Computing.Net > Forums > Security and Virus > Homepage keeps on getting hijacked

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Homepage keeps on getting hijacked

Reply to Message Icon

Name: admiralakbar
Date: December 14, 2003 at 20:56:45 Pacific
OS: Windows XP
CPU/Ram: P4 1.5 Ghz/256 mb sdram
Comment:

I'm having problems with my computer at the moment. Every time I try to reset my homepage, it changes back to www.search-space.com. Other problems that have popped up include trouble opening links, inability to use my search command under start, general difficulty using internet explorer(I use mozilla for now, because IE doesnt work), and lots of freezing and programs stopping. I tried spybot s&d as well as adaware, and neither worked.

Any advice?




Sponsored Link
Ads by Google

Response Number 1
Name: Kevin The Tech Dude
Date: December 14, 2003 at 21:21:32 Pacific
Reply:

Get this and post the log file

Hijackthis

KTTD



0

Response Number 2
Name: sid
Date: December 14, 2003 at 23:44:39 Pacific
Reply:

Go to www.javacoolsoftware.com and download spyware guard!


0

Response Number 3
Name: Valerie
Date: December 14, 2003 at 23:48:45 Pacific
Reply:

When you've cleaned up your system goto

http://www.wilderssecurity.com/bhblaster.html

and download/install Browser Hijack Blaster and have it running when you are surfing. It will detect any attempt to alter your Browser homepage setting and give you options

Good luck

V...


0

Response Number 4
Name: Johnw
Date: December 15, 2003 at 03:13:07 Pacific
Reply:

http://beam.to/spybotsd

Once you have the program installed, open SpyBot and select the "Immunize" icon on the left & Click on Immunize , in the new page .
Then check the box "lock hosts file read-only as protection against hijackers".

Make sure you use the SpyBot Update button regularly .


0

Response Number 5
Name: Admiralakbar
Date: December 16, 2003 at 18:40:09 Pacific
Reply:

Ah thank you. Here's the log file.

Logfile of HijackThis v1.97.7
Scan saved at 9:39:07 PM, on 12/16/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\STOPzilla!\szntsvc.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\AIM\aim.exe
C:\Documents and Settings\WAHEED AKBAR\Desktop\Stuff\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-space.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-space.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.search-space.com/
O2 - BHO: (no name) - {00110011-4B0B-44D5-9718-90C88817369B} - C:\WINDOWS\NavExt.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\System32\StopzillaBHO.dll
O2 - BHO: (no name) - {f760cb9e-c60f-4a89-890e-fae8b849493e} - C:\WINDOWS\madise.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\QUICKENW\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/d2c89f68a1bb5a/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37962.795787037
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} (IRDIXAObj Class) -



0

Related Posts

See More



Response Number 6
Name: Admiralakbar
Date: December 17, 2003 at 19:28:56 Pacific
Reply:

I deleted these

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-space.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-space.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.search-space.com/

But still didnt work, and those things keep on getting re-added. Please, someone check this.


0

Response Number 7
Name: Abnormal
Date: December 18, 2003 at 20:00:43 Pacific
Reply:

Try cwshredder, whatever version works
for you.
cwshredder.zip

cwshredder.exe

Good luck


0

Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: Homepage keeps on getting hijacked

home page is getting hijacked www.computing.net/answers/security/home-page-is-getting-hijacked/13776.html

Urgent help on browser hijacker!! www.computing.net/answers/security/urgent-help-on-browser-hijacker/9871.html

cool-homepage hijack www.computing.net/answers/security/coolhomepage-hijack/7347.html