Homepage Hijack, difficulty w/ hijack this

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by John M., Jun 6, 2004.

Thread Status:
Not open for further replies.
  1. John M.

    John M. Private E-2

    I'm suffering with a "Homepage Hijack" I have run Ad aware, Spybot S&D, Clean my PC, I have Norton also running......... I downloaded hijack this and have had difficulity with opening it so I can run it and see if it destroys this pest.......... but........ My PC always freezes up when trying to unzip the file??????? I'm not a waay saavy computer user, I would really appreciate any help?? If there is a way for anybody to contact me, I could sure use the help from one of you all knowing computer guru's.......

    If you're in So. range Co., Ca....... I'll pay to have this problem fixed, I'm out of patience...... it's been a week now!@!....... The varmint that has ahold of me is this http://213.159.117.132/redir.php don't go there.... once it gets ahold of you........ it doesn't let go.........
    If anybody has had this and has successfully deleted it, please let me know how you did it??
    Being ever so humble.......... John M.
     
    John M., Jun 6, 2004
    #1
  2. Radiofool

    Radiofool Private First Class

    Perhaps your version of HijackThis is corrupt. Try downloading it again.
     
    Radiofool, Jun 6, 2004
    #2
  3. John M.

    John M. Private E-2

    Thanks very much Radiofool......... The download worked..unzipped....... and a log of what Hijack This found.... Now I need to find somebody to say which should be deleted......
    Also... I ran CWshredder... with success........CWS found the problem as far as I can tell...... the hijacker has not re-established itself as my default page.... and it has been past it's normal time of a minute or less...... I wish I found this site last weekend!!!
    This is Great, many thanks to you......
    John M.
     
    John M., Jun 6, 2004
    #3
  4. alanc

    alanc MajorGeek

    Go ahead and post the log here and we'll take a look at it.
     
    alanc, Jun 7, 2004
    #4
  5. Maxwell

    Maxwell Folgers

    Maxwell, Jun 7, 2004
    #5
  6. Kerri

    Kerri Private E-2

    I saved my hijackthis log and i don't know which ones to delete. I have a pretty good idea from all I've read, but I am so afraid of deleting a needed file. I'd really appreciate the help!!!
     
    Kerri, Dec 7, 2004
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    First you need to read the sticky threads and then you need to post in your own thread and not revive a 6 month old thread. State your problems too. Hijackthis is the last step.

    First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal
    If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.

    NOTE: In order to resolve the issues you are having it is very important that you at least try to perform all the steps as outlined. If you have any difficulty please post back letting us know what steps you have completed, what you found while doing the scans if anything and details about any problems you have encountered in completing the steps. The more details you can provide the better.


    After doing ALL of the above if you still have a problem:

    Make sure you have HJT Version 1.98.2 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

    Now post a HijackThis as a .txt file attachment to your message. All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

    To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT


    BUT PLEASE DO IT IN A NEW THREAD OF YOUR OWN.
     
    chaslang, Dec 7, 2004
    #7
  8. Kerri

    Kerri Private E-2

    So sorry. This forum works a bit different from the others in which I have been involved. I'll seek help elsewhere. Again, I apologize for posting to the wrong thread.
    Thanks,
    Kerri
     
    Kerri, Dec 7, 2004
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You do not need to seek help elsewhere. I already offered it. Just follow those directions and post in a new thread of your own.

    It's easier to relate specifically to only your problem by having you post in your own thread. Reading someone else's history can get confusing for everyone especially when the info is so old. Things are changing quickly.
     
    chaslang, Dec 8, 2004
    #9
  10. Veritas

    Veritas Private E-2

    Re: problem solved:Homepage Hijack

    Hey all, i recently had this problem also and after 3 days of searching, i finally found out how to solve it, well, one way that is. i tired everything from ad aware to spybot to virus scans to hijack this, non of which had any positive results. i tried deleting the hijacked startpage, searchpage, in registry but upon opening internet explorer, the values were reset and my homepage yet again returned to being hijacked. heres how i found to solve it.

    try this as a last resort, deleting unknown .dll files may cause your computer to mess up. i found the help for this scattered out in a forum on another place , had to dig around for a bit but i thought id post it here to help some of you all out in my own words. read this first and see what happens then before you do anything visit http://forums.whatpc.co.uk/thread.jsp?forum=11&thread=46813&message=286093
    to make sure you arent doing things wrong, hope it helps :)

    step one:
    got to start, run, and type in regedit. next go to the menu bar and click on edit, then click find and type startpage. if you have anything like what i had it should be something like res:\%43%43.. a whole bunh of that stuff, any ways right click it and select modify, then copy the selected text (all the res: percent stuff)

    step 2:
    go to this site http://www.simplelogic.com/Developer/URLDecode.asp and paste what you have just selected and select the clean data button. now at the top of the window you will see your results decoded, this is the .dll file that is hiding on your computer changing your homepage and giveg you hell. once you locate the .dll file in your c:\windows\system 32 folder, you must delete the bad .dll file. it probably wont work so reboot into safe mode (restart and press f8 while booting) and try to delete it in there. If that doesnt work get this file, http://downloads.subratam.org/DllCompare.exe , it makes it so that you can delete the protected file by adding a right click option and will delete the file on the next reboot. (to use, find the file you want to delete, and right click on it then youll see what to do.)

    step 3:
    i dont know if this was needed but after deleting the bad .dll file, i went back into regedit and deleted the startpage, searchpage, and the about:blank one, just to be on the safe side. when i rebooted, i fired up internet explorer and low and behold problem solved. so i hope this fixes your problems.
     
    Veritas, Jan 17, 2005
    #10
  11. jsisco11

    jsisco11 Private E-2

    Re: Homepage Hijack, MILITARY TAKEOVER!

    Hello Veritas. Yesterday I read your post and found it helpful in dealing with the same problem you had. Initially I was impressed with the http://www.military.com site, which is associated with moster.com, enough to make it my home page for Internet Explorer. However, when I scanned my pc with Microsoft Antispyware, it pointed to the site as a potential threat. NO MATTER WHAT I DID, including every procedure laid out in this forum given by Major Attitude, to reset to my default home page, military.com took over on startup. When in my anger I blocked the site because of the violation, my entire internet connection was messed up. I was forced to unblock the site to bring things back to normal. The only problem now is me being obligated to military.com without free will is not right. I visited the web site daily and would have been perfectly fine book-marking the site as one of my favorites. NOT ANYMORE!!! :(

    My Windows XP SP2 will not allow me to paste data values from the registry to simplelogic.com. I right click and click modify which opens the edit binary value box. It will allow me to select the value and copy but when I right click to paste it, the option is not given. Is there any other way to identify that WICKED, CONTROLLING, :mad: blankidy blank blank military .dll?
     
    jsisco11, Feb 20, 2005
    #11
  12. Sootah

    Sootah Private E-2

    Hijackers are annoying, eh?

    Keep in mind that most peoples HJT logs, when clean, arent more than half a page long usually. If yours is longer than that then it's probably loaded. There is a good analyzer at http://www.hijackthis.de/en . You can post your log there and it'll tell you what to erase.

    There's also a generic guide on ........

    Edit by chaslang: Links removed. We already have guides on Majorgeeks you do not need to go someplace else. Please familiarize yourself with our sticky threads.
     
    Last edited by a moderator: Mar 9, 2005
    Sootah, Mar 9, 2005
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Why does everyone insist on reopening this old thread that no user cares about?

    Thread is closed.
     
    chaslang, Mar 9, 2005
    #13
Thread Status:
Not open for further replies.

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds