Tip: Run a free scan for common Windows errors ad

re: IE6 won't let me make msn default search engine Monday, September 1, 2003 at 8:56 pm Posted by Ms. Eagle (33507 messages posted) Kelly, that's the symptoms of a browser hijacker. There's a lot of that going on these days. First, run Spybot S&D to clean out as much spyware junk as possible. Download Spybot S&D After installing it, restart your computer. Then load it and go online and download "all" updates that aren't optional. Close all browser windows, then start it in Easy mode and run the scan. Then click 'Check All', and fix everything SpybotSD labels in red. Restart your computer. Then download this small application, "Hijack This" and follow instructions and post the logfile. 'Hijack This' Unzip 'HT' into a new folder. Then double click the .Exe file to run it. Choose Scan. It will display a list. Most of the things you see listed are necessary or required entries, so don't fix anything yet. The Scan button will turn into Save Log.Choose Save log, then click Edit - Select all and copy/paste the contents of the log file in a post, either here, on the Spywareinfo forums or on Spybot's support forums (last link). If you post here, PLEASE choose this Option below before posting the log, so it will be legible: Check this box to preserve your spacing.... Spywareinfo Hijacking Article So how did I get infected in the first place? [Reply or follow-up to this message] re: IE6 won't let me make msn default search engine Monday, September 1, 2003 at 9:21 pm Posted by Ms. Eagle (33507 messages posted) In addition, be sure to clear out your TIF and other temp files. Go to Start - Settings - Control Panel - Internet Options. Under the General tab click the Delete temporary internet files, choose to delete all Offline content. Next Start - Find - Files or folders - in the named box type: *.tmp and choose Edit - select all - File - delete. Empty the contents of the C:\Windows\temp folder and C:\temp folder, if you have one. Empty Recycle bin. Also, download this .reg file to your Desktop. Double-click on it and answer Yes, to merge into your registry. It will restore all the default Search settings for IE. IEFIX.reg [Reply or follow-up to this message] re: IE6 won't let me make msn default search engine Tuesday, September 2, 2003 at 8:52 am Posted by Kelly (7 messages posted) Thanks so much for replying with the correct fix Carol! I was so frustrated last night I searched until I found a chat group called TomCoyote and the ppl in there were able to walk me thru the same instructions that you've posted and got it up and running correctly. I guess I'll let my son live another day, but he better not use my pc anytime soon lol! Thanks again!! On Monday, September 1, 2003 at 8:56 pm, Carol wrote: > >Kelly, that's the symptoms of a browser hijacker. There's a lot of that going on >these days. First, run Spybot S&D to clean out as much spyware junk as possible. >Download Spybot S&D > >After installing it, restart your computer. Then load it and go online and download >"all" updates that aren't optional. Close all browser windows, then start it in Easy >mode and run the scan. Then click 'Check All', and fix everything SpybotSD labels >in red. Restart your computer. > >Then download this small application, "Hijack This" and follow instructions and post >the logfile. > >'Hijack This' > >Unzip 'HT' into a new folder. Then double click the .Exe file to run it. Choose Scan. >It will display a list. Most of the things you see listed are necessary or required >entries, so don't fix anything yet. The Scan button will turn into Save Log.Choose >Save log, then click Edit - Select all and copy/paste the contents of the log file >in a post, either here, on the Spywareinfo forums or on Spybot's support forums (last >link). > >If you post here, PLEASE choose this Option below before posting the log, so it will >be legible: Check this box to preserve your spacing.... >href="http://www.spywareinfo.com/articles/hijacked/"> >Spywareinfo Hijacking Article >color="FF69B4"> >So how did I get infected in the first place? > > [Reply or follow-up to this message] re: IE6 won't let me make msn default search engine Tuesday, September 2, 2003 at 12:44 pm Posted by Ms. Eagle (33507 messages posted) You're welcome, Kelly. I'm glad you got it taken care of and your son was spared. lol You sure didn't waste any time. I hope you check out the last link in my first post. It's a post on the Spybot support forums, with a very informative explanation and links to spyware preventive apps, etc. The key is to prevent it in the first place. The number of spyware related problems have gotten worse than viruses. [Reply or follow-up to this message] re: IE6 won't let me make msn default search engine Wednesday, September 3, 2003 at 11:32 am Posted by Kelly (7 messages posted) Carol, I have noticed 2 problems since I was "hijacked". I no longer have the yahoo address bar under my regular address bar, and when I open up the web, my page (window) isn't maximized. I can maximize after I open it, but it won't stay that way once I close and reopen...any suggestions?? Thank you, Kelly On Tuesday, September 2, 2003 at 12:44 pm, Carol wrote: > >You're welcome, Kelly. I'm glad you got it taken care of and your son was spared. >lol You sure didn't waste any time. I hope you check out the last link in my first >post. It's a post on the Spybot support forums, with a very informative explanation >and links to spyware preventive apps, etc. The key is to prevent it in the first >place. The number of spyware related problems have gotten worse than viruses. > > > > > >src=http://www.clicksmilie.de/sammlung/trave_abc/smilie_r.gif>src=http://www.clicksmilie.de/sammlung/trave_abc/smilie_l.gif> [Reply or follow-up to this message] re: IE6 won't let me make msn default search engine Friday, September 5, 2003 at 10:12 pm Posted by Ms. Eagle (33507 messages posted) Kelly, if you still haven't got these latest issues resolved, I suggest posting on the forum that helped with the hijacking, since I'm not sure what all they had you do. Maybe, they'll reopen your thread? Carol [Reply or follow-up to this message] re: IE6 won't let me make msn default search engine Thursday, October 30, 2003 at 7:20 pm Posted by jim (1 messages posted) When I download hijackthis and try to unzip it I get a message to inser the correct CD-ROM select OK and restart application. Any ideas on this message and how to unzip the file? On Monday, September 1, 2003 at 8:56 pm, Carol wrote: > >Kelly, that's the symptoms of a browser hijacker. There's a lot of that going on >these days. First, run Spybot S&D to clean out as much spyware junk as possible. >Download Spybot S&D > >After installing it, restart your computer. Then load it and go online and download >"all" updates that aren't optional. Close all browser windows, then start it in Easy >mode and run the scan. Then click 'Check All', and fix everything SpybotSD labels >in red. Restart your computer. > >Then download this small application, "Hijack This" and follow instructions and post >the logfile. > >'Hijack This' > >Unzip 'HT' into a new folder. Then double click the .Exe file to run it. Choose Scan. >It will display a list. Most of the things you see listed are necessary or required >entries, so don't fix anything yet. The Scan button will turn into Save Log.Choose >Save log, then click Edit - Select all and copy/paste the contents of the log file >in a post, either here, on the Spywareinfo forums or on Spybot's support forums (last >link). > >If you post here, PLEASE choose this Option below before posting the log, so it will >be legible: Check this box to preserve your spacing.... >href="http://www.spywareinfo.com/articles/hijacked/"> >Spywareinfo Hijacking Article >color="FF69B4"> >So how did I get infected in the first place? > > [Reply or follow-up to this message] re: IE6 won't let me make msn default search engine Thursday, October 30, 2003 at 10:38 pm Posted by Ms. Eagle (33507 messages posted) You need an unzipping program, if you haven't got one installed. You can create a new folder, called Hijack This and put it in your Programs Files directory after you've unzipped it. Then run the .EXE. WinZip UltimateZip Hijack This Tutorial [Reply or follow-up to this message] re: IE6 won't let me make msn default search engine Friday, November 7, 2003 at 8:37 pm Posted by Tony (1 messages posted) This is my logfile, and thank you so much for your help (If you read it!!!:)) Logfile of HijackThis v1.97.3 Scan saved at 10:33:54 PM, on 11/7/2003 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: E:\WINNT\System32\smss.exe E:\WINNT\system32\winlogon.exe E:\WINNT\system32\services.exe E:\WINNT\system32\lsass.exe E:\WINNT\system32\svchost.exe E:\WINNT\system32\spoolsv.exe E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe E:\WINNT\System32\svchost.exe C:\PROGRA~1\norton\NORTON~2\GHOSTS~2.EXE E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\norton\Norton AntiVirus\navapsvc.exe C:\Program Files\norton\Norton Utilities\NPROTECT.EXE E:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe E:\WINNT\system32\regsvc.exe E:\WINNT\system32\MSTask.exe C:\PROGRA~1\norton\SPEEDD~1\nopdb.exe E:\WINNT\System32\WBEM\WinMgmt.exe E:\WINNT\system32\MsPMSPSv.exe E:\WINNT\system32\svchost.exe E:\WINNT\Explorer.exe E:\Program Files\Common Files\Symantec Shared\SymTray.exe E:\WINNT\system32\cmd32.exe E:\WINNT\system32\S3tray2.exe E:\Documents and Settings\Mysteri\Desktop\HijackThis.exe E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb07.exe E:\Program Files\Yahoo!\browser\ybrwicon.exe E:\Program Files\Symantec\LiveUpdate\AUpdate.exe E:\Program Files\BroadJump\Client Foundation\CFD.exe E:\WINNT\System32\P2P Networking\P2P Networking.exe E:\PROGRA~1\YAHOO!\browser\ycommon.exe E:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\norton\Norton Ghost\GhostStartTrayApp.exe C:\program files\altnet\points manager\points manager.exe E:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe E:\WINNT\SM1BG.EXE E:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe E:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe E:\Program Files\AIM\aim.exe E:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe E:\WINNT\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe E:\Program Files\Microsoft Office\Office10\OSA.EXE E:\Program Files\WinZip\WZQKPICK.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) F0 - system.ini: Shell=Explorer.exe E:\WINNT\system32\cmd32.exe F2 - REG:system.ini: Shell=Explorer.exe E:\WINNT\system32\cmd32.exe O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - (no file) O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - E:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - E:\Program Files\Panicware\Pop-Up Stopper Pro\CCHelper.dll O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - E:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll O2 - BHO: (no name) - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - E:\WINNT\wsem216.dll O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\norton\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - E:\WINNT\nem214.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINNT\System32\msdxm.ocx O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - E:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\norton\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - E:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [YBrowser] E:\Program Files\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [BJCFD] E:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\Run: [tgcmdprovidersbc] "c:\program files\support.com\bin\tgcmd.exe" /server /startmonitor /deaf /nosystray O4 - HKLM\..\Run: [P2P Networking] E:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "E:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\norton\Norton Ghost\GhostStartTrayApp.exe O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] E:\Program Files\Common Files\Symantec Shared\Symtray.exe SetReg O4 - HKLM\..\Run: [RDLL] RunDll16.exe O4 - HKLM\..\Run: [WCOLOREAL] "E:\Program Files\WayTech\Coloreal\coloreal.exe" O4 - HKLM\..\Run: [PS2] E:\WINNT\system32\ps2.exe O4 - HKLM\..\Run: [NeroCheck] E:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [Internet Optimizer] "c:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SM1BG] E:\WINNT\SM1BG.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe O4 - HKLM\..\Run: [IPInSightMonitor 01] "E:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe" O4 - HKLM\..\Run: [82302492.exe] E:\WINNT\System32\82302492.exe O4 - HKLM\..\RunServices: [RDLL] RunDll16.exe O4 - HKLM\..\RunServices: [CMD] cmd32.exe O4 - HKCU\..\Run: [AIM] E:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Yahoo! Pager] E:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: WinZip Quick Pick.lnk = E:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! Dictionary - file:///E:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! Search - file:///E:\Program Files\Yahoo!\Common/ycsrch.htm O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: Flash Saver (HKLM) O9 - Extra 'Tools' menuitem: Flash Saver (HKLM) O9 - Extra button: Yahoo! Login (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab O16 - DPF: {20000273-8230-4DD4-BE4F-6889D1E74167} - http://download2.abetterinternet.com/download/cabs/FON19106/payload2.cab O16 - DPF: {23B7A816-3647-49D2-9756-6F41CE8F9201} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/ddm_control.CAB O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/FON19106/flash.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/sbcy/yinst.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/299b8406865c08d57103/netzip/RdxIE601.cab O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37922.7930671296 O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://download.yahoo.com/dl/installs/yab_af.cab O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/kdx.cab On Monday, September 1, 2003 at 8:56 pm, Carol wrote: > >Kelly, that's the symptoms of a browser hijacker. There's a lot of that going on >these days. First, run Spybot S&D to clean out as much spyware junk as possible. >Download Spybot S&D > >After installing it, restart your computer. Then load it and go online and download >"all" updates that aren't optional. Close all browser windows, then start it in Easy >mode and run the scan. Then click 'Check All', and fix everything SpybotSD labels >in red. Restart your computer. > >Then download this small application, "Hijack This" and follow instructions and post >the logfile. > >'Hijack This' > >Unzip 'HT' into a new folder. Then double click the .Exe file to run it. Choose Scan. >It will display a list. Most of the things you see listed are necessary or required >entries, so don't fix anything yet. The Scan button will turn into Save Log.Choose >Save log, then click Edit - Select all and copy/paste the contents of the log file >in a post, either here, on the Spywareinfo forums or on Spybot's support forums (last >link). > >If you post here, PLEASE choose this Option below before posting the log, so it will >be legible: Check this box to preserve your spacing.... >href="http://www.spywareinfo.com/articles/hijacked/"> >Spywareinfo Hijacking Article >color="FF69B4"> >So how did I get infected in the first place? > > [Reply or follow-up to this message] Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows 98 Discussion Forum