startpage.16.m

hi folks need some help with this trojan i've tryed all the things in the
ask before posting thred i've got adaware se /105 avg anti virus/ spy bot
ccleaner/cwshredder/hyjacj this but still cant get rid .
also canceled system restore if i attatch the hyjack this log can anybody tell me what to get rid of please

 

First:
The first thing that jumps out at me is that your Operating System and Internet Explorer are out dated. After we get your system clean you need to go to Windows Updates and get updated! Be sure you update to Internet Explorer 6.0 SP1.

Internet Explorer Service Pack 1

Second:
Please look in Add or Remove Programs for the following and Uninstall them if found:

MOSEARCH


Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.



Now, look in Task Manager (Ctrl-Alt-Del) for the following running process and, if you see it, try to END it:

MOSEARCH.EXE


Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://media44.fastclick.net/w/safepop.cgi?mid=45368&sid=19457&id=101658&len=87& c=5&nfcp=1&fp=2

O2 - BHO: (no name) - {3CC1D02B-74CA-4938-A96D-DD36EE3D43EA} - C:\WINDOWS\SYSTEM\INNH.DLL

O4 - HKLM\..\RunServices: [MOSearch] C:\PROGRA~1\COMMON~1\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE

O18 - Filter: text/html - {ECA6FC6C-8146-47AA-AD9F-231FC5C8E129} - C:\WINDOWS\SYSTEM\INNH.DLL
O18 - Filter: text/plain - {ECA6FC6C-8146-47AA-AD9F-231FC5C8E129} - C:\WINDOWS\SYSTEM\INNH.DLL

Again, make sure All Browser Windows are Closed when you Click FIX.


NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:


C:\Program Files\Common Files\SYSTEM\MOSEARCH ←–– Delete this whole folder if it exist!

C:\WINDOWS\TEMP\se.dll

C:\WINDOWS\SYSTEM\INNH.DLL


NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"


Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


NOW:
Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!