|
|
|||||||||
|
|||||||||
| |||||||||
|
|
|
| |||||||||
![]() |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
|
|
|
Generate data entry and reporting .NET Web apps in minutes, straight from your database. Read our FREE whitepaper “Build Web 2.0 Applications Without Hand-Coding” Download now! |
|
#1
|
|||
|
|||
|
Homepage Hijacking amongst other problems
Hello, I have been having numerous problems for some time now.
First off, my homepage was hijacked and is set to Citi.com. I have recently downloaded SpywareBlaster & SpywareGuard, as recommended in the sticky, and these have allowed me to permanently change my homepage to what I choose. However, I constantly get warnings from SpywareGuard that an attempt has been made to set my homepage back to Citi.com. I cannot figure out what is causing this to happen. I run AdAware & Spybot very often as well. A seperate problem... Whenever I boot up into Windows it often takes an extremely long time to load my icons, and before any action can be performed. It will load my desktop background and start bar and often sit there for minutes. Since this started happening I've also had another problem. Anytime I shut down my PC, the End Program box pops up and Windows tries to close a file named "HPKKJA32.exe". I have done a google search on this file and there was not ONE result. I find this disturbing. Here is my HijackThis log: Logfile of HijackThis v1.97.7 Scan saved at 12:15:23 AM, on 6/6/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\runservice.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton Internet Security\NISUM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Norton Internet Security\NISSERV.EXE C:\Program Files\Norton Internet Security\SymProxySvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Norton Internet Security\IAMAPP.EXE C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\AIM95\aim.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Downloads\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = URL O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {7DD896A9-7AEB-430F-955B-CD125604FDCB} - (no file) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: ATI TV (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - URL O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - URL O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - URL O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - URL O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - URL Any help or advice that can be given is greatly appreciated! |
|
#2
|
|||
|
|||
|
Alright, well I went to the Symantec site and did an online virus scan (since their definitions are always going to be up to date), I actually got this from the sticky:
Online Virus scan at: Symantec (Norton) click the check for security risks button Symantec A/V Scan I obtained the following results: 195318 files scanned, 5 file(s) infected on your disk drives. No viruses were detected in memory. Your computer is infected with at least one known virus or Trojan horse. 1) C:\System Volume Information\_restore{C4187BA9-7563-4EFE-B482-C14A20ABCB6F}\RP612\A0112072.exe is infected with Backdoor.Trojan 2) C:\Program Files\Windows Media Player\wmplayer.exe.tmp is infected with Backdoor.Trojan 3) C:\Documents and Settings\Charles Czuhajewski\.jpi_cache\jar\1.0\classload.jar-69375156-6424d851.zip is infected with Trojan.ByteVerify 4) C:\Documents and Settings\Charles Czuhajewski\Local Settings\Temporary Internet Files\Content.IE5\IH41L73C\print-1-44423[1].html is infected with Bloodhound.Exploit.6 5) C:\WINDOWS\system32\Hpkkja32.exe is infected with Backdoor.Trojan Even though no one has responded to my thread yet, I have found these forums very useful in reading others' problems, and all the recommended tools found in the sticky have proven very useful! I'll keep an update as I find out more about my problems... |
![]() |
| Viewing: Dev Shed Forums > System Administration > Antivirus Protection > Homepage Hijacking amongst other problems |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
|
|