Please help(homepage changing)

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by kickmydonkey, Jun 15, 2004.

  1. kickmydonkey

    kickmydonkey Private E-2

    Ok, well I thought I may be able to fix this by just searching message boards for a similar problem,however haven't found an exact match for my problem. My homepage keeps changing itself to res://srxkg.dll/index.html#37049 (or similar changes itselt to different dll things)and it always has the title homesearch,with a little windows icon on the top left of the page. everytime I remove it using hijack this it just restores itself. Have used spybot, adaware and tried everything with hijack this. Well anyway, here is my hijackthis log.
    Logfile of HijackThis v1.97.7

    Scan saved at 10:19:58 PM, on 6/15/2004

    Platform: Windows XP SP1 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\LEXBCES.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\system32\LEXPPS.EXE

    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

    C:\WINDOWS\System32\Ati2evxx.exe

    C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe

    C:\WINDOWS\System32\drivers\CDAC11BA.EXE

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\wanmpsvc.exe

    C:\WINDOWS\apitp.exe

    C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe

    C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe

    C:\WINDOWS\system32\syspk.exe

    C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe

    C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe

    C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\WINDOWS\explorer.exe

    C:\WINDOWS\System32\wuauclt.exe

    C:\Documents and Settings\GERALD\Local Settings\Temp\Temporary Directory 14 for hijackthis.zip\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\snxkg.dll/sp.html#37049

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://snxkg.dll/index.html#37049

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://snxkg.dll/index.html#37049

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\snxkg.dll/sp.html#37049

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://snxkg.dll/index.html#37049

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\snxkg.dll/sp.html#37049

    O2 - BHO: (no name) - {652B2B57-E4D1-DA98-11D1-63B6EC399433} - C:\WINDOWS\system32\syszc32.dll

    O4 - HKLM\..\Run: [syspk.exe] C:\WINDOWS\system32\syspk.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38152.8377314815

    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    please help me out.
    Thanks alot
    Daniel
     
  2. Andy R

    Andy R Private E-2

    follow my thread, or any of the "only the best" threads, there have been proably 10 other people in the last few days with this similar problem
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds