#1
  1. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Apr 2004
    Posts
    4
    Rep Power
    0

    Exclamation I got hijacked too! Just need a lil' help


    Hey guys, First I'd like to apologize about being another person in need of help. Last night I DL'ed Spybot Search and Destory program, Ran that last night and got rid of all the spywear and bugs. What my main problem is that my home page like, many others, has been over runned by the res://mshp.dll web page. Tonight I downloaded HijackThis and ran a search and save it, This is what I came up with:

    Logfile of HijackThis v1.97.7
    Scan saved at 11:04:13 AM, on 4/15/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\Mixer.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#22776
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://mshp.dll/index.html#22776
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://mshp.dll/index.html#22776
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#22776
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://mshp.dll/index.html#22776
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://mshp.dll/sp.html#22776
    O2 - BHO: . - {587DBF2D-9145-4c9e-92C2-1F953DA73773} - C:\WINDOWS\iepy\iepy32.dll
    O2 - BHO: ShowSearch module - {E2DDF680-9905-4dee-8C64-0A5DE7FE133C} - C:\WINDOWS\iepy\mssearch.dll
    O2 - BHO: (no name) - {FD9BC004-8331-4457-B830-4759FF704C22} - C:\WINDOWS\iepy\msiesh.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Image] rundll32 C:\WINDOWS\image.dll,Install
    O4 - HKCU\..\RunServices: [Image] rundll32 C:\WINDOWS\image.dll,Install
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E79} - http://activex.microsoft.com/activex...n/nsmp2inf.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/15dc0f81...p/RdxIE601.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...867.6338773148
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
    O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup.cab


    I apologize for my lack of knowledge about computers, and I beg for your help, Thank you I'll check the forums often in hopes for a reply.

    Thank you

    Truzark
    Last edited by Truzark; April 15th, 2004 at 12:06 PM.
  2. #2
  3. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Apr 2004
    Posts
    15
    Rep Power
    0
    I'm a little confused. I don't think I've ever had my homepage hijacked! I've had certian things change it on me. All I've done is go into tool/internet options (in IE) and change the homepage to what ever I had it before. Dose that help you at all?
  4. #3
  5. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Apr 2004
    Posts
    15
    Rep Power
    0
    Sorry for the earlier post. It seems there is something with the hijack issue. I've never seen it myself. Someone will help you with this log i'm sure. good luck!
  6. #4
  7. No Profile Picture
    Contributing User
    Devshed Regular (2000 - 2499 posts)

    Join Date
    Aug 2003
    Posts
    2,491
    Rep Power
    19
    Hi Truzark,

    Please follow these instructions:

    Reg fix:

    Next, copy the text inside the quote box to Notepad, and save in a location of your choice as remove.reg (make sure you save as type: 'all files')

    Doubleclick Remove.reg, and answer yes when prompted to add its contents to the Registry.

    QUOTE
    Windows Registry Editor Version 5.00

    [-HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/html]
    [-HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/plain]
    /QUOTE

    Restart your computer, download the latest version of CWShredder (in my signature below).
    Run it, Press "Check for update" (update if necessary) press 'Fix', and allow it to fix all it finds.

    Next, run Hijack This once more, repost to this forum thread, and please show us a fresh log.

    Tom
    HijackThis
    Ad-aware
    Spybot Search & Destroy
    SpywareBlaster
    SpywareGuard
    Housecall Online A/V Scan

    Please read the stickys at the top of the forum before posting!
  8. #5
  9. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Apr 2004
    Posts
    4
    Rep Power
    0

    w00t!


    Heyas' Aries023 and Tom,

    Thanks Aries for your curtesy trying to help out! I apreciate it

    Tom, I did like you said, Add that quote into my regstry, Down loaded CWShredder, Tryed updating then clicked Fix, it said:

    Done!
    Removed from your system:
    - 6 infected IE registry values
    - CWS affiliate: Winshow

    I then did like you said to re-run Hijack This, this is the current log:

    Logfile of HijackThis v1.97.7
    Scan saved at 2:46:03 PM, on 4/15/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\Mixer.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\HijackThis.exe

    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E79} - http://activex.microsoft.com/activex...n/nsmp2inf.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/15dc0f81...p/RdxIE601.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...867.6338773148
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
    O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup.cab

    How does it look now? I restarted my computer after I ran CWShredder and re-ran Hijack, I now have my home page back! Thank you so much for your help, Lemme know if my log looks clean, Thanks again!!

    I was also wondering if its best to hold on to Hijack and CWShredder and, Do I need to keep the Remove.reg icon on my desktop?

    Thank you!

    Truzark
  10. #6
  11. No Profile Picture
    Contributing User
    Devshed Regular (2000 - 2499 posts)

    Join Date
    Aug 2003
    Posts
    2,491
    Rep Power
    19
    You can reuse HijackThis and CWShredder. HijackThis does not have an update feature built in like CWShredder, so it's always best to see if there is a new version often.

    You have a MySearch parasite.
    Open 'Add/Remove Programs' in the Control Panel. Select the 'My Search Bar' (MySearch variant), 'MyWay Speed Bar' (MyWay) or 'My Web Search Bar' (MyWeb) entry and click 'Remove'. For the MyWeb variant, be sure to also remove 'Fun Web Products Easy Installer'.

    You have Netster Smart Browse Toolbar. Here's removal instructions if you'd like to remove it:
    http://www.pestpatrol.com/PestInfo/n...se_toolbar.asp

    You need to move HijackThis to a permanent folder such as C:\HJT or something similar, so important backups can be made.

    Run HijackThis. Place a checkmark next to the following items. Close ALL other browser windows and click "fix checked"

    O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/15dc0f8...ip/RdxIE601.cab

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE is a resource hog. You can fix this one if you like.

    Reboot

    Please Update Windows and Internet Explorer. Download each critical update one by one, rebooting when necessary. There are new, important updates so get them right away.

    http://v4.windowsupdate.microsoft.com/

    Tom
    HijackThis
    Ad-aware
    Spybot Search & Destroy
    SpywareBlaster
    SpywareGuard
    Housecall Online A/V Scan

    Please read the stickys at the top of the forum before posting!
  12. #7
  13. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Apr 2004
    Posts
    4
    Rep Power
    0
    Dear Tom,

    Thanks again for going over my most recent log. I have Hijact This installed under my C:\ hard drive. I went ahead and "Fixed" those 4 that you suggested.

    I went under my Control Panel - Add & Remove Programs, but I got stuck and couldn't find: 'My Search Bar'.

    I ran a search for "MySearch" and it was found under C:\WINDOWS\Temp\Altnet. But I couldn't find it under the list of programs to remove.

    If you have any other suggestions or some thing I should do differently just hollar, I'll check back frequently.

    Thanks again,

    Truzark
  14. #8
  15. No Profile Picture
    Contributing User
    Devshed Regular (2000 - 2499 posts)

    Join Date
    Aug 2003
    Posts
    2,491
    Rep Power
    19
    You might want to dump the contents of all your Temp folders.

    Reboot into Safe Mode (tap F8 or hold the Ctrl key down while booting). Delete everything in C:\WINDOWS\Downloaded Program Files, empty your Temporary Internet Files (Open IE go to Tools, Internet Options and Delete files (all offline content too). Delete all files in C:\Documents and Settings\%user name%\Local Settings\Temp also C:\Windows\Temp


    Tom
    HijackThis
    Ad-aware
    Spybot Search & Destroy
    SpywareBlaster
    SpywareGuard
    Housecall Online A/V Scan

    Please read the stickys at the top of the forum before posting!
  16. #9
  17. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Apr 2004
    Posts
    4
    Rep Power
    0

    Thanks!


    Tom,

    Cool, thanks for all your help! I feel a lot better now things are fixed, I can sleep better now.

    Thanks for your help!

    Truzark
  18. #10
  19. No Profile Picture
    Contributing User
    Devshed Regular (2000 - 2499 posts)

    Join Date
    Aug 2003
    Posts
    2,491
    Rep Power
    19
    Your welcome! Sleep good!

    Tom
    HijackThis
    Ad-aware
    Spybot Search & Destroy
    SpywareBlaster
    SpywareGuard
    Housecall Online A/V Scan

    Please read the stickys at the top of the forum before posting!
  20. #11
  21. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Apr 2004
    Posts
    1
    Rep Power
    0

    Angry res://mshp.dll/sp.html#22776


    Hi !
    Did U get any reply to yr pb ? I got highjacked as well (same res://mshp.dll/sp.html#22776 as home page) and I am getting !
    Tks
    Ramj
  22. #12
  23. No Profile Picture
    Contributing User
    Devshed Regular (2000 - 2499 posts)

    Join Date
    Aug 2003
    Posts
    2,491
    Rep Power
    19
    Hi Ramj,

    Feel free to post a new thread with your HijackThis log:

    Enable everything in MSCONFIG (if you have disabled anything).

    Download HijackThis (link below). Make sure you install HijackThis to a permanent folder such as C:\HJT as it creates backups of what we will fix. Run the program, press Scan, press Save log. Notepad will open, copy and paste the entire log into your post. Do not fix anything yet, most of what's in the log is needed!

    Tom
    HijackThis
    Ad-aware
    Spybot Search & Destroy
    SpywareBlaster
    SpywareGuard
    Housecall Online A/V Scan

    Please read the stickys at the top of the forum before posting!

IMN logo majestic logo threadwatch logo seochat tools logo