Member Avatar for summon

I cann't change my homepage adress pls help me ... i formatted my windows but still that page is coming and i cant change it.

Here is my log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:37:01, on 10.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\OV530EM.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\program files\steam\steam.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\boran\Desktop\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Ovt Wia] C:\WINDOWS\OV530EM.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{F896D780-017A-4187-BC00-DC9B732EDBFA}: NameServer =
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 3413 bytes

  • 3 Contributors
  • 8 Replies
  • 212 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by summon

Dani AI

Generated

A short expert add‑on to the thread: the symptom in ’s HijackThis log (a locked homepage plus registry policy and DNS entries) is a classic two‑part problem — a policy that prevents IE from accepting changes, and altered DNS settings that keep sending the browser to the same site. ’s advice to scan for malware was on target, and ’s removal of the bad entries fixed the immediate problem; the extra detail below is a safe, repeatable checklist for anyone who finds the same signs later.

If Internet Options is greyed out or the homepage buttons are locked, the registry policy key under HKCU\Software\Policies\Microsoft\Internet Explorer is likely forcing the setting. Back up the registry (or make a restore point) first, then remove that policy key and check the three “Main” keys listed in Microsoft’s troubleshooting steps to restore the Start Page values. (learn.microsoft.com)

If HijackThis shows O17 NameServer entries, the machine’s DNS has been changed (local DNS hijack / “pharming”) so legitimate addresses resolve to attacker IPs. Check the network adapter TCP/IP settings and either set DNS to obtain automatically or point to a trusted resolver, then clear local caches and reset the network stack. Useful commands (run from an administrator command prompt on XP): 

ipconfig /flushdns
netsh winsock reset
netsh int ip reset c:\resetlog.txt

Resetting TCP/IP / Winsock and flushing DNS forces the system to stop using the bogus resolver and is a standard part of recovery. (support.microsoft.com)

Final checks: examine the hosts file (%SystemRoot%\system32\drivers\etc\hosts) for unauthorized entries, remove any leftover BHOs or startup items (Autoruns is useful), and run an up‑to‑date anti‑malware scanner to remove the underlying infection so the registry/DNS edits do not return. Always keep a registry export or system restore point before editing and repeat a HijackThis scan after cleanup to confirm the O6/O17/R0 entries are gone.

Recommended Answers

All 8 Replies

Member Avatar for summon

Suspishio thank you for your answer but link isnt working...

Guys pls help me :(((

Member Avatar for Suspishio

Sorry to read that. I just tested the link OK.

Anyway, IMHO you need to clean out the trojan that did this. SpyBot and AVG (I'd use both) are good at this.

I couldn't see anything in your HJT log (I'm not the top expert I admit) - but something that starts, hijacks your home page and then finishes won't show.

You could try routing around in the Registry in the RUN key for something dodgy; you could also look in the C:\ root - there shouldn't be any EXE programs there.

Member Avatar for summon

Again thank you Suspishio for your care... i go to that link and did whatever it says but i still got the problem .... i will paste a picture of it may it helps .... i cant even touch the settings ''use current , use default or use blank ''

pls help me :(

sadsdsad.JPG 75.73 KB
Member Avatar for Suspishio

There is a quirk in IE and it might be your problem (likely not).

Tools/Internet Options/Advanced/Browsing

Then Uncheck the Automatic Updates box if ticked. If ticked it prevents you from changing the home page.

There are other programs that can do this lie anti-virus which can lock your environment down according to your specification.

Let's hope it's not a hijack.

Let us know.

Member Avatar for summon

Hi again there was no tick ... i dont know what to do :(

Member Avatar for bobbyraw

try this from microsoft

Also delete
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

do you recognize these ip address in the registry i beleive they are related to the turkey wed site.
O17 - HKLM\System\CCS\Services\Tcpip\..\{F896D780-017A-4187-BC00-DC9B732EDBFA}: NameServer =

run spybot and adware in safe mode and delete the above reg keys. then follow the step above

Member Avatar for summon

Many thanks the problem is solved thanks too all trying to help me :D bobbyraw 's sloution was correct thanks :D

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.