Please Help A Newbie with homepage hijacking

Reply

Join Date: Aug 2004
Posts: 11
Reputation: legenddriverc is an unknown quantity at this point 
Solved Threads: 0
legenddriverc legenddriverc is offline Offline
Newbie Poster

Please Help A Newbie with homepage hijacking

 
0
  #1
Aug 30th, 2004
Hello I am having a problem wit IE. When I open it up, My homepage gets redirected to windows.cc(I don't know the whole thing, but i can get it when I get home today) and I get a window that pops up about spyware. I have ran adaware and spybot several times, but this has not helped.It seeems like everytime I run these programs they find something I see posts about hijack this, should I try that program? Thanks in advance for any help
Reply With Quote Quick reply to this message  
Join Date: May 2004
Posts: 1,478
Reputation: mikeandike22 is an unknown quantity at this point 
Solved Threads: 18
mikeandike22's Avatar
mikeandike22 mikeandike22 is offline Offline
Nearly a Posting Virtuoso

Re: Please Help A Newbie

 
0
  #2
Aug 30th, 2004
yes get hijackthis shut down any browser windows then scan. Click save log and post the log here.
here is a good place to download hijack this
http://www.spychecker.com/program/hijackthis.html
My Daniweb Blog: This,That, and Everything Else (Blog contest winner)

GetFirefox!
GetOpera!






Reply With Quote Quick reply to this message  
Join Date: Aug 2004
Posts: 11
Reputation: legenddriverc is an unknown quantity at this point 
Solved Threads: 0
legenddriverc legenddriverc is offline Offline
Newbie Poster

Re: Please Help A Newbie

 
0
  #3
Aug 30th, 2004
Originally Posted by mikeandike22
yes get hijackthis shut down any browser windows then scan. Click save log and post the log here.
here is a good place to download hijack this
http://www.spychecker.com/program/hijackthis.html
thank you I will do this as soon as I get home tonight
Reply With Quote Quick reply to this message  
Join Date: Aug 2004
Posts: 11
Reputation: legenddriverc is an unknown quantity at this point 
Solved Threads: 0
legenddriverc legenddriverc is offline Offline
Newbie Poster

Re: Please Help A Newbie with homepage hijacking

 
0
  #4
Aug 30th, 2004
this is what came up

Logfile of HijackThis v1.97.7
Scan saved at 6:12:16 PM, on 8/30/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\program files\mcafee.com\vso\mcvsshld.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-us\msnappau.exe
C:\Program Files\WinMX\WinMX.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\gcfzzkheujp.exe
C:\WINDOWS\System32\8d2mo5ybwxr4xj.exe
C:\WINDOWS\System32\gcfzzkheujp.exe
C:\WINDOWS\System32\gcfzzkheujp.exe
C:\WINDOWS\System32\gcfzzkheujp.exe
C:\WINDOWS\System32\gcfzzkheujp.exe
C:\Documents and Settings\Corey\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowws.cc/hp.htm?id=9
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\ct9ucsvy44.dll
O3 - Toolbar: &Search - {3F5A62E2-51F2-11D3-A075-CC7364CAE42A} - C:\WINDOWS\System32\jfi.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.2001.0001\en-us\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\program files\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Online Service] C:\WINDOWS\msreg.exe
O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\win.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe
O4 - HKLM\..\Run: [pnpsvc_lock] C:\WINDOWS\System32\25587401.exe
O4 - HKLM\..\Run: [TmybfCTiM] C:\documents and settings\corey\local settings\temp\TmybfCTiM.exe
O4 - HKLM\..\Run: [Network Security Guard] C:\WINDOWS\System32\gcfzzkheujp.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe
O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: winlogin.exe
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O15 - Trusted Zone: *.greg-search.com
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {427273CC-764E-11D3-823D-006097F90453} (Pixami Image Editor Control) - http://www.imagestation.com/common/c...b?ver=1,1,0,32
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {B94B4225-E02E-4D3F-BADB-026F1E2F3AD7} (HttpDownloader Control) - http://www.instantplugin.com/SexDownloader.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yaho...opper1_1us.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
Reply With Quote Quick reply to this message  
Join Date: May 2004
Posts: 1,478
Reputation: mikeandike22 is an unknown quantity at this point 
Solved Threads: 18
mikeandike22's Avatar
mikeandike22 mikeandike22 is offline Offline
Nearly a Posting Virtuoso

Re: Please Help A Newbie with homepage hijacking

 
0
  #5
Aug 30th, 2004
all of these look like viruses
C:\WINDOWS\System32\gcfzzkheujp.exe
C:\WINDOWS\System32\8d2mo5ybwxr4xj.exe
C:\WINDOWS\System32\gcfzzkheujp.exe
C:\WINDOWS\System32\gcfzzkheujp.exe
C:\WINDOWS\System32\gcfzzkheujp.exe
C:\WINDOWS\System32\gcfzzkheujp.exe
set a system restore point and then open up the task manager end those processes(make sure that they dont restart) then delete them.

fix these item (unless you know what the are)
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART *(this means that you probably have illegal p2p software like kazaa intsalled on your pc i would look out for that)*
O4 - HKLM\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe *(never heard of it but sounds suspicous)*
O4 - HKLM\..\Run: [pnpsvc_lock] C:\WINDOWS\System32\25587401.exe
O4 - HKLM\..\Run: [TmybfCTiM] C:\documents and settings\corey\local settings\temp\TmybfCTiM.exe
O4 - HKLM\..\Run: [Network Security Guard] C:\WINDOWS\System32\gcfzzkheujp.exe
O4 - HKCU\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {B94B4225-E02E-4D3F-BADB-026F1E2F3AD7} (HttpDownloader Control) - http://www.instantplugin.com/SexDownloader.cab

make sure you make a restore point or backup before trying to fix these just in case it doesnt work.
My Daniweb Blog: This,That, and Everything Else (Blog contest winner)

GetFirefox!
GetOpera!






Reply With Quote Quick reply to this message  
Join Date: Aug 2004
Posts: 11
Reputation: legenddriverc is an unknown quantity at this point 
Solved Threads: 0
legenddriverc legenddriverc is offline Offline
Newbie Poster

Re: Please Help A Newbie with homepage hijacking

 
0
  #6
Aug 30th, 2004
thanks I will try it right now
Reply With Quote Quick reply to this message  
Join Date: Aug 2004
Posts: 11
Reputation: legenddriverc is an unknown quantity at this point 
Solved Threads: 0
legenddriverc legenddriverc is offline Offline
Newbie Poster

Re: Please Help A Newbie with homepage hijacking

 
0
  #7
Aug 30th, 2004
ok I did it but it did not help my homepage still comes in as http://www.windowws.cc/hp.htm?id=9 an then switches to http://296f8.ilxt.info/index.php?aid=20009 and then I get the your computer has spyware pop up
Reply With Quote Quick reply to this message  
Join Date: Aug 2004
Posts: 11
Reputation: legenddriverc is an unknown quantity at this point 
Solved Threads: 0
legenddriverc legenddriverc is offline Offline
Newbie Poster

Re: Please Help A Newbie with homepage hijacking

 
0
  #8
Aug 30th, 2004
and now when my computer starts it says it is missing parts of McAfee and I did the restore already
Reply With Quote Quick reply to this message  
Join Date: Aug 2004
Posts: 11
Reputation: legenddriverc is an unknown quantity at this point 
Solved Threads: 0
legenddriverc legenddriverc is offline Offline
Newbie Poster

Re: Please Help A Newbie with homepage hijacking

 
0
  #9
Aug 31st, 2004
Also my aol stopped working now and It won't let me reinstall and it says missing idleproc.dll missing
Reply With Quote Quick reply to this message  
Join Date: May 2004
Posts: 1,478
Reputation: mikeandike22 is an unknown quantity at this point 
Solved Threads: 18
mikeandike22's Avatar
mikeandike22 mikeandike22 is offline Offline
Nearly a Posting Virtuoso

Re: Please Help A Newbie with homepage hijacking

 
0
  #10
Aug 31st, 2004
well if you took my advice then u should of created a restore point or backup of files so open system restore and restore back to the place where you performed the scan. Did you also check into having illegal p2p programs on your computer like kazaa, imesh, grokster, andd things like tha because usually those a re back with malware.
My Daniweb Blog: This,That, and Everything Else (Blog contest winner)

GetFirefox!
GetOpera!






Reply With Quote Quick reply to this message  
Reply

This thread is more than three months old.
Perhaps start a new thread instead?
Message:



Other Threads in the Viruses, Spyware and other Nasties Forum
Thread Tools Search this Thread



About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC