Home Page

[wallie32]

A strange thing has occured regarding my home page in Internet Explorer.
I had Google as my home page now it has changed to:

http://www.software4download.com

If I use the usual method to change it back to Google ie
Go to Google then Internet Options>Use Current>Apply
it is o/k till I boot up againg then it reverts back to

http://www.software4download.com

I have tried running CWS shredder,Skybot and Ad Aware but its still the same.
Any suggestions greatly appreciated.
wallie

 

[carrr]

Download Hijack THis! Scan your pc and post a log here for input.

 

[clayton74]

Have you tried editing the registry?

 

[flyingwolf23]

if the person has never heard of a browser hijack than its probably safe ti assume we sould not tell then to edit the registry.


clayton74
Have you tried editing the registry?

Semper Fi

http://www.jnatek.kicks-ass.net

http://www.awh.kicks-ass.net

http://www.baby-james.kicks-ass.net

My new Baby BOY!!

 

[SYAR2003]

Download the program "hijackthis"
from this location.

http://www.spywareinfo.com/downloads.php?cat=sp#det

Log the result it finds and copy / paste it in to
this forum thread.

Don't use it to fix anything yet.

 

[doc32]

This is the log file:
I noticed a line referring to the culprit,Software4download


Logfile of HijackThis v1.97.7
Scan saved at 13:44:39, on 06/12/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Program Files\Medion Home Cinema XL II\PowerCinema\PCMService.exe
C:\WINDOWS\System32\PRISMSTA.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\WINDOWS\DitExp.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\eMule\emule.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\Norma Davidson\Local Settings\Temporary Internet Files\Content.IE5\SLIZ01QN\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.software4download.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.aldi.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext =

http://www.aldi.com/

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Medion Home Cinema XL II\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AntivirusRegistration] C:\Program Files\Excid.com Aps\eTrust Antivirus Registration\EzAntivirusRegistrationCheck.exe
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [@SoftUKgb-htm] RunDll32 UDConn.dll,RunAsIcon @SoftUKgb
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {2F0D1DA3-F3E4-4C67-BB5C-5AFD70C1A4A5} (UDConnect Class) -

http://01.sharedsource.org/html/UDConn_5.2.0.9.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37909.1316898148

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

 

[bcastner]

Generally speaking it is not a great idea to be running Kazaa/Altnet and eMule while diagnosing problems with your internet access.


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.software4download.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.aldi.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext =

http://www.aldi.com/

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART

O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {2F0D1DA3-F3E4-4C67-BB5C-5AFD70C1A4A5} (UDConnect Class) -

http://01.sharedsource.org/html/UDConn_5.2.0.9.cab

Reboot and Delete:
The folder C:\WINDOWS\System32\P2P NetworkingThe Folder C:\Program Files\MyWay
Reboot in Normal mode and run AdAware with updated definitions, and SpyBot 1.2 with updated definitions.

 

[SYAR2003]

Any info on this
C:\WINDOWS\CNYHKey.exe

O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe

Files that run from directly under the \windows directory
as processes i generally don't like.

Bill ?

 

[bcastner]

Chiconey keyboard utility I thought, as was [CHotkey] mHotkey.exe

But that was my guess.

 

[SYAR2003]

Try searching the net on that exe file
and dont give any hits.
But that could of course bee good , it it was
fishy some hits would certainly appear.

Okay , so it's legit .
Fine ,i'll try to remember that one.