Homepage changing to allneedsearch

Computing.Net > Forums > Security and Virus > Homepage changing to allneedsearch

Homepage changing to allneedsearch

Original Message

Name: mpcunnin
Date: February 19, 2004 at 09:16:08 Pacific
Subject: Homepage changing to allneedsearch
OS: Windows XP Pro SP1
CPU/Ram: PIII 791 MHz/ 498 MB

Comment:

Help my homepage keeps changing to allneedsearch.com. My favorites keep getting porn links.

Matt

Report Offensive Message For Removal

Response Number 1

Name: mpcunnin
Date: February 19, 2004 at 09:20:53 Pacific
Subject: Homepage changing to allneedsearch

Reply: (edit)

here is the HiJackThis log file...can you help me?
Logfile of HijackThis v1.97.7
Scan saved at 11:51:29 AM, on 2/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\S3tray2.exe
C:\WINDOWS\essspk.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlogon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HiJackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://allneedsearch.com/spm.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://allneedsearch.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allneedsearch.com/
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://awebfind.biz/sp.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.alfa-search.com/start.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yourbookmarks.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://awebfind.biz/sp.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://allneedsearch.com/spm.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://allneedsearch.com/
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://in.webcounter.cc/--/?cwvag (obfuscated)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [windows auto update] msblast.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [Soundmx] C:\WINDOWS\System32\soundmx.exe
O4 - HKLM\..\RunServices: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: winlogon.exe
O16 - DPF: {11111111-1111-1111-1111-111111111118} - file://c:\Program Files\mscfg.exe
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38034.5703125
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = geaecoflex.com
O17 - HKLM\Software\..\Telephony: DomainName = geaecoflex.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{4AEC70C6-50D0-48BD-8319-F3F08A6EC303}: NameServer = 192.168.115.200,205.152.133.254
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = geaecoflex.com
O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [windows auto update] msblast.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [Soundmx] C:\WINDOWS\System32\soundmx.exe
O4 - HKLM\..\RunServices: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: winlogon.exe
O16 - DPF: {11111111-1111-1111-1111-111111111118} - file://c:\Program Files\mscfg.exe
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38034.5703125
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = geaecoflex.com
O17 - HKLM\Software\..\Telephony: DomainName = geaecoflex.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{4AEC70C6-50D0-48BD-8319-F3F08A6EC303}: NameServer = 192.168.115.200,205.152.133.254
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = geaecoflex.com
O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)
Matt

Report Offensive Follow Up For Removal

Response Number 2

Name: ranchhand
Date: February 19, 2004 at 14:22:07 Pacific
Subject: Homepage changing to allneedsearch

Reply: (edit)

I'm not too good at reading HT listings, but I see MSBLAST referenced in there. That definitely has to go.
Also, download and install
>Spywareblaster
>Spybot S&D
>Lavasoft Adaware
**just search on Google for those titles.
Update the indexes immediately and run all three of them; chances are that will take care of your probs.

Report Offensive Follow Up For Removal

Response Number 3

Name: faizy
Date: February 20, 2004 at 12:21:38 Pacific
Subject: Homepage changing to allneedsearch

Reply: (edit)

use an anti virus (norton anti virus)
1. update your anti virus
2. go to safe mode and check for viruses
3. note the name of the vorus
4. virus that you find delete it
5. restart your system again in safe mode
6. go to find files and search for the virus if found, delete it
7. go to registry (run->regedit) and in \HKEY_current_user\software\microsfot\internet explorer delete andy file that contains search URL....
and few other things you should do that i m now tired of typing....sorry
go to your antivirus www and look for help

Report Offensive Follow Up For Removal


Homepage changing to Searchpage.cc My Homepage changes- HiJackThis log Homepage changed? homepage address changed to c:/spex Homepage changes!!!	IE homepage resets to porn site Default IE homepage changed My homepage won't work mouse pointer changes to a bar code account changed to limited, virus?

NEW: CoolWWWSearch

FTC having conference on ...

Use following form to reply to current message:

Name: From My Computing.Net Settings E-Mail: From My Computing.Net Settings Subject: Homepage changing to allneedsearch

Comments:

  Homepage URL (*): 
Homepage Title (*): 
         Image URL:

Parallels and Windows Domains

OS Install Failure

Vista and Dual Core Athlon

How to stop scanning while opening

open dialog

All Posts Awaiting Replies