[Resolved] Home Page never stays

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

DrewB74

Thread Starter
Joined
Jan 27, 2003
Messages
4
Every time I restart the computer the home page for the internet is re set to http://www.kogalu.com/sou/internz/enter3.htm, I have never heard of this and it always wants to go there. When it does it d/l's a dialer that changes the defautl dail up conetion, and pust xxxdailer icons in start and on desk top, try to delete them and they come back. I have to change the properties of mt dial up conection every time to a serch engine before dialing or else it takes over again. ? Any help would b great.

Thanks:D
 
Joined
Oct 9, 2001
Messages
9,396
wellcome to T.S.G drew.

you can run "startuplist" from within "highjackthis"....no need to download it.

cheers;)
 

TonyKlein

Malware Specialist
Joined
Aug 26, 2001
Messages
10,392
As for Hijack This, please don't have it fix stuff right away, as most of the items you'll see are legit.

Do this:


Download, unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log somewhere, and please show us its contents.

Someone here will be happy to help you analyze the results.
 

DrewB74

Thread Starter
Joined
Jan 27, 2003
Messages
4
Hope u can help
This is realy getting a problem, have to go through so much to get on-line with out getting the xxx dial turning up?? Don't know were it comes from.?
Thanks

Logfile of HijackThis v1.91.2
Scan saved at 9:28:18 AM, on 31/01/2003
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\PROGRAM FILES\DAP\DAPBHO.DLL
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [EPSON Stylus C41 Series] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C41 Series" /O7 "EPUSB1:" /M "Stylus C41"
O4 - HKLM\..\Run: [explorer] wscript.exe C:\WINDOWS\fotompg.vbs %
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [HistoryKill] C:\Program Files\HistoryKill\histkill.exe /startup
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: Run DAP (HKLM)
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC898} - http://www.kogalu.com/sou/internz/girls.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
 

TonyKlein

Malware Specialist
Joined
Aug 26, 2001
Messages
10,392
OK, here ya go:

Run Hijack This, and check ALL of the items in bold. Doublecheck so as to be sure not to miss a single one.
Next, shut down all Internet Explorer Windows, and have HT fix all checked.

Now go to Control Panel > Internet (Options) > Temporary Internet Files, and press "delete files".
Next, go to the Programs tab, and press 'Reset Web Settings'

Reboot when you're done.

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://urawa.cool.ne.jp/erayasu/pucchi/gol.htm

O4 - HKLM\..\Run: [explorer] wscript.exe C:\WINDOWS\fotompg.vbs %

O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC898} - http://www.kogalu.com/sou/internz/girls.exe


Good luck,
 
Joined
Jul 18, 2000
Messages
221
Warning...please don't click on that kogalu.com link at the bottom. Girls.exe was flagged by eTrust as Win32.DlFeer trojan.
 
Joined
Jul 18, 2000
Messages
221
Ermmm...looks like it won't download anyway - "Access Denied" message. Rats, I was hoping to get a copy to see what it does. ;)
 

TonyKlein

Malware Specialist
Joined
Aug 26, 2001
Messages
10,392
BTW, the fotompg.vbs startup I had you uncheck is a baddie as well, and it was likely installed by the Girls.exe thingie.

Go to C:\Windows, and delete fotompg.vbs
 

DrewB74

Thread Starter
Joined
Jan 27, 2003
Messages
4
Thanks for that it seems to b all gone, you guys are great.
killed the vbscript too thatnks again:D
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top