[Resolved] Home Page never stays

[DrewB74]

Every time I restart the computer the home page for the internet is re set to http://www.kogalu.com/sou/internz/enter3.htm, I have never heard of this and it always wants to go there. When it does it d/l's a dialer that changes the defautl dail up conetion, and pust xxxdailer icons in start and on desk top, try to delete them and they come back. I have to change the properties of mt dial up conection every time to a serch engine before dialing or else it takes over again. ? Any help would b great.

Thanks

 

[rugrat]

You have been hijacked. Go here

http://www.spywareinfo.com/articles/hijacked/

and download and run "Hijack This" it should clean most of it up. Then go here, http://www.lurkhere.com/~nicefiles/index.html

and download, spybot search and destroy, start the program , UPDATE it and run it. Then download Start up list from the same page, run that and copy and paste the results here so we can see if anything nasty is left.

Let us know

 

[$teve]

wellcome to T.S.G drew.

you can run "startuplist" from within "highjackthis"....no need to download it.

cheers

 

[TonyKlein]

As for Hijack This, please don't have it fix stuff right away, as most of the items you'll see are legit.

Do this:


Download, unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log somewhere, and please show us its contents.

Someone here will be happy to help you analyze the results.

 

[DrewB74]

Hope u can help
This is realy getting a problem, have to go through so much to get on-line with out getting the xxx dial turning up?? Don't know were it comes from.?
Thanks

Logfile of HijackThis v1.91.2
Scan saved at 9:28:18 AM, on 31/01/2003
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\PROGRAM FILES\DAP\DAPBHO.DLL
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [EPSON Stylus C41 Series] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C41 Series" /O7 "EPUSB1:" /M "Stylus C41"
O4 - HKLM\..\Run: [explorer] wscript.exe C:\WINDOWS\fotompg.vbs %
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [HistoryKill] C:\Program Files\HistoryKill\histkill.exe /startup
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: Run DAP (HKLM)
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC898} - http://www.kogalu.com/sou/internz/girls.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

 

[TonyKlein]

OK, here ya go:

Run Hijack This, and check ALL of the items in bold. Doublecheck so as to be sure not to miss a single one.
Next, shut down all Internet Explorer Windows, and have HT fix all checked.

Now go to Control Panel > Internet (Options) > Temporary Internet Files, and press "delete files".
Next, go to the Programs tab, and press 'Reset Web Settings'

Reboot when you're done.

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm

O4 - HKLM\..\Run: [explorer] wscript.exe C:\WINDOWS\fotompg.vbs %

O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC898} - http://www.kogalu.com/sou/internz/girls.exe

Good luck,

 

[HKEd]

Warning...please don't click on that kogalu.com link at the bottom. Girls.exe was flagged by eTrust as Win32.DlFeer trojan.

 

[HKEd]

Ermmm...looks like it won't download anyway - "Access Denied" message. Rats, I was hoping to get a copy to see what it does.

 

[TonyKlein]

BTW, the fotompg.vbs startup I had you uncheck is a baddie as well, and it was likely installed by the Girls.exe thingie.

Go to C:\Windows, and delete fotompg.vbs

 

[DrewB74]

Thanks for that it seems to b all gone, you guys are great.
killed the vbscript too thatnks again

 

[TonyKlein]

You're welcome!

Glad to hear that got rid of it.