Search not working right... - Page 2

Question

crunchie 990 Most Valuable Poster

19 Years Ago

That log looks ok. Which Temp folder? Sometimes you have to be in safe mode in order to totally clean it out.

DMR 152 Wombat At Large

19 Years Ago

* iahide.dll is a legitimate component of the F-Secure anti-virus package. Unfortunately, some anti-spyware programs mis-detect the file as a threat.

* Files beginning with a tilde (~) are usually temporary or backup files created by a program or process. They usually get deleted automatically on reboot or when the creating program terminates, and will be "in use" and therefore undeletable until such time. Occasionally (during a program/system crash for example) they don't get properly deleted; give the system a reboot and see if the file goes away.

DMR 152 Wombat At Large

19 Years Ago

"it went away"? Do you mean that it wasn't there when you booted into safe mode, or that it was, but it "disappeared" when you tried the test deletetion?

If the file simply wasn't there when you booted into safe mode, see if it is when you boot normally.

Here's a little more info on iahide.dll from F-Secure:

http://www.f-secure.com/v-descs/iadhide.shtml

DMR 152 Wombat At Large

19 Years Ago

If you're not using the F-Secure AV program, you're probably OK.

The file is part of F-Secure's automatic virus definition update mechanism, so if you do use F-Secure, you'll want to restore it; the link I gave you above tells you how.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

fitchfrog19 0 Junior Poster in Training · Answer 1 · 2004-05-03T21:12:40+00:00

:) :) :) :) :) THANK YOU SOOOOOOOOOOO MUCH... is there anything i should do with the ad aware or spyware or hijack this anymore?!?! should i just leave them on my computer??? should i do them every once in a while??? [even though i wouldnt have any idea what to delete or fix... hahah :o ]

fitchfrog19 0 Junior Poster in Training · Answer 2 · 2004-05-03T21:33:49+00:00

is there anyway you can show me what the link said about 'So how did I get infected to start with'??? it just keeps saying cannot find server :sad:

fitchfrog19 0 Junior Poster in Training · Answer 3 · 2004-05-04T00:32:17+00:00

today everytime i shut my moniter offf (which i usually do when im not at my computer) my AIM messanger signs off... and its been acting up a lot today... does this have something to do with me fixing everything the last couple days or do you think its just my internet connection? (i have cable) i know its a stupid question but i have no idea...

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 4 · 2004-05-04T17:24:05+00:00

With AIM, we never deleted anything relating to it so I don't think it is spyware related. Maybe you can check the user settings? I don't have it myself so cannot give any advise on how to.
In regards to the link, I have copied & pasted it.

You usually get infected because your security settings are too low.

Here are a number of recommendations that will help tighten them, and which will contribute to making you a less likely victim:

1) Watch what you download!
Many freeware programs, and P2P programs like Grokster, Imesh, Kazaa and others are amongst the most notorious, come with an enormous amount of bundled spyware that will eat system resources, slow down your system, clash with other installed software, or just plain crash your browser or even Windows itself.

2) Go to IE > Tools > Windows Update > Product Updates, and install ALL Security Updates listed.
It's important to always keep current with the latest security fixes from Microsoft.
Install those patches for Internet Explorer, and make sure your installation of Java VM is up-to-date. There are some well known security bugs with Microsoft Java VM which are exploited regularly by browser hijackers.

3) Go to Internet Options/Security/Internet, press 'default level', then OK.

Now press "Custom Level."

In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to 'prompt', and 'Initialize and Script ActiveX controls not marked as safe" to 'disable'.

Now you will be asked whether you want ActiveX objects to be executed and whether you want software to be installed.
Sites that you know for sure are above suspicion can be moved to the Trusted Zone in Internet Option/security.

So why is activex so dangerous that you have to increase the security for it?
When your browser runs an activex control, it is running an executable program. It's no different from doubleclicking an exe file on your hard drive.
Would you run just any random file downloaded off a web site without knowing what it is and what it does?

And some more advice:

4) Install Javacool's SpywareBlaster

It will protect you from all spy/foistware in it's database by blocking installation of their ActiveX objects.

Download and install, download the latest updates, and you'll see a list of all spyware programs covered by the program (NOTE: this is NOT spyware found on your computer)
Press "select all", then "kill all checked", and you're done.
The spyware that you told Spywareblaster to set the "kill bit" for won't be a hazard to you any longer.
Although it won't protect you from every form of spyware known to man, it is a very potent extra layer of protection.
Don't forget to check for updates every week or so.

There's a board at Wilderssecurity as well.

Let's also not forget that SpyBot Search and Destroy has the Immunize feature which works roughly the same way.
It can't hurt to use both.

5) Another brilliant program by Javacool we recommend is SpywareGuard.
It provides a degree of real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method.

An anti-virus program scans files before you open them and prevents execution if a virus is detected - SpywareGuard does the same thing, but for spyware! And you can easily have an anti-virus program running alongside SpywareGuard.
It now also features Download Protection and Browser Hijacking Protection!

6) IE-SPYAD puts over 5000 sites in your restricted zone, so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
http://www.staff.uiuc.edu/~ehowes/resource.htm#IESPYAD

Incidentally, another site with an enormous amount of information on computer security, and which is well worth a visit is http://www.wilders.org/

DMR 152 Wombat At Large Team Colleague · Answer 5 · 2004-05-05T01:46:01+00:00

Moving to the Security forum, as this is a spyware/malware issue. :)

fitchfrog19 0 Junior Poster in Training · Answer 6 · 2004-05-09T14:28:29+00:00

i just had my normal virus scanner which scans every night @ 2am tell me i had another trojan horse virus that couldnt be removed from my computer (like when it asks you to fix it... this one tells you you cant fix this virus...) what is this? what can i do??? i thought i was all set... :(

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 7 · 2004-05-09T14:55:00+00:00

crunchie 990 Most Valuable Poster

19 Years Ago

If it has been quarintined, just delete it.

fitchfrog19 0 Junior Poster in Training · Answer 8 · 2004-05-10T12:28:20+00:00

:cry: :cry: :cry: :cry: :cry: :cry: :cry: :cry: :cry: :cry: i hate my computer lately

fitchfrog19 0 Junior Poster in Training · Answer 9 · 2004-05-10T12:31:00+00:00

i cant quarantine it... i tried using adware last time i told you about this... and it found some new things so i quarantined them and deleted them and now this virus scanner said the trojan horse is back now... please help!!! :cry:

fitchfrog19 0 Junior Poster in Training · Answer 10 · 2004-05-10T12:32:47+00:00

c:\_restore\temp\a0000350.cpy IS BACK... it comes up when my computer scans everynite for viruses... it says it is a TROJAN HORSE REVOP.C & my virus scanner says it cannot be removed or even moved to the virus vault when the option comes up to remove it...

what do i do???? this stupid trojan horse thing in my c:\_restore\temp\a0000350.cpy (the last 3 numbers always change) has been on my computer for a while...

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 11 · 2004-05-10T12:49:04+00:00

you will have to go through the system restore steps again. Turn off system restore, scan for virus', post a log from hjt, empty your temp folders, set new restore point.

fitchfrog19 0 Junior Poster in Training · Answer 12 · 2004-05-10T21:23:29+00:00

oh boy... okay i will do all of this tonight when i get out of work @ midnight & post it for you... did i do something wrong last time & that is why the trojan horse is back (or still on here?) :o

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 13 · 2004-05-10T22:05:45+00:00

Sometimes it's the sites that you visit, email attachments, a good firewall should keep them under control.

fitchfrog19 0 Junior Poster in Training · Answer 14 · 2004-05-17T09:35:47+00:00

:rolleyes: should i be saving all the HJT logs... the extra folder things in the folder with the HJT icon???? just wondering... here is the new log... is there anything wrong????

Logfile of HijackThis v1.97.7
Scan saved at 11:42:30 PM, on 5/16/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\PROGRAM FILES\MOTIVE\MOTMON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\OPTIONS\CABS\LOGITECH\HP_FINDER.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\WINDOWS\SYSTEM\PRINTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BACKWEB.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\DESKTOP\HJT\HIJACKTHIS1977\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hp.my.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Delay] C:\WINDOWS\delayrun.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [DJRegFix] regedit /s c:\hp\djregfix.reg
O4 - HKLM\..\Run: [HPLogiFinder] \WINDOWS\OPTIONS\CABS\LOGITECH\HP_FINDER.EXE
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://hp.my.yahoo.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38039.3870833333
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab

fitchfrog19 0 Junior Poster in Training · Answer 15 · 2004-05-17T09:39:27+00:00

also when i try to delete about 26 things in my temp folder, it wont let me... i deleted all the cookies & temporary internet files...

fitchfrog19 0 Junior Poster in Training · Answer 16 · 2004-05-18T01:42:23+00:00

the one in C then in WINDOWS... its called TEMP... it has the cookies folder in it, the history folder in it and the temporary internet files in it... the a bunch of wierd things too... it wont let me delete all the wierd things one is called ~df2f53.temp and one is called iadhide.dll should i go into safe mode and delete these two???

fitchfrog19 0 Junior Poster in Training · Answer 17 · 2004-05-18T02:14:24+00:00

woops!!! the one with the ~ was gone when i rebooted in safe mode, and when i went to delete the iadhide one... just to see if it would let me delete... it went away... will i have to reinstall something now?? bc when i rebooted normally i set my system restore back on and created a new restore point......

fitchfrog19 0 Junior Poster in Training · Answer 18 · 2004-05-18T10:58:29+00:00

i meant that in safe mode [which i went into b4 i saw your response that it was ok] i tried to delete it & it deleted... but i couldnt find it in the recycle bin to restore it...... so i just rebooted into normal mode... and i couldnt do anything to bring it back....

is it bad that i deleted it?!?!

fitchfrog19 0 Junior Poster in Training · Answer 19 · 2004-05-19T01:05:52+00:00

i use AVG anti-virus checker, it does it every nite @ 2am...

fitchfrog19 0 Junior Poster in Training · Answer 20 · 2004-05-19T01:11:56+00:00

i went to the AVG and updated my scanner, now when i looked in temp, it had iadhide back... thanks!!!!! i also downloaded some vcleaner.exe from their website, it says to reboot in safe mode and use it to clean a computer, do you think i should try it, or will i be ok (according to my log)

Logfile of HijackThis v1.97.7
Scan saved at 3:18:54 PM, on 5/18/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\PROGRAM FILES\MOTIVE\MOTMON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\OPTIONS\CABS\LOGITECH\HP_FINDER.EXE
C:\WINDOWS\SYSTEM\PRINTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BACKWEB.EXE
C:\PROGRAM FILES\AIM\AIM.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\PROGRAM FILES\AIM+\AIM+.EXE
C:\PROGRAM FILES\AIM\AIM95_C0\AIM.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\DESKTOP\HJT\HIJACKTHIS1977\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hp.my.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Delay] C:\WINDOWS\delayrun.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [DJRegFix] regedit /s c:\hp\djregfix.reg
O4 - HKLM\..\Run: [HPLogiFinder] \WINDOWS\OPTIONS\CABS\LOGITECH\HP_FINDER.EXE
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://hp.my.yahoo.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38039.3870833333
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab

Rooster6975 0 Newbie Poster · Answer 21 · 2004-06-08T17:23:00+00:00

Hello,

I know all about your problem because I had it as well. It is caused by a particularly annoying Trojan Horse called QHosts. More information is to be found here : http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html

Now oddly enough, I am pointing you to a Symantec site, yet I have Norton AntiVirus installed, updated, and running, yet it did not detect my infection. All of the things you are doing on your computer are admirable, you will most certainly expunge anything spyware/virus related, however if you want to get to the root of the problem, simply follow the very first step CRUNCHIE advised you to do : "First of all you need to flush your system restore to get rid of the virus. Switch off system restore (Note that a new one will be created from here on & you will lose all previous restore points) & Go here for an on-line scan & set it to autoclean for you."

Well ok, the second thing since you did not have RESTORE enabled (neither did I for that matter). The online version of TrendMaster HouseCall found and killed the Trojan.QHosts.A trojan horse. When I rebooted, for the first time in ages, I was able to use my Google toolbar again.

I am absolutely convinced justtemplates.com is putting that trojan horse out themselves. It redirects your browser to their terrible search engine, while pretending they are the good guys. You can search in google using their referral search, but they get credited with the referral. If you use their search engine which your eye is naturally drawn to because it is the only white dialog box on the screen, you end up with nothing that matches your search criteria. Nothing at all. You are just given many junk sites selling crap on the Internet. Try it. Put in anything, for instance Volvo. The justtemplates.com search engine will try to sell you a diploma from a non-accredited university.

Thanks for the reply CRUNCHIE, it solved my problem.

R.