Member Avatar for ask0500

Hi,
my internet explorer - when i open it - previously it used to go to a search page ( because of adware) and then go to my homepage. After that today i ran spy sweeper to sweep off the adware and..after that i guess it removed teh link from adware to homepage..so now whenever i open a page..it goes to nothing
i deleted explorer, and got a new IE6 pack but not working..i downloaded Hijack This . Here are my scan results. Could anybody help me in figuring out whats wrong with my explorer?


Logfile of HijackThis v1.97.7
Scan saved at 11:13:19 AM, on 9/29/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Command Software\Command AntiVirus\avinitnt.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\ngsrv.exe
C:\Program Files\Command Software\Command AntiVirus\schscnt.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\COMMAN~1\COMMAN~1\untray.exe
C:\PROGRA~1\COMMAN~1\COMMAN~1\dvprpt.exe
C:\PROGRA~1\COMMAN~1\COMMAN~1\avtray.exe
C:\WINDOWS\System32\KsdkCORE.exe
C:\WINDOWS\PASSCFG16.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\InterVideo\WinDVR\WinScheduler.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\Documents and Settings\Ayalasomayajula\Desktop\shiva\ftp\HijackThis.exe
C:\WINDOWS\regedit.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.tnstate.edu
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.tnstate.edu
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no

file)
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: adwave.com
O1 - Hosts: www.xzoomy.com
O1 - Hosts: xzoomy.com
O1 - Hosts: www.advnt01.com
O1 - Hosts: advnt01.com
O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - (no

file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program

files\Adobe\Acrobat Reader 5\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ohb - {4D568F0F-8AC9-40AB-88B7-415134C78777} -

C:\WINDOWS\SYSTEM32\winb2s32.dll
O2 - BHO: (no name) - {6F8E442E-9245-0EE1-D755-16550FA92A34} - (no file)
O2 - BHO: (no name) - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -

C:\WINDOWS\System32\nvms.dll
O2 - BHO: (no name) - {CE188402-6EE7-4022-8868-AB25173A3E14} -

C:\WINDOWS\System32\mscb.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} -

C:\Documents and Settings\Ayalasomayajula\Local Settings\Temp\t.dll
O2 - BHO: (no name) - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} -

C:\WINDOWS\System32\msbe.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Begin2Search.com Bar - {52FE5233-367C-4EFB-BDD7-0BE4D212C107}

- C:\WINDOWS\SYSTEM32\winb2s32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog

Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel(R) Active

Monitor\imontray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [untray] C:\PROGRA~1\COMMAN~1\COMMAN~1\untray.exe
O4 - HKLM\..\Run: [dvprpt] C:\PROGRA~1\COMMAN~1\COMMAN~1\dvprpt.exe
O4 - HKLM\..\Run: [CSAV_CheckViruses] C:\PROGRA~1\COMMAN~1\COMMAN~1\vchk.exe
O4 - HKLM\..\Run: [avtray] C:\PROGRA~1\COMMAN~1\COMMAN~1\avtray.exe
O4 - HKLM\..\Run: [MSN service] KsdkCORE.exe
O4 - HKLM\..\Run: [Windows System Configuration] C:\WINDOWS\PASSCFG16.EXE
O4 - HKLM\..\Run: [Windows DLL Loader] C:\WINDOWS\PASSCFG16.EXE
O4 - HKLM\..\Run: [Microsoft DNS Query] msdns.exe
O4 - HKLM\..\RunServices: [MSN service] KsdkCORE.exe
O4 - HKLM\..\RunServices: [Win32 System Spool] spoolsvc.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] winupdate.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"

/background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program

Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: InterVideo WinScheduler.lnk = C:\Program

Files\InterVideo\WinDVR\WinScheduler.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel

present
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tnstate.edu
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller

Control) - http://www.35mb.com/applet.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FCF289D4-0AC8-4ED8-BE31-E8AF09606AB5} (download_35mb_com.applet)

- http://www.35mb.com/downloadapplet.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain =
O17 - HKLM\Software\..\Telephony: DomainName =
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain =
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain =

  • 3 Contributors
  • 2 Replies
  • 309 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by dlh6213

Dani AI

Generated

Short diagnosis: the HijackThis output from is typical of a partial adware removal — the adware binary was removed but IE is still configured to call the removed component (search/home hooks), the hosts file contains redirects, and there are leftover BHOs/startup entries. That combination explains the blank page on startup: IE is trying to load something that no longer exists.

Action plan (in order):

  1. Make a full backup and export the IE-related registry keys before changing anything (use Regedit -> File -> Export).
  2. Clean the hosts file: open it in Notepad and remove every line that redirects normal domains to an IP (leave only comments/default localhost lines). Example:
    notepad %windir%\system32\drivers\etc\hosts
ipconfig /flushdns
  3. Repair IE settings: set a known-good homepage in Tools -> Internet Options -> General. If the search/home settings are stubborn, export the IE keys in both HKCU and HKLM, then remove or edit any search/startup values that reference missing files or odd URLs.
  4. Remove persistent BHOs/toolbars/startup entries: run the latest HijackThis (as @deonnanicole advised) and examine O2/O3/O4 entries — remove only items that point to missing files, Temp locations, or show as "no name". For a deeper view use Autoruns (Sysinternals) to disable suspicious autostart entries.
  5. Scan again offline/safer mode with updated AV + anti-malware (Spybot/Ad-aware/Malwarebytes), reboot and retest.

Extra notes: check Tools -> Internet Options -> Connections -> LAN Settings for an unwanted proxy; use msconfig/services.msc to review unknown services and scheduled tasks. If many critical system files or services are altered, consider an OS repair or clean reinstall after saving personal data. As pointed out, apply Windows updates to reduce re-infection risk.

If uncertainty remains, post a fresh HijackThis log (run from its own folder with browsers closed) plus the cleaned hosts file contents so the remaining entries can be reviewed.

Recommended Answers

All 2 Replies

Member Avatar for deonnanicole

Hi!:) First off, if you haven't done so already, scan with Adaware and Spybot (reboot between each), and let them fix what they find. Also, you need to update hijackthis to version 1.98.2. After scanning and rebooting with Adaware and Spybot, scan again with the newer hijackthis and post a fresh log. :)

Member Avatar for dlh6213

You need to go to Windows Update and get all the critical updates, that may help prevent some of the stuff you are getting (you don't even have SP1 yet).

Also, you are running HJT from your desktop, it should be put in it's own folder (like c:\hjt\hijackthis.exe). You can then put a shortcut to it on your desktop for easy access if you like.

One more thing, before scanning with HJT, close all open browser windows.

You can get the latest version of HJT from here:
http://www.softpedia.com/progDownlo...nload-5034.html

Another thing that will help prevent intrusions is SpywareBlaster, you can get it from here:
http://www.javacoolsoftware.com/
Update it right after you get it, then have it enable all protection.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.