Member Avatar for kajdkb

For about a week, my home page continually changes to fuzzypc.com. I have run Ad-Aware, Spybot and AVG. Each time I run any of them, they find numerous new "threats", usually heal/clean or put into vault, etc. I have been running AVG every few hours and it still picks up a minimum of 7 threats. And the home page still changes to fuzzypc.com. I have run HiJackThis with the results as follows. Can you help please?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:31:02 PM, on 11/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC1.EXE
C:\Program Files\Genie-Soft\GBMPro8\GBMAgent.exe
C:\Program Files\Sierra Wireless Inc\3G Watcher\WaHelper.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Sierra Wireless Inc\3G Watcher\Watcher.exe
C:\Program Files\Sierra Wireless Inc\3G Watcher\SwiApiMux.exe
C:\Documents and Settings\ken\My Documents\Kenny1\downloads\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.genie-soft.com/linker/links.aspx?linkid=50&SrcID=68
O2 - BHO: (no name) - {01CD0B31-9154-45F2-9414-F5D64B74EAF6} - C:\WINDOWS\system32\wvusssq.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: 0 - {3844D88F-F2C2-4409-B9A1-9322676A141D} - C:\Program Files\Internet Explorer\qukadotal859.dll (file missing)
O2 - BHO: (no name) - {3A844AB4-970A-4381-9713-784F20C27F3D} - C:\WINDOWS\system32\hgdbc.dll (file missing)
O2 - BHO: (no name) - {57024DD0-8931-4F3C-BC8F-B210A6BC916E} - C:\Program Files\Windows NT\mexokas83122.dll (file missing)
O2 - BHO: (no name) - {96ACAB33-32F9-3C5F-DA58-4FE607F10ECD} - C:\WINDOWS\system32\kzyaaje.dll (file missing)
O2 - BHO: {69a1b6e2-db4d-0368-ff34-563bee4165f9} - {9f5614ee-b365-43ff-8630-d4bd2e6b1a96} - C:\WINDOWS\system32\xslwcsfy.dll (file missing)
O2 - BHO: (no name) - {B0FAEA97-5490-4284-AE4D-63E808E01806} - C:\Program Files\Windows NT\mexokas4444.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC1.EXE /P23 "EPSON Stylus C42 Series" /O5 "LPT1:" /M "Stylus C42"
O4 - HKLM\..\Run: [GBMPro8Agent] C:\Program Files\Genie-Soft\GBMPro8\GBMAgent.exe
O4 - HKLM\..\Run: [WatcherHelper] "C:\Program Files\Sierra Wireless Inc\3G Watcher\WaHelper.exe"
O4 - HKLM\..\Run: [Watcher3G] "C:\Program Files\Sierra Wireless Inc\3G Watcher\Watcher.exe" /minimized
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [GBMPro8Agent] C:\Program Files\Genie-Soft\GBMPro8\GBMAgent.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Videos] "C:\Program Files\laughnetwork\update.exe" /background
O4 - HKCU\..\Run: [Jinodyd] "C:\Documents and Settings\ken\My Documents\?racle\?ti2evxx.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O20 - Winlogon Notify: wvusssq - wvusssq.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O24 - Desktop Component 0: (no name) - About:Home

--
End of file - 9132 bytes


Thank you
Ken

  • 3 Contributors
  • 3 Replies
  • 104 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by kylethedarkn

Dani AI

Generated

Persistent homepage changes to fuzzypc.com are a classic browser‑hijacker symptom. has already run Ad‑Aware, Spybot and AVG without success; suggested an automated removal tool and noted that the public copy may be out of date. The infection will commonly persist by installing browser helper objects, user startup entries or by changing local DNS/hosts/router settings, so a staged, cautious cleanup is best.

Follow this prioritized workflow (do not skip the backups or isolation steps):

  • Back up bookmarks/favorites and personal files first, and create a system image or restore point. If you must download tools, do so from a clean machine and transfer them.
  • Reboot to Safe Mode (use Networking only if you need to update scanners). Run a current anti‑malware full scan (second‑opinion scanners are useful) and quarantine any detections.
  • Use an autorun/startup viewer (Sysinternals Autoruns or equivalent) to disable unknown startup items and BHOs. Do not delete on first pass—disable, reboot, then delete once stability is confirmed.
  • Inspect and clean browser shortcuts (right‑click shortcut > Properties > Target) for appended URLs, reset the browser to defaults, and clear cache/favorites if needed.
  • Check the local Hosts file and the machine/network DNS settings (router admin) for unauthorized entries.
  • If the homepage still resets, create a new Windows user account to test whether the change is per‑user. If the new profile is clean, migrate data and retire the infected profile.
  • If all else fails, back up data and do a clean OS reinstall.

ComboFix is powerful and should only be used when you have an up‑to‑date build and an experienced helper advising you; an expired or outdated copy can fail. After following the steps above, post fresh logs (current removal tool logs and a fresh HijackThis or autoruns summary) and a short list of which scanners you ran so helpers can give targeted next steps. Change passwords and update firmware/software after cleanup.

Recommended Answers

All 3 Replies

Member Avatar for gerbil

Hello, Ken, please start hijackthis select Scan Only, place checkmarks against all the entries listed below that still exist, and then press Fix Checked.

O2 - BHO: (no name) - {01CD0B31-9154-45F2-9414-F5D64B74EAF6} - C:\WINDOWS\system32\wvusssq.dll (file missing)
O2 - BHO: 0 - {3844D88F-F2C2-4409-B9A1-9322676A141D} - C:\Program Files\Internet Explorer\qukadotal859.dll (file missing)
O2 - BHO: (no name) - {3A844AB4-970A-4381-9713-784F20C27F3D} - C:\WINDOWS\system32\hgdbc.dll (file missing)
O2 - BHO: (no name) - {57024DD0-8931-4F3C-BC8F-B210A6BC916E} - C:\Program Files\Windows NT\mexokas83122.dll (file missing)
O2 - BHO: (no name) - {96ACAB33-32F9-3C5F-DA58-4FE607F10ECD} - C:\WINDOWS\system32\kzyaaje.dll (file missing)
O2 - BHO: {69a1b6e2-db4d-0368-ff34-563bee4165f9} - {9f5614ee-b365-43ff-8630-d4bd2e6b1a96} - C:\WINDOWS\system32\xslwcsfy.dll (file missing)
O2 - BHO: (no name) - {B0FAEA97-5490-4284-AE4D-63E808E01806} - C:\Program Files\Windows NT\mexokas4444.dll (file missing)
O4 - HKCU\..\Run: [Jinodyd] "C:\Documents and Settings\ken\My Documents\?racle\?ti2evxx.exe"
O20 - Winlogon Notify: wvusssq - wvusssq.dll (file missing)
O24 - Desktop Component 0: (no name) - about:Home

Good.
==Download this file to your desktop:
- to run it dclick combofix.exe and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs reboot to restore the desktop.
Post with that log another Hijackthis log, please.

Member Avatar for kajdkb

The link for works fine, but the program comes up stating it is expired.

Member Avatar for kylethedarkn

The link for works fine, but the program comes up stating it is expired.

Yes unfortunetly its not working right now, and until the updated version is out it won't work, so just skip that part in his instructions. :icon_lol:

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.