What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Random Search Pages

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hey folks. :) I am so glad you are here. I am not a novice by any stretch but this is out of my normal realm.

1. I am getting random search pages if I enter a typo for a webpage. I have run both Spybot S&D and Adware 6 after updating them.

2. My search page is stuck. I chose the page but when I figured out something was going on I tried changing it to no avail.

3. When I go in to internet options and try to reset on the Program tab it errors out saying that it can not change the settings.

I found a couple lines in my host file that I did not need and changed them but that did not impact my situation.

here is a copy of my Hijack this log;

Logfile of HijackThis v1.98.2
Scan saved at 12:03:27 AM, on 10/4/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\Winamp\winampa.exe
D:\PROGRA~1\Grisoft\AVG6\avgserv.exe
D:\Program Files\EPSON\ESM2\eEBSVC.exe
D:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\EPSON\ESM2\SAgent2.exe
D:\PROGRA~1\TEXTBR~1\Bin\INSTAN~1.EXE
D:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
D:\Program Files\Browser Mouse\2.03\mouse32a.exe
D:\Program Files\ATI Multimedia\main\LaunchPd.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
D:\PROGRA~1\AIM95\aim.exe
C:\Program Files\ATI Multimedia\main\ATISched.EXE
C:\Program Files\GoogleDCC\GoogleDCC.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\PC-cillin 2000\PNTIOMON.exe
D:\Program Files\Wacom\TabUserW.exe
D:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Trend Micro\PC-cillin 2000\pccntupd.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\Program Files\AnalogX\ITR\itrc.exe
D:\Program Files\PopTray\PopTray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Windows XP Fun Pack\Winter 2003\WinterPowerToy\WinterWalltoy.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\GoogleDCC\GoogleFah\GoogleFah.exe
C:\Program Files\GoogleDCC\GoogleFah\GoogleFahCore_65.exe
D:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Firefox\firefox.exe
C:\Documents and Settings\Tabasco1\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dailyoverlook.com/1024.php
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe"
O4 - HKLM\..\Run: [WebTrapNT.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe"
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [aiepk] C:\Documents and Settings\Tabasco1\Desktop\aiepk.exe
O4 - HKLM\..\Run: [LWBMOUSE] d:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [iTunesHelper] D:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [InstantAccess] D:\PROGRA~1\TEXTBR~1\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] D:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [AVG_CC] D:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [FLMMEMOREX203] D:\Program Files\Browser Mouse\2.03\mouse32a.exe
O4 - HKLM\..\RunServices: [RegisterDropHandler] D:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [ATI Launchpad] "D:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\Run: [AIM] D:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ATI Scheduler] C:\Program Files\ATI Multimedia\main\ATISched.EXE
O4 - HKCU\..\Run: [GoogleDCClient] C:\Program Files\GoogleDCC\GoogleDCC.exe -startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: ITR Client.lnk = D:\Program Files\AnalogX\ITR\itrc.exe
O4 - Startup: PopTray.lnk = D:\Program Files\PopTray\PopTray.exe
O4 - Startup: Winter Fun Wallpaper Changer.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Atomic Timer 3.7.LNK = D:\Program Files\Atomic Timer\Atomic Timer 3.7.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Real-time Monitor.lnk = ?
O4 - Global Startup: TabUserW.lnk = D:\Program Files\Wacom\TabUserW.exe
O4 - Global Startup: ZoneAlarm.lnk = D:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download with &DAP - D:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - D:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\PROGRA~1\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5A66E13A-311D-488B-828D-DDDF52EFB636} (strprint.trprints) - https://partnering.one.microsoft.com/mcp/to…scriptPrint.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1094027279712
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/76808a0…all/xscan53.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} (Toolbar Reg Sniff Activate) - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {958FCAB0-616B-11D3-A63F-00001B322780} (TimetickerLittleHelpers.usfServer) - http://www.timeticker.com/Timeset/TcpServer.CAB
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…364/mcfscan.cab


Thanks in advance;
Charles
Post #2
Hi welcome to TOM COYOTE FORUMS
First of all
Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

Do you use the following programs ? I'm assuming that you DO NOT
Viewpoint Media Player
Click here for information on it
If not please uninstall it via add/remove programs
Detailed instructions below
On the Windows XP taskbar:
Click Start > Control Panel.
In the Control Panel window, double-click Add or Remove Programs

Next with NO other windows open, run HIJACKTHIS, check and fix the following lines if present
the following are bad
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
The following are resource hogs
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE

After that REBOOT into safe mode. Instructions here
These may be hidden files. See here for how to show hidden files.
Find and delete the following folders
C:\Program Files\Viewpoint\
DO NOT WORRY if you do not find them
It should have already been REMOVED by add/remove programs

Your home page cannot be changed because you had set it with Spybot S&D
To change it back
Open Spybot
First go to Mode and select advanced mode
Select tools at the bottom left of the program
click on the icon in the main window called IE tweaks

Try clearing out your Temporary folders and internet files
Check the following folders and delete any files that you find in:
C:\Documents and Settings\each Account\Local Settings\Temporary Internet Files (and any subfolders)Make certain you delete any files in the hidden folderContent.IE in the Temporary Internet Files Folder
C:\Documents and Settings\Each Account\Local Settings\Temp\ folder and any subfolders
Empty your Recycle Bin
To ensure that your computer is totally clean, go to Start>Programs>Acccessories>System Tools> Disk Cleanup and put a check mark beside all the entries in the disk cleanup window that ask you what you want to clean. Clean all hard drives and all files. This will get rid of any malware that is hiding in the temporary folders.Empty your Recycle Bin

After that REBOOT and
POST the new log in this thread using 'Add Reply'
Post #3
Thanks I am almost 100% home. :-) I am running Spybot S&D 1.2 and I don't see the ie tweaks under tools. Is it located elsewere now? Thanks, Charles
Post #4
Hi For Spybot S&D 1.2 First start the program in advance mode. You need to select advance mode from the start menu programs list and not from the icon on your desktop Next go to immunisations uncheck the boxes You should update your spybot to version 1.3 as soon as possible Remember to check for spyware definition updates regularly So how's your computer running ? If problems persist post a new log B) or else i think you are clean :thumbup:
Post #6
You are clean :thumbup:
A few tips here for you to stay clear of malware
Check for windows critical updates regularly
Use a FIREWALL
a good one can be downloaded here
Zone Alarm
The following programs will protect your computer from most spyware or malware
Adaware
Spybot
Spyware Blaster

Update your virus and spyware detection definitions weekly

You may benefit from reading the article "How Did I Get Infected In The First Place" for information on how to secure your PC from spyware/adware/malware.There are several small free programs mentioned there that help with securing your PC against this type of problem
Post #7
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI