Browser Hijacking

garystone · Oct 5, 2004

Helppppppppp......
I am running IE on Windows XP and have had my home page hijacked.
I have disabled the restore function, downloaded all the removal tools listed but when I change the homepage back to google for example, within a matter of seconds the registry changes and the homepage is changed .

The homepage details always change and are in the format of 78%63% etc etc.

Can anybody shed any light please.

Thanking you in advance

Gary

Kodo · Oct 5, 2004

you say you've downloaded all the removal tools listed? does that mean you followed the tutorial?

http://forums.majorgeeks.com/showthread.php?t=35407
READ ME FIRST: Basic Spyware, Trojan And Virus Removal.

I just want to make sure before we proceed.

garystone · Oct 5, 2004

Hi Kodo,

I have to the best of my knowledge, followed the instructions as shown.

Gary

Kodo · Oct 5, 2004

ok, the next step is this

http://forums.majorgeeks.com/showthread.php?t=38752
Hijack This Tutorial And How To Post Your Log File

Please read this tutorial carefully. Do not run HiJackThis from any folder within Documents and Settings, desktop, temp folder or an archive.

garystone · Oct 5, 2004

Hi Kodo,

I will follow instructions and post log file when I get home.

Thank you.

garystone · Oct 5, 2004

Hi Kodo

Please find log file as requested,

thanks

Gary

chaslang · Oct 5, 2004

First, you need to get HijackThis off your Desktop and into its own folder. Like c:\Program File\HJT or c:\HJT.

Also while I look at your log. Check for SyncroAd and WinSync in Add/Remove programs and uninstall them if found. Let me know if you find them.

You also need to visit Microsoft's Windows Update to get your WinXP and Internet Explorer updated.

chaslang · Oct 5, 2004

You never ran the TrendMicro online scan. Why?

garystone · Oct 5, 2004

Hi Chaslang,

Thanks for your reply, in add/remove programs I have a' Windows SyncroAd' listed. Should this be removed? WinSync is not listed.
I will definitely update my system when clean!!
I have also moved Hijack This to its own folder on c:\

Gary

garystone · Oct 5, 2004

I couldn't connect to the internet even though I had logged on in safe mode with network support.

Kodo · Oct 5, 2004

garystone said:

Hi Chaslang,

Thanks for your reply, in add/remove programs I have a' Windows SyncroAd' listed. Should this be removed? WinSync is not listed.
I will definitely update my system when clean!!
I have also moved Hijack This to its own folder on c:\

Gary
Click to expand...

yes, get rid of syncroad.

Post a new Log file please.

chaslang · Oct 5, 2004

You have a lot of trojans on the computer. You MUST update your OS and IE and install some protection.

Make sure system restore is disabled and viewing of hidden file is enabled.
Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Find the below processes and End them (if found):
SyncroAd.exe
MSMSGSVC.exe
WinSync.exe
lsrv.exe
serm32.exe
msfrewall.exe
ndis.exe
sp2update.exe
xpcd.exe
winmon.exe

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.com%00@www.e-finder.cc/hp/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.com%00@www.e-finder.cc/hp/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated)
O2 - BHO: DOMPeek Class - {834261E1-DD97-4177-853B-C907E5D5BD6E} - C:\WINDOWS\dpe.dll
O4 - HKLM\..\Run: [Microsoft Services] lsrv.exe
O4 - HKLM\..\Run: [Microsoft WinUpdates] serm32.exe
O4 - HKLM\..\Run: [MS FIREWALL] msfrewall.exe <---- http://www.sophos.com.au/virusinfo/analyses/w32sdbotpk.html
O4 - HKLM\..\Run: [NDIS Adapter] ndis.exe
O4 - HKLM\..\Run: [sdfsdfsdf] C:\sp2update.exe
O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
O4 - HKLM\..\Run: [msjava service] xpcd.exe
O4 - HKLM\..\Run: [Windows Monitor] winmon.exe
O4 - HKLM\..\RunServices: [Microsoft Services] lsrv.exe
O4 - HKLM\..\RunServices: [Microsoft WinUpdates] serm32.exe
O4 - HKLM\..\RunServices: [MS FIREWALL] msfrewall.exe
O4 - HKLM\..\RunServices: [NDIS Adapter] ndis.exe
O4 - HKLM\..\RunServices: [msjava service] xpcd.exe
O4 - HKCU\..\Run: [Microsoft Services] lsrv.exe
O4 - HKCU\..\Run: [MS FIREWALL] msfrewall.exe
O4 - HKCU\..\Run: [NDIS Adapter] ndis.exe
O4 - HKCU\..\Run: [MSMsgSvc] C:\WINDOWS\System\MSMSGSVC.exe
O4 - HKCU\..\RunServices: [MS FIREWALL] msfrewall.exe
O13 - DefaultPrefix: http://%65%68%74%74%70%2E%63%63/?
O13 - WWW Prefix: http://%65%68%74%74%70%2E%63%63/?
O19 - User stylesheet: (file missing)

Boot in safe mode and use Windows Explorer to delete:
C:\WINDOWS\dpe.dll
C:\Program Files\Windows SyncroAd <--- the whole directory
C:\WINDOWS\System\MSMSGSVC.exe
c:\windows\system32\lsrv.exe
c:\windows\system32\serm32.exe
c:\windows\system32\msfrewall.exe
c:\windows\system32\ndis.exe
C:\sp2update.exe
c:\windows\system32\xpcd.exe
c:\windows\system32\winmon.exe

Some of the above file may not be located where I indicated. You may need to use Windows Advance search options to find them. Here is how to configure search:

Click Start, Search, All files and folders, enter the file name in the box provided, then click More advanced options and make sure you have checked:
- Search system folders
- Search hidden files and folders
- Search subfolders

Eneter the filename and then click the Search button.

After this boot in normal mode and post a new HJT log attachment and let us know how things are working.

garystone · Oct 5, 2004

I have followed instructions, please find log file.
Now when I log on to internet, it does not take me to different search pages but takes me to 'http://spywarealert.net'.

Gary

garystone · Oct 5, 2004

Sorry chaslang but I keep getting an upload error when trying to upload the log file.
I have tried deleting the 2 previous uploads but it will not let me.

Gary

garystone · Oct 5, 2004

Hi all,

I have re-run Hijack this - please find enclosed log file (hopefully). No visible signs of hijacking now, where is the best place to download updated versions of xp & ie?

thank you

Gary

chaslang · Oct 5, 2004

Fix these line with HijackThis after shutting down all browser sessions:
O2 - BHO: (no name) - {834261E1-DD97-4177-853B-C907E5D5BD6E} - (no file)
O4 - HKCU\..\Run: [MSMsgSvc] C:\WINDOWS\System\MSMSGSVC.exe

Did you miss this O4 line last time?

Did you get the C:\WINDOWS\System\MSMSGSVC.exe file deleted last time when I had you boot in safe mode? Make sure. Go look for it.

garystone · Oct 6, 2004

Hi,

I searched for the file but could not find it.
Any ideas?

Thank you for all your help so far. At least I can let my kids search the web without being bombarded with c#@p.

Gary

chaslang · Oct 6, 2004

garystone said:

Hi,

I searched for the file but could not find it.
Any ideas?

Thank you for all your help so far. At least I can let my kids search the web without being bombarded with c#@p.

Gary
Click to expand...

Were you able to fix those lines in HJT? Show me another log.

You asked where to go for updates:
Go here and get your updates do all but Win XP SP2. Do not upgrade to SP2 while having any problems.

Windows Update: http://v4.windowsupdate.microsoft.com/en/default.asp

garystone · Oct 6, 2004

Hi Chaslang,

HJT deleted the files.
This is the new log.

Thanks

Kodo · Oct 6, 2004

well, you still have a cws on your machine if you deleted this line

O2 - BHO: (no name) - {834261E1-DD97-4177-853B-C907E5D5BD6E} - (no file)

and it came back.

for the MSMSGSVC.exe go to start..run .. type CMD and hit enter.
and the prompt type

DEL C:\WINDOWS\System\MSMSGSVC.exe

run CWshredder once more and post a new log.

garystone · Oct 6, 2004

Kodo,

Please find new log file

Gary

chaslang · Oct 7, 2004

Your log looks clean now. Go get your Windows updates!

Kodo · Oct 7, 2004

chaslang said:

Your log looks clean now. Go get your Windows updates!
Click to expand...

yes.. please!!

garystone · Oct 7, 2004

Thank you all for your help!

Gary

Kodo · Oct 7, 2004

You're welcome!

Log in or Sign up

Browser Hijacking

garystone Private E-2

Kodo SNATCHSQUATCH

garystone Private E-2

Kodo SNATCHSQUATCH

garystone Private E-2

garystone Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

garystone Private E-2

garystone Private E-2

Kodo SNATCHSQUATCH

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

garystone Private E-2

garystone Private E-2

garystone Private E-2

Attached Files:

hijackthis.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

garystone Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

garystone Private E-2

Attached Files:

hijackthis.txt

Kodo SNATCHSQUATCH

garystone Private E-2

Attached Files:

hijackthis.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Kodo SNATCHSQUATCH

garystone Private E-2

Kodo SNATCHSQUATCH

Log in or Sign up

Browser Hijacking

garystone Private E-2

Kodo SNATCHSQUATCH

garystone Private E-2

Kodo SNATCHSQUATCH

garystone Private E-2

garystone Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

garystone Private E-2

garystone Private E-2

Kodo SNATCHSQUATCH

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

garystone Private E-2

garystone Private E-2

garystone Private E-2

Attached Files:

hijackthis.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

garystone Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

garystone Private E-2

Attached Files:

hijackthis.txt

Kodo SNATCHSQUATCH

garystone Private E-2

Attached Files:

hijackthis.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Kodo SNATCHSQUATCH

garystone Private E-2

Kodo SNATCHSQUATCH

Useful Searches