HI!! need help please! My IE 6.0 Homepage changes everytime I start my PC. Since some time ago, this is happeening and Im tired of this. I have ZomeAlarm, Cleanup, Ad-aware. I have ran all this program and nothing seems to be working! :(. Can you please help me?

http://patrick.kolla.de/spybotsd.html Spybot Search & Destroy http://www.spywareinfo.com/hijacked.html hijacked homepage

And if Spybot S&D does not solve your problem go to http://www.tomcoyote.org/hjt/ and download HijackThis. After starting HijackThis, click the scan button which will change into a save log button. Save the logfile and also copy and paste the results back here in this thread. Most items reported by HijackThis are valid, so don’t fix anything yet.

You can also download this free software, Start Page Guard, which should solve your problems. Download from: http://pjwalczak.com/spguard/index.php HTH

I ran Spybot S&D and it didnt work I still have the same problem :( I went to Hijacthis and this is the result, hope you can help me fix this Setter. Thank you very much in advance! Ishia ***** Hijackthis results******* Logfile of HijackThis v1.96.1 Scan saved at 12:28:45, on 8/21/03 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WIN2\SYSTEM\KERNEL32.DLL C:\WIN2\SYSTEM\MSGSRV32.exe C:\WIN2\SYSTEM\SPOOL32.exe C:\WIN2\SYSTEM\MPREXE.exe C:\WIN2\SYSTEM\MSTASK.exe D:\AVG\AVGSERV9.exe C:\WIN2\SYSTEM\ZONELABS\VSMON.exe C:\WIN2\SYSTEM\LEXBCES.exe C:\WIN2\SYSTEM\RPCSS.exe C:\WIN2\SYSTEM\mmtask.tsk C:\WIN2\EXPLORER.exe C:\WIN2\TASKMON.exe D:\POPUP KILLER\POPUPKILLER.exe D:\AVG\AVGCC32.exe C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.exe D:\APN\EM2.exe C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.exe C:\WIN2\RunDLL.exe D:\ZONEALARM\ZAPRO.exe C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.exe D:\PSP 7.0\PSP.exe C:\WIN2\SYSTEM\PSTORES.exe D:\WINRAR\WINRAR.exe C:\WIN2\TEMP\RAR$EX00.705\HIJACKTHIS.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://rd.yahoo.com/customize/ymsgr/defaults/*http://my.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.yahoo.com/customize/ymsgr/defaults/su/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 209.242.141.4:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = F1 - win.ini: run=Crack.bat O1 - Hosts: 207.44.160.36 www.whyppc.com O1 - Hosts: 207.250.236.120 pops.freeze.com O1 - Hosts: 216.98.150.253 www.bestdealcomputers.com O1 - Hosts: 200.68.192.252 www.oportunidades.com O1 - Hosts: 66.63.128.83 www.computoredge.com O1 - Hosts: 209.132.127.248 advertisers.computoredge.com O1 - Hosts: 69.20.5.164 www.cashforclicks.com O1 - Hosts: 216.98.132.237 www.cuponexpress.com O1 - Hosts: 200.52.83.113 www.fundacionproninez.org.mx O1 - Hosts: 209.217.54.235 www.instantips.com O1 - Hosts: 212.187.242.217 insight.zdnet.co.uk O1 - Hosts: 212.187.242.200 news.zdnet.co.uk O1 - Hosts: 63.210.164.73 www.microsoft.com O1 - Hosts: 217.160.31.195 security.kolla.de O1 - Hosts: 203.55.198.7 spybot.eon.net.au O1 - Hosts: 202.157.185.108 ejrs.com O1 - Hosts: 216.74.132.12 view.atdmt.com O1 - Hosts: 216.235.147.35 www.computing.net O1 - Hosts: 193.86.103.19 www.grisoft.com O1 - Hosts: 216.40.224.220 www1.paypopup.com O1 - Hosts: 66.28.225.72 www.buscaremedios.com O1 - Hosts: 66.7.164.245 ad3.hgmnetwork.com O1 - Hosts: 66.7.164.241 www.publiservicio.com O1 - Hosts: 62.175.241.134 09.sharedsource.org O1 - Hosts: 205.180.85.60 media20.fastclick.net O1 - Hosts: 216.102.246.27 64.35.113.133 O1 - Hosts: 64.246.11.23 www3.paypopup.com O1 - Hosts: 206.16.1.197 download-search.search.com.com O1 - Hosts: 206.16.0.134 download.com.com O1 - Hosts: 198.65.135.85 www.broadbandwizard.net O1 - Hosts: 200.77.213.249 cmas-tj.cablemas.com O1 - Hosts: 12.129.225.118 www.cinemastar.net O1 - Hosts: 205.180.85.68 media28.fastclick.net O1 - Hosts: 205.180.85.40 205.180.85.40 O1 - Hosts: 207.44.156.26 www2.paypopup.com O1 - Hosts: 216.73.87.82 ad.doubleclick.net O1 - Hosts: 216.239.53.99 www.google.com.mx O1 - Hosts: 66.163.171.128 login.yahoo.com O1 - Hosts: 66.163.171.129 my.yahoo.com O1 - Hosts: 66.218.66.241 espanol.groups.yahoo.com O1 - Hosts: 66.150.161.134 69.57.140.27 O1 - Hosts: 64.246.53.147 www.herzeleid.com O1 - Hosts: 66.218.66.240 groups.yahoo.com O1 - Hosts: 208.245.212.9 www.n-connect.net O1 - Hosts: 195.70.35.155 autokereskedes.info O1 - Hosts: 216.40.250.58 www4.paypopup.com O1 - Hosts: 209.247.51.16 pub16.ezboard.com O1 - Hosts: 216.239.59.99 www.google.com.ar O1 - Hosts: 128.242.246.89 www.hboplus-la.tv O1 - Hosts: 128.242.246.62 www.hbo-la.tv O1 - Hosts: 216.239.41.99 www.google.com O2 - BHO: (no name) - {02478D28-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_0_2_6.DLL O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WIN2\SYSTEM\NZDD.DLL O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file) O2 - BHO: (no name) - {6754A456-BAD9-11D4-93D3-00B0D03A2F91} - (no file) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\win2\downloaded program files\googletoolbar_en_1.1.70-deleon.dll O2 - BHO: (no name) - {1D870C86-AA3C-4451-81E4-71D480A1A652} - C:\WIN2\SYSTEM\SBSRCH_V22.DLL (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN2\SYSTEM\MSDXM.OCX O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_0_2_6.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\win2\downloaded program files\googletoolbar_en_1.1.70-deleon.dll O4 - HKLM\..\Run: [ScanRegistry] C:\WIN2\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WIN2\taskmon.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [PopUpKiller] D:\POPUP KILLER\POPUPKILLER.exe O4 - HKLM\..\Run: [AVG_CC] D:\AVG\avgcc32.exe /STARTUP O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [EasyMessage] D:\APN\EM2.exe O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [MiniLog] C:\WIN2\SYSTEM\ZONELABS\MINILOG.exe -service O4 - HKLM\..\RunServices: [Amdfix] C:\WIN2\SYSTEM\amdfix.exe O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [Avgserv9.exe] D:\AVG\Avgserv9.exe O4 - HKLM\..\RunServices: [TrueVector] C:\WIN2\SYSTEM\ZONELABS\VSMON.exe -service O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY O4 - HKCU\..\Run: [OWMngr] C:\WIN2\SYSTEM\OWMngr.exe O4 - Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Global Startup: ZoneAlarm Pro.lnk = D:\ZoneAlarm\zapro.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\INCRED~1\bin\resources\WebMenuImg.htm O8 - Extra context menu item: &Google Search - res://C:\WIN2\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmsearch.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WIN2\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\WIN2\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmsimilar.html O8 - Extra context menu item: Backward &Links - res://C:\WIN2\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmbacklinks.html O8 - Extra context menu item: Translate Page - res://C:\WIN2\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmtrans.html O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\LimeShop\System\Temp\limeshop_script0.htm O9 - Extra button: Real.com (HKLM) O9 - Extra button: Translate (HKLM) O9 - Extra 'Tools' menuitem: Translator (HKLM) O9 - Extra button: ICQ Pro (HKLM) O9 - Extra 'Tools' menuitem: ICQ (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: ICQ Surf (HKLM) O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O13 - DefaultPrefix: http://auto.search.msn.com:3128@%61%72%68%65%6F%2E%63%6F%6D/%63%67%69%2D%62%69%6E/c.pl?url= O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.82.221.103/14af77c7f6cd719cfc05/netzip/RdxIE.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.communities.msn.com/controls/FileUC/MsnUpld.cab O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://216.65.38.226/Download_Plugin.exe O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003050501/housecall.antivirus.com/housecall/xscan53.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {713AE1D4-897C-11D2-B2A0-00C04F94B4D5} (WUCorpSuppControl Class) - http://corporate.windowsupdate.microsoft.com/en/wucorpct.CAB O16 - DPF: {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} (Google Script Object) - http://activex.microsoft.com/objects/ocget.dll O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.kats-korner.com/wfplayer/tdserver.cab O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/my/yiebio5_0_2_7.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37615.0512152778 O16 - DPF: Yahoo! Chat 1.3 - http://cs8.chat.sc5.yahoo.com/c174/chat.cab O16 - DPF: {53E10C2C-43B2-4657-BA29-AAE179E7D35C} - http://www.adsrvr.com/auth/IE_InstllC.exe O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab O16 - DPF: Yahoo! Chat - http://cs6.chat.sc5.yahoo.com/c381/chat.cab O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) - O16 - DPF: {3717DF57-0396-463D-98B7-647C7DC6898A} - http://delivery.inet-traffic.com/intdel.exe O16 - DPF: YExplorer1_8US.CAB - http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://photos.msn.com/r/neutral/controls/MsnPUpld.cab?5,0,1730,0 O16 - DPF: {FC87A650-207D-4392-A6A1-82ADBC56FA64} (MultiDist) - http://xbs.mtree.com/mt/dialers/fc/MultiDistFC.CAB O16 - DPF: {99E79790-2B09-11D6-8C73-0800460222F0} - http://www.accessplugin.com/plug/install.cab O16 - DPF: {AFDBB6D0-6B96-419C-8BC6-FF0B99368C0B} - http://www.memorymeter.com/MemoryMeter.cab

Hi Ishia, Run an UPDATED Spybot Search and Destroy ( http://security.kolla.de/ ) and fix all items in RED and reboot. Then after closing all browser windows, fix the items listed below that are remaining using HijackThis and then reboot again. R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = F1 - win.ini: run=Crack.bat The F1 items are usually very old programs that are safe, so you should find more info on this filename to see if it's good or bad. The name Crack.bat just has to be something that is up to no good :-) However, I don’t know. If you are not responsible for the following O1-Hosts entries in your Hosts File, then fix them all. ------------------ O1 - Hosts: 207.44.160.36 www.whyppc.com O1 - Hosts: 207.250.236.120 pops.freeze.com O1 - Hosts: 216.98.150.253 www.bestdealcomputers.com O1 - Hosts: 200.68.192.252 www.oportunidades.com O1 - Hosts: 66.63.128.83 www.computoredge.com O1 - Hosts: 209.132.127.248 advertisers.computoredge.com O1 - Hosts: 69.20.5.164 www.cashforclicks.com O1 - Hosts: 216.98.132.237 www.cuponexpress.com O1 - Hosts: 200.52.83.113 www.fundacionproninez.org.mx O1 - Hosts: 209.217.54.235 www.instantips.com O1 - Hosts: 212.187.242.217 insight.zdnet.co.uk O1 - Hosts: 212.187.242.200 news.zdnet.co.uk O1 - Hosts: 63.210.164.73 www.microsoft.com O1 - Hosts: 217.160.31.195 security.kolla.de O1 - Hosts: 203.55.198.7 spybot.eon.net.au O1 - Hosts: 202.157.185.108 ejrs.com O1 - Hosts: 216.74.132.12 view.atdmt.com O1 - Hosts: 216.235.147.35 www.computing.net O1 - Hosts: 193.86.103.19 www.grisoft.com O1 - Hosts: 216.40.224.220 www1.paypopup.com O1 - Hosts: 66.28.225.72 www.buscaremedios.com O1 - Hosts: 66.7.164.245 ad3.hgmnetwork.com O1 - Hosts: 66.7.164.241 www.publiservicio.com O1 - Hosts: 62.175.241.134 09.sharedsource.org O1 - Hosts: 205.180.85.60 media20.fastclick.net O1 - Hosts: 216.102.246.27 64.35.113.133 O1 - Hosts: 64.246.11.23 www3.paypopup.com O1 - Hosts: 206.16.1.197 download-search.search.com.com O1 - Hosts: 206.16.0.134 download.com.com O1 - Hosts: 198.65.135.85 www.broadbandwizard.net O1 - Hosts: 200.77.213.249 cmas-tj.cablemas.com O1 - Hosts: 12.129.225.118 www.cinemastar.net O1 - Hosts: 205.180.85.68 media28.fastclick.net O1 - Hosts: 205.180.85.40 205.180.85.40 O1 - Hosts: 207.44.156.26 www2.paypopup.com O1 - Hosts: 216.73.87.82 ad.doubleclick.net O1 - Hosts: 216.239.53.99 www.google.com.mx O1 - Hosts: 66.163.171.128 login.yahoo.com O1 - Hosts: 66.163.171.129 my.yahoo.com O1 - Hosts: 66.218.66.241 espanol.groups.yahoo.com O1 - Hosts: 66.150.161.134 69.57.140.27 O1 - Hosts: 64.246.53.147 www.herzeleid.com O1 - Hosts: 66.218.66.240 groups.yahoo.com O1 - Hosts: 208.245.212.9 www.n-connect.net O1 - Hosts: 195.70.35.155 autokereskedes.info O1 - Hosts: 216.40.250.58 www4.paypopup.com O1 - Hosts: 209.247.51.16 pub16.ezboard.com O1 - Hosts: 216.239.59.99 www.google.com.ar O1 - Hosts: 128.242.246.89 www.hboplus-la.tv O1 - Hosts: 128.242.246.62 www.hbo-la.tv O1 - Hosts: 216.239.41.99 www.google.com O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file) O2 - BHO: (no name) - {6754A456-BAD9-11D4-93D3-00B0D03A2F91} - (no file) O2 - BHO: (no name) - {1D870C86-AA3C-4451-81E4-71D480A1A652} - C:\WIN2\SYSTEM\SBSRCH_V22.DLL (file missing) O4 - HKCU\..\Run: [OWMngr] C:\WIN2\SYSTEM\OWMngr.exe OnWebMedia advertising foistware (Spybot S&D should have remove this program) O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O13 - DefaultPrefix: http://auto.search.msn.com:3128@%61%72%68%65%6F%2E%63%6F%6D/%63%67%69%2D%62%69%6E/c.pl?url= O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.82.221.103/14af77c7f6cd719cfc05/netzip/RdxIE.cab O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://216.65.38.226/Download_Plugin.exe O16 - DPF: {53E10C2C-43B2-4657-BA29-AAE179E7D35C} - http://www.adsrvr.com/auth/IE_InstllC.exe O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) - O16 - DPF: {3717DF57-0396-463D-98B7-647C7DC6898A} - http://delivery.inet-traffic.com/intdel.exe O16 - DPF: {FC87A650-207D-4392-A6A1-82ADBC56FA64} (MultiDist) - http://xbs.mtree.com/mt/dialers/fc/MultiDistFC.CAB O16 - DPF: {99E79790-2B09-11D6-8C73-0800460222F0} - http://www.accessplugin.com/plug/install.cab O16 - DPF: {AFDBB6D0-6B96-419C-8BC6-FF0B99368C0B} - http://www.memorymeter.com/MemoryMeter.cab After reboot then delete the following: The file OWMngr.exe at C:\WIN2\SYSTEM\OWMngr.exe Recommend making sure you have all the latest security updates. MSIE: Internet Explorer v6.00 is currently at SP1 -------------- For the future see: So how did I get infected in the first place? http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi?;act=ST;f=38;t=3051 Four of the most recommended anti-spyware programs are SpywareBlaster and SpywareGuard and Spybot S&D and Ad-aware. If you install all four programs, keep them updated, and scan with Spybot S&D and Ad-aware periodically, you will be fairly well-protected from spyware. Thought I would mention that SpywareGuard includes a browser hijack stopper (Javacool calls it Browser Hijack Blaster) that protects your system from browser hijackers and spyware that alters your Internet Explorer settings. Good Luck!