Hey! I've got a really tough one. I've already asked some people and no one knows how to help me on this one! I'm not sure how this came about because I was out of town when it happened. But when I got back I tried opening up a normal site (ex: www.google.com) but instead of it opening, a string of random url was added to the beginning therefore making the url unknown and not displaying the site. I've found that I can type http://google.com and it works.. but I really wish I could set it back to normal. I thought it might have something to do with cookies or something that got on my computer but I went in and deleted those and it is still messed up. Help me if you can! I'd really appreciate it! Thanks

Hi Friend, You might face these knid of problems if there is some problem with your Internet explorer.So please try repairing internet explorer which might solve the problem you are facing. To use the Internet Explorer Repair tool: Click Start, point to Settings, click Control Panel, and then double-click Add/Remove Programs. On the Install/Uninstall tab, click Microsoft Internet Explorer 5, click Add/Remove, click Repair the current installation of Internet Explorer, and then click OK. Regards, Qgenie.

Qgenie- Thanks so much for the input, but unfortunatly that didn't help. If you have any other ideas I would love to hear them. Thanks again. Erin

Hi Erin, Please download the program HijackThis from http://www.tomcoyote.org/hjt/ then scan and save the log, then post your logfile here, we will try to help you get rid of the problem. Mark

Hey Michael, Here's my log Logfile of HijackThis v1.96.0 Scan saved at 11:38:26 AM, on 8/7/2003 Platform: Windows 2000 SP2 (WinNT 5.00.2195) MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\COMPAQ\ACLIENT\ACLIENT.exe C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe C:\WINNT\Cpqdiag\Cpqdfwag.exe C:\PROGRA~1\Compaq\COMPAQ~2\CPQWEB~1\WebDmi.exe C:\WINNT\System32\svchost.exe C:\Program Files\Compaq\LCRMS\LCRMS.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINNT\System32\NMSSvc.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\PROGRA~1\Compaq\COMPAQ~2\cpqdmi.exe C:\WINNT\Explorer.exe C:\WINNT\System32\ltmsg.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.exe C:\WINNT\System32\Promon.exe C:\PROGRA~1\Compaq\COMPAQ~2\CHKADMIN.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\WINNT\loadqm.exe C:\WinAmp\Winamp3\winampa.exe C:\Program Files\MSN Messenger\MsnMsgr.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\AIM\aim.exe C:\Program Files\AT&T\WnClient\Programs\WNConnect.exe C:\PROGRA~1\AT&T\WnClient\Programs\WNCSMS~1.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WinAmp\Winamp3\winamp3.exe C:\WinZip\WINZIP32.exe C:\WINZIP\wzqkpick.exe C:\Documents and Settings\Erin\Local Settings\Temp\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKCU\Software\Microsoft\Internet Explorer,Search Page = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.worldnet.att.net/ie4/search/index.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.kazaa-lite.ws/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.att.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\System32\blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Use Custom Search URL = O1 - Hosts: 65.77.83.222 thehun.com O1 - Hosts: 65.77.83.222 thehun.net O1 - Hosts: 65.77.83.222 madthumbs.com O1 - Hosts: 65.77.83.222 worldsex.com O1 - Hosts: 65.77.83.222 teeniefiles.com O1 - Hosts: 65.77.83.222 al4a.com O1 - Hosts: 65.77.83.222 sublimedirectory.com O1 - Hosts: 65.77.83.222 thumbzilla.com O1 - Hosts: 65.77.83.222 sexocean.com O1 - Hosts: 65.77.83.222 easypic.com O1 - Hosts: 65.77.83.222 absolut-series.com O1 - Hosts: 65.77.83.222 jpeg4free.com O1 - Hosts: 65.77.83.222 thumbnailpost.com O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9 O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [cpqek] C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.exe O4 - HKLM\..\Run: [Promon.exe] Promon.exe O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~2\CHKADMIN.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] "C:\WinAmp\Winamp3\winampa.exe" O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINNT\Cpqdiag\CpqDfwAg.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background O4 - HKCU\..\Run: [AIM] C:\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\WinZip\WZQKPICK.exe O9 - Extra button: AIM (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O13 - DefaultPrefix: http://vrape.hardloved.com/top/search.php?id=1&s= O13 - WWW Prefix: http://vrape.hardloved.com/top/search.php?id=1&s= O14 - IERESET.INF: START_PAGE_URL=http://www.att.net O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by7fd.bay7.hotmail.msn.com/activex/HMAtchmt.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{9E32FD08-629B-4491-AC2A-6E5A2782F59A}: NameServer = 204.127.160.1 12.102.240.1 Thanks a bunch!! -Erin

Hi Erin, First run an updated Spybot Search and Destroy ( http://security.kolla.de/ ) and fix all items in RED and reboot. Then after closing all browser windows, fix the items listed below that are remaining using HijackThis and then reboot again. R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKCU\Software\Microsoft\Internet Explorer,Search Page = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.worldnet.att.net/ie4/search/index.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.kazaa-lite.ws/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://vrape.hardloved.com/top/search.php?id=1&s= R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://vrape.hardloved.com/top/search.php?id=1&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Use Custom Search URL = O1 - Hosts: 65.77.83.222 thehun.com O1 - Hosts: 65.77.83.222 thehun.net O1 - Hosts: 65.77.83.222 madthumbs.com O1 - Hosts: 65.77.83.222 worldsex.com O1 - Hosts: 65.77.83.222 teeniefiles.com O1 - Hosts: 65.77.83.222 al4a.com O1 - Hosts: 65.77.83.222 sublimedirectory.com O1 - Hosts: 65.77.83.222 thumbzilla.com O1 - Hosts: 65.77.83.222 sexocean.com O1 - Hosts: 65.77.83.222 easypic.com O1 - Hosts: 65.77.83.222 absolut-series.com O1 - Hosts: 65.77.83.222 jpeg4free.com O1 - Hosts: 65.77.83.222 thumbnailpost.com O13 - DefaultPrefix: http://vrape.hardloved.com/top/search.php?id=1&s= O13 - WWW Prefix: http://vrape.hardloved.com/top/search.php?id=1&s= You should also do a Windows Update as there are currently security updates for both Windows 2000 and Internet Explorer. -Platform: Windows 2000 is currently at SP4 -MSIE: Internet Explorer is currently at v6.00 SP1 -------------- For the future see: So how did I get infected in the first place? http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi?;act=ST;f=38;t=3051 In addition to using SpywareBlaster (mentioned in the thread) I would also use SpywareGuard http://www.wilderssecurity.net/spywareguard.html Four of the most recommended anti-spyware programs are SpywareBlaster and SpywareGuard and Spybot S&D and Ad-aware. If you install all four programs, keep them updated, and scan with Spybot S&D and Ad-aware periodically, you will be fairly well-protected from spyware. Thought I would mention that SpywareGuard includes a browser hijack stopper (Javacool calls it Browser Hijack Blaster) that protects your system from browser hijackers and spyware that alters your Internet Explorer settings. Good Luck!

THANK YOU SOO MUCH!! I really appreciate it! -Erin