs G vk UDeviceNotSelectedTimeout00001210: 1 5 ( W 9 0 ! vk ' zGDIProce 00001250:ssHandleQuota" vk Spooler2 y e s 00001290: 0 ` vk =pswapdisk vk 000012D0: R TransmissionRetryTimeout 0 ` 00001310: vk ' P USERProcessHandleQuota 00001350: 00001390: 000013D0: 00001410: 00001450: 00001490: 000014D0: 00001510: 00001550: 00001590: 000015D0: ---------- WIN.TXT fAppInit_DLLs֍G -------------- -------------- $011C8: AppInit_DLLs $011F7: UDeviceNotSelectedTimeout $01247: zGDIProcessHandleQuota $012E0: TransmissionRetryTimeout $01330: USERProcessHandleQuota -------------- -------------- No strings found. -------------- -------------- REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 A handle was successfully obtained for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key. This key has 0 subkeys. The AppInitDLLs value exists and reports as 2 bytes, including the 2 for string termination. [AppInitDLLs] Ansi string : "" 0000 00 00 | .. |
20-Jul-2004, 06:48 PM
#8 | |||||||
21-Jul-2004, 06:28 PM
#10 | |||||||
| Very trim scanlog; and since all appears well it looks like we can put a "resolved" on this  |
21-Jul-2004, 09:04 PM
#12 | |||||||
 You are most welcome! |
Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.
If you're not already familiar with forums, watch our Welcome Guide to get started.
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
