Hello Gurus, I am apparently the victim of a browser hijacking. My homepage is consistently reset to "approvedlinks" after bootup.I read your forum and others, and started by downloading and running Spybot Search and Destroy 1.96. I fixed whatever it found. Then I downloaded and ran HiJack This, making sure to run it right after bootup. Here's the Log it produced: Logfile of HijackThis v1.97.2 Scan saved at 9:08:49 AM, on 22/09/2003 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\SYSTEM32\DNTUS26.exe C:\WINNT\SYSTEM32\DWRCS.exe C:\PROGRA~1\Magma\MAGMAH~1\app\pppoeservice.exe C:\WINNT\system32\regsvc.exe C:\WINNT\System32\wins\DLLHOST.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.exe C:\WINNT\System32\cdplayer.exe C:\WINNT\System32\ntsys.exe C:\winnt\web\printers\images\explorer.exe C:\WINNT\System32\internat.exe C:\WINDOWS\iedll.exe C:\WINDOWS\loader.exe C:\Program Files\Microsoft Office\Office\OSA.exe C:\Program Files\WinZip\WZQKPICK.exe C:\Program Files\Accessories\HijackThis\HijackThis unzipped\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://approvedlinks.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://approvedlinks.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://approvedlinks.com/sp.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://approvedlinks.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://out.true-counter.com/a/?656387 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://out.true-counter.com/b/?656387 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://approvedlinks.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://out.true-counter.com/b/?656387 (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://out.true-counter.com/a/?656387 about:blank (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchv.com/1/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://out.true-counter.com/b/?656387 (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://out.true-counter.com/b/?656387 (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://out.true-counter.com/b/?656387 (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://out.true-counter.com/c/?656387 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchv.com/1/search.php?qq=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://approvedlinks.com/hp.htm R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://out.true-counter.com/b/?656387 (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://out.true-counter.com/b/?656387 (obfuscated) F0 - system.ini: Shell=C:\WINNT\Explorer.Exe, F2 - REG:system.ini: Shell=C:\WINNT\Explorer.Exe, O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - C:\WINNT\fhfmm.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: DNSErr object - {1E1B2879-88FF-11D2-8D96-D7ACAC95951F} - C:\WINNT\DNSErr.dll O2 - BHO: WinShow module - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - C:\WINNT\winshow.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [DeluxeCD] C:\WINNT\System32\cdplayer.exe -tray O4 - HKLM\..\Run: [Ntsys] ntsys.exe O4 - HKCU\..\Run: [Internat.exe] internat.exe O4 - HKCU\..\Run: [iedll] c:\WINDOWS\iedll.exe O4 - HKCU\..\Run: [loader] c:\WINDOWS\loader.exe O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.exe O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.exe O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {00000000-0000-0000-0000-d4c4b96b0d97} - O16 - DPF: {00000000-8c7d-4ea8-b113-9163c935d38e} - O16 - DPF: {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} (FHFMMObj Class) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O19 - User stylesheet: C:\WINNT\Web\oslogo.bmp Needless to say, I deeply resent being invaded. Can you help me fix this problem? Thanks, birdy

Boy, What a mess...You are infected with W32.Welchia, Backdoor.IRC.Zcrew and a CoolWebSearch hijack. First, go here and download and run the W32.Welchia removal tool: W32.Welchia.worm Removal Tool Then Download and run CWShredder: CWShredder Then run HT again and check the following items. Next, close all browser Windows, and have HT fix all checked. O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - C:\WINNT\fhfmm.dll O2 - BHO: DNSErr object - {1E1B2879-88FF-11D2-8D96-D7ACAC95951F} - C:\WINNT\DNSErr.dll O2 - BHO: WinShow module - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - C:\WINNT\winshow.dll (file missing) O4 - HKLM\..\Run: [Ntsys] ntsys.exe After fixing, boot into safe mode and delete the following files: C:\WINNT\System32\ntsys.exe C:\winnt\web\printers\images\explorer.exe Reboot to Windows, and if you didn't install DameWare remote control client, see this on how to remove it: http://www.bionics.co.uk/_site/kb/0089170000.htm After that, go here and run an online virus scan, if anything is found, copy the report and paste it in a reply along with a new HT log. RAV

Thanks Tom, for such a quick response. I'm just wondering where CWShredder originates, because the server address doesn't mean much to me. At the Symantec site, there's all kinds of helpful warnings, but in the case of CWShredder, it's go or don't. Am I running any risks downloading it? Thanks, birdy

CWShredder originates from Spywareinfo...

shedder is safe to d/l and use.

Hey guys, I'm having the same problem as birdy. I have downloaded and run spybot and adware and removed what they found. Here is my log from hijack this Logfile of HijackThis v1.97.2 Scan saved at 5:08:32 PM, on 9/22/03 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v5.00 (5.00.2614.3500) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\SPOOL32.exe C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.exe C:\WINDOWS\SYSTEM\MDM.exe C:\WINDOWS\SYSTEM\LEXBCES.exe C:\WINDOWS\SYSTEM\RPCSS.exe C:\WINDOWS\SYSTEM\LEXPPS.exe C:\WINDOWS\EXPLORER.exe C:\WINDOWS\TASKMON.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.exe C:\PROGRAM FILES\AIM95\AIM.exe C:\WINDOWS\SYSTEM\WMIEXE.exe C:\WINDOWS\SYSTEM\DDHELP.exe C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.exe C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.exe C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.exe C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.ewebsearch.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.ewebsearch.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.ewebsearch.net/sp.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ewebsearch.net/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.ewebsearch.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.ncsu.edu/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.ewebsearch.net/ R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [vptray] C:\Program Files\Norton AntiVirus\vptray.exe O4 - HKLM\..\Run: [LexStart] lexstart.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\RunServices: [rtvscn95] C:\Program Files\Norton AntiVirus\rtvscn95.exe O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.exe O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM95\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [iedll] C:\WINDOWS\iedll.exe O4 - HKCU\..\Run: [loader] C:\WINDOWS\LOADER.exe O4 - Startup: <nobr><a class="iAs" style="border-bottom:darkgreen 1px solid;text-decoration:underline;color:darkgreen;background-color:transparent;" href="http://itxt.vibrantmedia.com/al.asp?ipid=7&cc=us&di=46900&ts=1471675&redir=http://www5.overture.com/d/sr/?xargs=02u3hs9yoakGVuyzCDRRClf3ibGgfAP2F4gVUpUCiL7agCPidjIajGps0kl99KmNVVN5FzM9Y00z1j36T%2Ba0et%2FPp23Tg7A%2Byemw3ZwVJ2Vj5%2FptY2H%2FW%2B%2BhuikKAjAQMEK%2BNWklQLVtjLz1vdN7RTpiI6EACvVWj77l%2F8Im4DMzcBg3bmjdPRw2nZTHi%2B5n2okthENCIi1AOJeJKRAYJKupBK55qqgPnadova8nM131q26w%2Br%2FV8w%2BY%2BNatdPU%2F9nqKtJ4PnJJzrGeSpo4vAHCFhfzGBLBSA4X1Xl7PZTcp3h9snjIIatwUtISMzTmZcS5BkiyR%2F4fLre%2BVr1qEJeF5Tk065HNTt%2B2VD22MaOJW3EMRYsAnFa33vv3Q%3D%3D" target="_blank" oncontextmenu="return false;" onmouseover="kwE(event,0);" onmouseout="kwL(event);" onmousemove="kwM(0);">Microsoft Office</nobr>.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: AltaVista Home - http://jump.altavista.com/avie5/home O8 - Extra context menu item: AV Search This Term - http://jump.altavista.com/avie5/search O8 - Extra context menu item: AV Translate this Web Page - http://jump.altavista.com/avie5/babelfish O8 - Extra context menu item: AV Translate Selection - http://jump.altavista.com/avie5/babelfish O9 - Extra 'Tools' menuitem: &AltaVista Home (HKLM) O9 - Extra button: Translate (HKLM) O9 - Extra 'Tools' menuitem: AV &Translate (HKLM) O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL (HKLM) O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host (HKLM) O9 - Extra button: AIM (HKLM) O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37574.7599537037 O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/0123294a73597f306b00/netzip/RdxIE601.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/d052c1d7d32ead/housecall.antivirus.com/housecall/xscan53.cab Thanks wolf

wolfpack81 Download and run CWShredder, then post a new HT log. CWShredder