Member Avatar for malibublue101

My I.E. is being re-directed when I launch the program. My homepage has not changed, as I am only re-directed when I launch I.E. I have Run every spyware program I can find.....no solution yet. Please help. Hi-jack this log below. Thank-you for reading.


Logfile of HijackThis v1.98.2
Scan saved at 2:00:31 PM, on 10/20/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Sygatefirewall\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\avgcc32.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
D:\avgserv.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
D:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\hphmon05.exe
D:\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Mark\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Adobe\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Control Popups in Internet Explorer - {41353F8B-78CE-48A5-BE44-153ED293D192} - D:\PopupPopper\PopLib.dll
O4 - HKLM\..\Run: [SmcService] D:\SYGATE~1\smc.exe -startgui
O4 - HKLM\..\Run: [AVG_CC] D:\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] D:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "D:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [MediaFace Integration] D:\Program Files\SetHook.exe
O4 - HKCU\..\Run: [SpySweeper] "D:\Spy Sweeper\SpySweeper.exe" /0
O9 - Extra button: PopupPopper Control Panel - {3E94F358-9537-4BBA-8D12-D7F8A0136973} - D:\PopupPopper\SiteList.exe
O16 - DPF: Yahoo! Bingo -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {CE74A05D-ED12-473A-97F8-85FB0E2F479F} (dlControl.UserControl1) -
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) -
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll

  • 2 Contributors
  • 7 Replies
  • 247 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Good troubleshooting so far — covered the obvious hosts/HijackThis checks and already tried Hoster but got “file access denied.” Next steps should focus on isolating the launcher and replacing the hosts file safely.

First, check every Internet Explorer shortcut (Start menu, desktop, QuickLaunch). Right‑click → Properties and inspect the Target field: it should point only to iexplore.exe with no trailing URL or odd switches. Then test IE with add‑ons disabled: Start → Run → type
iexplore.exe -extoff
If the redirect disappears, a BHO/toolbar is causing it; disable toolbars/add‑ons one at a time (or use HijackThis to identify suspect BHOs) rather than wholesale removal.

Because Hoster reported access denied, replace the hosts file from Safe Mode (avoids file locks). Boot F8 → Safe Mode, log in as an administrator, rename C:\WINDOWS\system32\drivers\etc\hosts to hosts.old and create a fresh hosts file with only the basic entry:

# default hosts
127.0.0.1 localhost

Save that as C:\WINDOWS\system32\drivers\etc\hosts, ensure Read‑Only is cleared, and reboot to normal mode. If you cannot change permissions in normal mode, disable Simple File Sharing (Explorer → Tools → Folder Options → View) to expose the Security tab and give Administrators Full Control, or perform the replace in Safe Mode.

Also search the registry for branding strings that hijackers set (don’t edit before backing up): open regedit, export the key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main, then search for “Trusted Start Page” and “about:blank” and check for a user value named "Window Title" (that value can alter IE’s title). Remove only clearly malicious keys after exporting them.

If the problem is still present after those checks, create a new Windows user account to see whether it’s a per‑profile tweak. Keep backups of Favorites and the registry before making deletions; post an updated HijackThis log if help is still needed.

Recommended Answers

All 7 Replies

Member Avatar for crunchie

The only problem I see there is that you have hijackthis in a temp folder. If you have fixed anything before running hijackthis then posted the log I will need you to reboot, rescan with hijackthis straight away, with all instances of Internet Explorer closed & post that log.

Click My Computer, then C:\
In the menu bar, File->New->Folder.
That will create a folder named New Folder, which you can rename to "HJT" or "HijackThis". Now you have C:\HJT\ folder. Put your HijackThis.exe there, and double click to run it.

Member Avatar for malibublue101

thanks for responding. I did what you said. Here is my log.

Logfile of HijackThis v1.98.2
Scan saved at 9:35:44 PM, on 10/21/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Sygatefirewall\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\avgcc32.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
D:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\System32\RUNDLL32.exe
D:\avgserv.exe
C:\WINDOWS\System32\HPZipm12.exe
D:\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HJT\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Adobe\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Control Popups in Internet Explorer - {41353F8B-78CE-48A5-BE44-153ED293D192} - D:\PopupPopper\PopLib.dll
O4 - HKLM\..\Run: [SmcService] D:\SYGATE~1\smc.exe -startgui
O4 - HKLM\..\Run: [AVG_CC] D:\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] D:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "D:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [MediaFace Integration] D:\Program Files\SetHook.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKCU\..\Run: [SpySweeper] "D:\Spy Sweeper\SpySweeper.exe" /0
O9 - Extra button: PopupPopper Control Panel - {3E94F358-9537-4BBA-8D12-D7F8A0136973} - D:\PopupPopper\SiteList.exe
O16 - DPF: Yahoo! Bingo -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {CE74A05D-ED12-473A-97F8-85FB0E2F479F} (dlControl.UserControl1) -
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) -
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll

Member Avatar for crunchie

I still see nothing there. Download the Hoster from here. Press "Restore Original Hosts" and press "OK". Exit Program.

Member Avatar for malibublue101

Ok, I did as you said. When I try to restore original hosts, is tells me that "file access denied" :confused:

Member Avatar for crunchie

Your hosts file could possibly be read only. Go to the Hosts file and right click on it and go to properties. Should be in the system32 folder. Uncheck the *read only* box and hit apply. Then try the Hoster again.

Member Avatar for malibublue101

I had to do that to begin with. It still says the same thing. :confused: :confused:

Member Avatar for crunchie

1. Tools | Internet Options - General tab - Home page section
2. Change Address to «about:blank»
3. Click Apply then OK
4. Restart IE
5. Reset your homepage & click apply, then ok.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.