1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Security hijack help needed

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by AlasKen, Aug 11, 2006.

  1. AlasKen

    AlasKen Private E-2

    Like others I have a computer with 2 security page problems. One creates the yellow triangle and popup message stating that I have a problem and click on the icon which goes to a web site. It is created to look like a windows message. The other issue is a home page hijack that take me to a security Security Center site name www dot homepagesecurity dot com I have tried for the last 6 hours to follow the Read and Run me first instructions. I was not able to get the bitdefender scan to work. After trying to download the virus definitions it gave me a message that it was unalbe to update them and the scan would not be accurate so I ended up skipping it. I am attaching the files suggested with the exception of the bit defender. I am running Norton antivirus 2006 and the definitions were up todate last night and Idid a complete scan. I am working on my daughters computer (23 y/o and not living at home) so I only get to work on it in the eveninigs so if I am slow responding it is not be design. I have 12 hours into this now. It appeared after a friend surfed some porn sites, or so the story goes. I will send the getrunkey and shownew as soon as I can find them. I think they are under the administrator acount as I ran them from both users. ANy help is greatly appreciated.

    Attached Files:

  2. AlasKen

    AlasKen Private E-2

    Here are the runkeys and newfiles attachments. When I ran the MS Windows malicious software removal it came back with no malicious software. The Spybot S D found one microsoft WidowsSecurityCenter_disabled file and said it fixed it. Windows defender was run in safe mode. Thanks again for any help. AlasKen

    Attached Files:

  3. AlasKen

    AlasKen Private E-2

    I am not sure if it matters but I noticed my email address was incorrect in my profile so I corrected it. Thanks in advance for your help. AlasKen
  4. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Do you have a log from the BitDefender Online Scan?
  5. AlasKen

    AlasKen Private E-2

    I could not get bitdefender to run. It would get about 70% through loading virus definitions then would throw and unable to load virus definitions messageand state that a scan would be inaccurate so I didn't run that scan. I did run a Norton scan. Thanks..AlasKen
  6. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    - Pocket Killbox

    Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop. DO NOT run it as this time we will do that later in Safe Mode.
    Close Notepad.

    In HJT Choose Open the Misc Tools Section choose Process Manager, Highlight:
    Choose Kill Process. Click on the "Back" Button

    Click the 'Scan' button. Place a checkmark in the box next to the following lines:
    Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

    Now run Pocket Killbox:

    Choose Tools -> Delete Temp Files and click Delete Selected Temp Files

    Then after it deletes the files click the Exit (Save Settings) button.

    NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue..

    • Delete on Reboot
    • then Click on the All Files button.
    • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
    • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
    If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

    Now boot into SAFE MODE

    Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

    Open Windows Explorer navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)
    Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

    Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
    Temporary Files
    Temporary Internet Files
    Recycle Bin

    And Click OK.

    REBOOT to Normal Mode.

    Post a fresh HijackThis log.
  7. AlasKen

    AlasKen Private E-2

    Thank you very much. I attempted to follow your instructions and I think things worked

    When I ran HJT process manager non of the processes on your list were listed so I had nothing to kill.

    The next process for fixing the checked files seemed to work as expected.

    I ran Killbox and all seemed to work.

    I did not get the PendingFileRenameOperations.

    When I went to Windows Explorer the only file I found was C:\Program FIles\intCodec folder and I deleted it with no problem.

    I ran CCleaner

    And then deleted the contents of WINNT\Prefetch and deleted 17 items.

    I ran cleanmgr and selected the files stated.

    On reboot I was able to set my homepage without a hi jack. Very cool. I haven't received teh other annoying popups either.

    I am attaching the new HJT file

    I truly appreciate the time you spent on this.


    Attached Files:

  8. AlasKen

    AlasKen Private E-2

    I have also followed the thread on "How to protect yourself from malware" to try and prevent future occurrances. I have not reset the system point recovery until I know it is time. Thanks again. AlasKen
  9. AlasKen

    AlasKen Private E-2

    Oops. After reviewing all the steps I realized that I forgot to rename HighJackThis so I renamed it and ran it again. Sorry for the inconvenience. Again thanks for the help. AlasKen

    Attached Files:

  10. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

  11. AlasKen

    AlasKen Private E-2

    Dude your the best.

    Not sure why JAVA was out of date as I downloaded it over the weekend. No matter I will try again. I am very thankful for your help. However my daughter is even happier!!! Thanks..AlasKen
  12. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    The update to Java was just released the other day.

    You're welcome.
  13. AlasKen

    AlasKen Private E-2

    All nasties appear to be gone. Great job and thanks.

    As a followup when I start it seems to take a long time ~5 minutes before everything loads. It seems that a lot of processes are starting in the background. While the load takes place everything slows to a crawl even though NAV and other process appear to be finished. Screens get choppy and you can see the screen refresh taking place. Once everything loads everything sppeds back up. Would this be something I should ask about on the software forum? I will start a new thread if that is appropriate. Thanks again for the help.
  14. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Determine what you don't need to load when windows starts, then configure the programs to not load at system start.
  15. AlasKen

    AlasKen Private E-2

    Sorry to be dense but what is the proper way to determine what is actually loading at system start and how do I configure it? I do understand that msconfig is not the proper way to disable it but not sure if there is a tool to simplify the process. Thanks again. As an update my daughter reports that all is running with a heightened sense of safe surfing. Great job. AlasKen
  16. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    FOr the ones that use a registry enter they usually show in HijackThis, simply marking and click fix will remove the entry fromteh registry. Then the programs won't start. Others can be found in the Startup folder. Either under all users or the logged on user.

Share This Page

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds