1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

[Resolved] Home Page never stays

Discussion in 'Virus & Other Malware Removal' started by DrewB74, Jan 27, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. DrewB74

    DrewB74 Thread Starter

    Joined:
    Jan 27, 2003
    Messages:
    4
    Every time I restart the computer the home page for the internet is re set to http://www.kogalu.com/sou/internz/enter3.htm, I have never heard of this and it always wants to go there. When it does it d/l's a dialer that changes the defautl dail up conetion, and pust xxxdailer icons in start and on desk top, try to delete them and they come back. I have to change the properties of mt dial up conection every time to a serch engine before dialing or else it takes over again. ? Any help would b great.

    Thanks:D
     
  2. rugrat

    rugrat

    Joined:
    Dec 16, 2001
    Messages:
    1,869
  3. $teve

    $teve

    Joined:
    Oct 9, 2001
    Messages:
    9,396
    wellcome to T.S.G drew.

    you can run "startuplist" from within "highjackthis"....no need to download it.

    cheers;)
     
  4. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    As for Hijack This, please don't have it fix stuff right away, as most of the items you'll see are legit.

    Do this:


    Download, unzip, doubleclick HijackThis.exe, and hit "Scan".

    When the scan is finished, the "Scan" button will change into a "Save Log" button.
    Press that, save the log somewhere, and please show us its contents.

    Someone here will be happy to help you analyze the results.
     
  5. DrewB74

    DrewB74 Thread Starter

    Joined:
    Jan 27, 2003
    Messages:
    4
    Hope u can help
    This is realy getting a problem, have to go through so much to get on-line with out getting the xxx dial turning up?? Don't know were it comes from.?
    Thanks

    Logfile of HijackThis v1.91.2
    Scan saved at 9:28:18 AM, on 31/01/2003
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v5.50 (5.50.4134.0600)

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.google.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\PROGRAM FILES\DAP\DAPBHO.DLL
    O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
    O4 - HKLM\..\Run: [EPSON Stylus C41 Series] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C41 Series" /O7 "EPUSB1:" /M "Stylus C41"
    O4 - HKLM\..\Run: [explorer] wscript.exe C:\WINDOWS\fotompg.vbs %
    O4 - HKLM\..\Run: [CARPService] carpserv.exe
    O4 - HKLM\..\Run: [HistoryKill] C:\Program Files\HistoryKill\histkill.exe /startup
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
    O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
    O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
    O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
    O9 - Extra button: Run DAP (HKLM)
    O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC898} - http://www.kogalu.com/sou/internz/girls.exe
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
     
  6. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    OK, here ya go:

    Run Hijack This, and check ALL of the items in bold. Doublecheck so as to be sure not to miss a single one.
    Next, shut down all Internet Explorer Windows, and have HT fix all checked.

    Now go to Control Panel > Internet (Options) > Temporary Internet Files, and press "delete files".
    Next, go to the Programs tab, and press 'Reset Web Settings'

    Reboot when you're done.

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm

    O4 - HKLM\..\Run: [explorer] wscript.exe C:\WINDOWS\fotompg.vbs %

    O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC898} - http://www.kogalu.com/sou/internz/girls.exe


    Good luck,
     
  7. HKEd

    HKEd

    Joined:
    Jul 18, 2000
    Messages:
    221
    Warning...please don't click on that kogalu.com link at the bottom. Girls.exe was flagged by eTrust as Win32.DlFeer trojan.
     
  8. HKEd

    HKEd

    Joined:
    Jul 18, 2000
    Messages:
    221
    Ermmm...looks like it won't download anyway - "Access Denied" message. Rats, I was hoping to get a copy to see what it does. ;)
     
  9. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    BTW, the fotompg.vbs startup I had you uncheck is a baddie as well, and it was likely installed by the Girls.exe thingie.

    Go to C:\Windows, and delete fotompg.vbs
     
  10. DrewB74

    DrewB74 Thread Starter

    Joined:
    Jan 27, 2003
    Messages:
    4
    Thanks for that it seems to b all gone, you guys are great.
    killed the vbscript too thatnks again:D
     
  11. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    You're welcome! :)

    Glad to hear that got rid of it.
     
  12. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - [Resolved] Home Page
  1. ated19
    Replies:
    4
    Views:
    593
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/115526

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice