Please help, cant change homepage in IE. Log provided.

Question

whongtat 0 Newbie Poster

22 Years Ago

Logfile of HijackThis v1.98.0
Scan saved at 7:59:33 AM, on 7/6/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\GSICON.EXE
C:\WINDOWS\System32\dslagent.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\mfcwy.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\ievl32.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\steve wee\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\bqogw.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://bqogw.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://bqogw.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\bqogw.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\bqogw.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://bqogw.dll/index.html#96676
R3 - Default URLSearchHook is missing
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C2EF3E65-B610-3BA5-4D34-6D00744A449C} - C:\WINDOWS\system32\apinx.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [Microsoft Update] wumgrd.exe
O4 - HKLM\..\Run: [Windows Net Cfg ] service.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [yx] uu.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mfcwy.exe] C:\WINDOWS\system32\mfcwy.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wumgrd.exe
O4 - HKLM\..\RunServices: [Windows Net Cfg ] service.exe
O4 - HKLM\..\RunServices: [yx] uu.exe
O4 - HKCU\..\Run: [Windows Net Cfg ] service.exe
O4 - HKCU\..\Run: [Microsoft Update] wumgrd.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: Yahoo! Pool 2 -
O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - file://C:\install.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{3D4F7594-99EE-409F-850B-FE3FB4D548F4}: NameServer =

microsoft:windows-nt-2000-xp

3 Contributors
3 Replies
192 Views
18 Hours Discussion Span
Latest Post 22 Years Ago Latest Post by crunchie

Dani AI

Generated 6 Months Ago

The HijackThis output is consistent with a homepage hijacker: Internet Explorer is being redirected to a local resource, an unnamed BHO is present and there are multiple non-standard Run/RunServices entries plus external DNS servers. This looks like persistence (files + registry + services) rather than a simple browser setting glitch. and are on the right track with stopping the infection before changing IE settings permanently.

Safe, orderly cleanup sequence (notes and priorities):

Create a full System Restore point and export the registry (Regedit -> File -> Export) before any edits. Back up the Hosts file and important personal data.
Reboot to Safe Mode for file removal. Stop suspicious processes and disable unknown services first so files can be deleted cleanly.
After manual removals, run network and system repairs using the Windows command-line utilities shown below, then reboot normally:

ipconfig /flushdns
netsh winsock reset
sfc /scannow

Follow-up checks and hardening:

Verify TCP/IP DNS entries and set them to the ISP defaults or known-good public DNS if the log shows third-party name servers.
Confirm IE has no proxy set and reset IE’s configuration to defaults (Advanced reset) once the infection is removed.
Run one or two up-to-date on-demand scanners (for example, a reputable anti-malware and an on-demand online scanner) to catch leftovers and re-check for unnamed BHOs and Run keys.

Final items: change all passwords after cleanup, monitor for reappearance (persistence indicates deeper compromise), and if the infection persists or re-creates entries, prepare to image/backup data and perform a clean OS reinstall. Post an updated HijackThis scan after the above steps if clarification is needed; reference what was stopped/removed and which scanners were run.

All 3 Replies

alc6379 120 Cookie... That's it

22 Years Ago

Have you tried the solutions in this thread?
http://daniweb.com/techtalkforums/thread7507.html

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

whongtat 0 Newbie Poster · Answer 1 · 2004-07-06T18:33:58+00:00

This there nothing wrong with the log?
res://bqogw.dll/index.html#96676 keeps appearing as the homepage and i thought something's wrong with the log.
NOt yet tried the solution thou.

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 2 · 2004-07-06T18:42:54+00:00

Try this:

1. Tools | Internet Options - General tab - Home page section
2. Change Address to «about:blank»
3. Click Apply then OK
4. Restart IE
5. Reset your homepage & click apply, then ok.

If that doesn't work, do this:

Make sure your settings allow you to view "Hidden files" & "hide protected operating system files" is unchecked. Open up any explorer windows and click on "Tools" => "Folder Options" => "View" and be sure to check off "Show Hidden Files and Folders".
Press Ctrl+Alt+Delete once => Click Task Manager => Click the Processes tab => Double-click the Image Name column header to alphabetically sort the processes => Scroll through the list and look for "mfcwy.exe" & "ievl32.exe". If you find the files, click on them, and then click End Process => Exit the Task Manager.
Next, go to Start->Run and type "Services.msc" (without quotes) then hit OK.
Scroll down and find the service called "Network Security Service".
When you find it, double-click on it. In the next window that opens, click the Stop button, then change the Startup Type to Disabled. Now hit Apply and then OK and close any open windows.
Run HijackThis, click on "Scan" and then place a check mark in the following boxes, And click on "Fix Checked":
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\bqogw.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://bqogw.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://bqogw.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\bqogw.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\bqogw.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://bqogw.dll/index.html#96676
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {C2EF3E65-B610-3BA5-4D34-6D00744A449C} - C:\WINDOWS\system32\apinx.dll
O4 - HKLM\..\Run: [Microsoft Update] wumgrd.exe
O4 - HKLM\..\Run: [Windows Net Cfg ] service.exe
O4 - HKLM\..\Run: [yx] uu.exe
O4 - HKLM\..\Run: [mfcwy.exe] C:\WINDOWS\system32\mfcwy.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wumgrd.exe
O4 - HKLM\..\RunServices: [Windows Net Cfg ] service.exe
O4 - HKLM\..\RunServices: [yx] uu.exe
O4 - HKCU\..\Run: [Windows Net Cfg ] service.exe
O4 - HKCU\..\Run: [Microsoft Update] wumgrd.exe
O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - file://C:\install.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
Reboot into Safe Mode - , and delete the following files:
C:\WINDOWS\system32\bqogw.dll
C:\WINDOWS\system32\apinx.dll
C:\WINDOWS\system32\mfcwy.exe
C:\WINDOWS\ievl32.exe
Reboot in Normal Mode.
Download the file attached to this post and rename it to cwsuninst.reg
Doubleclick it and confirm you want to merge it with the registry.
Run HijackThis again and post a new log.
File Attachment
Extra notes
If given full internet access this variant will delete:
- your hosts file (good replacements can be found here or here )
- Spybot S&D's BHO (download SDHelper.dll, put it in the Spybot folder (default is: C:\Program Files\Spybot - Search & Destroy\) and click Start > Run > regsvr32 "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" > OK
- control.exe: follow instructions here: http://www.spywareinfo.com/~merijn/...es.html#control
Go here for an on-line scan & set it to autoclean for you.
Try this scan as well.

Please help, cant change homepage in IE. Log provided.

Dani AI

Recommended Answers Collapse Answers

All 3 Replies

Recommended Answers