Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 91863 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

Hijacked To This Page And Can't Fix


  • Please log in to reply
1 reply to this topic

#1 epmueller

epmueller

    New Member

  • New Member
  • Pip
  • 2 posts

Posted 25 June 2004 - 10:34 PM

I've run Adware, SpybotSD and and Norton but my default IE page keeps being hijacked to res://idxwg.dll/index.html#37049. When running SpybotSD, I even removed everything listed but the following keep coming back which I assume is related to my hijacked browser. What am I missing? Thanks! Logfile of HijackThis v1.97.7 Scan saved at 11:30:23 PM, on 6/25/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\System32\gearsec.exe C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\apiza.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\iesu.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 7 for hijackthis.zip\HijackThis.exe C:\Program Files\Common Files\Symantec Shared\NMain.exe C:\PROGRA~1\NORTON~1\NORTON~1\navw32.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\idxwg.dll/sp.html#37049 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://idxwg.dll/index.html#37049 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://idxwg.dll/index.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\idxwg.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://idxwg.dll/index.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\idxwg.dll/sp.html#37049 O2 - BHO: (no name) - {7A015144-5175-E3B9-7DB4-7366A22AC500} - C:\WINDOWS\system32\sysxk.dll O4 - HKLM\..\Run: [iesu.exe] C:\WINDOWS\iesu.exe

    Advertisements

Register to Remove


#2 epmueller

epmueller

    New Member

  • New Member
  • Pip
  • 2 posts

Posted 26 June 2004 - 05:35 PM

After looking around the web some more and trying many different things, I was finally able to find something that worked the at Merijn.org site:

http://forums.spywar...?showtopic=7261

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users