I got hijacked too! Just need a lil' help

Hey guys, First I'd like to apologize about being another person in need of help. Last night I DL'ed Spybot Search and Destory program, Ran that last night and got rid of all the spywear and bugs. What my main problem is that my home page like, many others, has been over runned by the res://mshp.dll web page. Tonight I downloaded HijackThis and ran a search and save it, This is what I came up with:

Logfile of HijackThis v1.97.7
Scan saved at 11:04:13 AM, on 4/15/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#22776
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://mshp.dll/index.html#22776
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://mshp.dll/index.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://mshp.dll/index.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://mshp.dll/sp.html#22776
O2 - BHO: . - {587DBF2D-9145-4c9e-92C2-1F953DA73773} - C:\WINDOWS\iepy\iepy32.dll
O2 - BHO: ShowSearch module - {E2DDF680-9905-4dee-8C64-0A5DE7FE133C} - C:\WINDOWS\iepy\mssearch.dll
O2 - BHO: (no name) - {FD9BC004-8331-4457-B830-4759FF704C22} - C:\WINDOWS\iepy\msiesh.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Image] rundll32 C:\WINDOWS\image.dll,Install
O4 - HKCU\..\RunServices: [Image] rundll32 C:\WINDOWS\image.dll,Install
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - URL
O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E79} - URL
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - URL
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - URL
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - URL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - URL
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - URL


I apologize for my lack of knowledge about computers, and I beg for your help, Thank you I'll check the forums often in hopes for a reply.

Thank you

Truzark

I'm a little confused. I don't think I've ever had my homepage hijacked! I've had certian things change it on me. All I've done is go into tool/internet options (in IE) and change the homepage to what ever I had it before. Dose that help you at all?

Sorry for the earlier post. It seems there is something with the hijack issue. I've never seen it myself. Someone will help you with this log i'm sure. good luck!

Hi Truzark,

Please follow these instructions:

Reg fix:

Next, copy the text inside the quote box to Notepad, and save in a location of your choice as remove.reg (make sure you save as type: 'all files')

Doubleclick Remove.reg, and answer yes when prompted to add its contents to the Registry.

QUOTE
Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/html]
[-HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/plain]
/QUOTE

Restart your computer, download the latest version of CWShredder (in my signature below).
Run it, Press "Check for update" (update if necessary) press 'Fix', and allow it to fix all it finds.

Next, run Hijack This once more, repost to this forum thread, and please show us a fresh log.

Tom

Heyas' Aries023 and Tom,

Thanks Aries for your curtesy trying to help out! I apreciate it

Tom, I did like you said, Add that quote into my regstry, Down loaded CWShredder, Tryed updating then clicked Fix, it said:

Done!
Removed from your system:
- 6 infected IE registry values
- CWS affiliate: Winshow

I then did like you said to re-run Hijack This, this is the current log:

Logfile of HijackThis v1.97.7
Scan saved at 2:46:03 PM, on 4/15/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - URL
O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E79} - URL
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - URL
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - URL
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - URL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - URL
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - URL

How does it look now? I restarted my computer after I ran CWShredder and re-ran Hijack, I now have my home page back! Thank you so much for your help, Lemme know if my log looks clean, Thanks again!!

I was also wondering if its best to hold on to Hijack and CWShredder and, Do I need to keep the Remove.reg icon on my desktop?

Thank you!

Truzark

You can reuse HijackThis and CWShredder. HijackThis does not have an update feature built in like CWShredder, so it's always best to see if there is a new version often.

You have a MySearch parasite.
Open 'Add/Remove Programs' in the Control Panel. Select the 'My Search Bar' (MySearch variant), 'MyWay Speed Bar' (MyWay) or 'My Web Search Bar' (MyWeb) entry and click 'Remove'. For the MyWeb variant, be sure to also remove 'Fun Web Products Easy Installer'.

You have Netster Smart Browse Toolbar. Here's removal instructions if you'd like to remove it:
http://www.pestpatrol.com/PestInfo/...wse_toolbar.asp

You need to move HijackThis to a permanent folder such as C:\HJT or something similar, so important backups can be made.

Run HijackThis. Place a checkmark next to the following items. Close ALL other browser windows and click "fix checked"

O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/15dc0f8...ip/RdxIE601.cab

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE is a resource hog. You can fix this one if you like.

Reboot

Please Update Windows and Internet Explorer. Download each critical update one by one, rebooting when necessary. There are new, important updates so get them right away.

http://v4.windowsupdate.microsoft.com/

Tom

Dear Tom,

Thanks again for going over my most recent log. I have Hijact This installed under my C:\ hard drive. I went ahead and "Fixed" those 4 that you suggested.

I went under my Control Panel - Add & Remove Programs, but I got stuck and couldn't find: 'My Search Bar'.

I ran a search for "MySearch" and it was found under C:\WINDOWS\Temp\Altnet. But I couldn't find it under the list of programs to remove.

If you have any other suggestions or some thing I should do differently just hollar, I'll check back frequently.

Thanks again,

Truzark

You might want to dump the contents of all your Temp folders.

Reboot into Safe Mode (tap F8 or hold the Ctrl key down while booting). Delete everything in C:\WINDOWS\Downloaded Program Files, empty your Temporary Internet Files (Open IE go to Tools, Internet Options and Delete files (all offline content too). Delete all files in C:\Documents and Settings\%user name%\Local Settings\Temp also C:\Windows\Temp


Tom

Tom,

Cool, thanks for all your help! I feel a lot better now things are fixed, I can sleep better now.

Thanks for your help!

Truzark

Your welcome! Sleep good!

Tom

Hi !
Did U get any reply to yr pb ? I got highjacked as well (same res://mshp.dll/sp.html#22776 as home page) and I am getting !
Tks
Ramj

Hi Ramj,

Feel free to post a new thread with your HijackThis log:

Enable everything in MSCONFIG (if you have disabled anything).

Download HijackThis (link below). Make sure you install HijackThis to a permanent folder such as C:\HJT as it creates backups of what we will fix. Run the program, press Scan, press Save log. Notepad will open, copy and paste the entire log into your post. Do not fix anything yet, most of what's in the log is needed!

Tom