What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Homepage Hijack

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
After many beers and glasses of cheap wine, I have succumbed (sp?) to asking for help :( , here's my log:

I am at my wits end…

Logfile of HijackThis v1.98.2
Scan saved at 4:12:01 PM, on 11/13/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\SYSTEM32\??plorer.exe
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O1 - Hosts: 67.18.39.58 security-forums.com
O1 - Hosts: 216.180.233.142 subratam.org
O1 - Hosts: 207.70.190.39 tomcoyote.com
O1 - Hosts: 205.206.231.15 securityfocus.com
O1 - Hosts: 66.132.229.196 bitdefender.com
O1 - Hosts: 66.35.255.33 trendmicro.com
O1 - Hosts: 216.49.88.12 mcafee.com
O1 - Hosts: 193.110.109.55 f-secure.com
O1 - Hosts: 213.220.100.3 f-prot.com
O1 - Hosts: 69.18.148.62 my-etrust.com
O1 - Hosts: 195.12.128.61 nod32.com
O1 - Hosts: 194.30.32.194 pandasoftware.com
O1 - Hosts: 81.176.69.79 kaspersky.com
O1 - Hosts: 65.77.216.76 anti-keyloggers.com
O1 - Hosts: 66.197.143.198 anti-keylogger.net
O1 - Hosts: 69.93.191.45 heidi.ie
O1 - Hosts: 64.91.255.87 diamondcs.com.au
O1 - Hosts: 207.44.236.84 agnitum.com
O1 - Hosts: 66.98.132.62 emsisoft.com
O1 - Hosts: 207.46.130.108 microsoft.com
O1 - Hosts: 207.126.111.202 mozilla.org
O1 - Hosts: 193.69.116.16 opera.com
O1 - Hosts: 216.167.96.118 sygate.com
O1 - Hosts: 208.185.174.44 zonelabs.com
O1 - Hosts: 216.177.3.144 blackice.com
O1 - Hosts: 128.242.106.66 kerio.com
O1 - Hosts: 66.35.250.210 spamassassin.org
O1 - Hosts: 216.213.19.27 bleepingcomputer.com
O1 - Hosts: 207.142.128.182 richardthelionhearted.com
O1 - Hosts: 67.18.205.218 securitywonks.org
O1 - Hosts: 69.61.32.242 securityhive.com
O1 - Hosts: 67.18.205.218 wonksearch.com
O1 - Hosts: 69.61.32.242 digital-mafia.org
O1 - Hosts: 69.61.32.242 linuxwonks.com
O1 - Hosts: 69.61.32.242 linuxwonks.org
O1 - Hosts: 69.61.32.242 linuxwonks.net
O1 - Hosts: 69.61.32.242 securitywonks.com
O1 - Hosts: 69.61.32.242 123vermaparivaar.com
O1 - Hosts: 69.61.32.242 sarvashikshaabhiyan.org
O1 - Hosts: 69.61.32.242 apssa-eastgodavari.org
O1 - Hosts: 69.61.32.242 musunuri.net
O1 - Hosts: 69.61.32.242 manasofttech.com
O1 - Hosts: 69.61.32.242 aponlineservices.com
O1 - Hosts: 69.61.32.242 gatheringclouds.net
O1 - Hosts: 212.13.208.91 oissg.org
O1 - Hosts: 63.251.138.37 atstake.com
O1 - Hosts: 69.61.22.37 arson-network.com
O1 - Hosts: 69.31.91.3 astalavista.box.sk
O1 - Hosts: 80.237.203.14 astalavista.com
O1 - Hosts: 69.57.146.21 blackcode.com
O1 - Hosts: 63.146.109.212 antionline.com
O1 - Hosts: 216.179.62.34 antioffline.com
O1 - Hosts: 203.101.77.19 nnsol.com
O1 - Hosts: 69.56.181.122 brain-hack.org
O1 - Hosts: 65.173.218.107 cisecurity.org
O1 - Hosts: 66.35.250.210 clamav.net
O1 - Hosts: 209.4.185.2 doshelp.com
O1 - Hosts: 67.18.39.58 darknet.org.uk
O1 - Hosts: 152.2.210.81 catb.org
O1 - Hosts: 209.51.158.170 h4ckerx.net
O1 - Hosts: 216.98.141.250 hackers.com
O1 - Hosts: 66.36.240.232 infosyssec.org
O1 - Hosts: 217.77.131.3 honeypots.net
O1 - Hosts: 129.6.13.23 nist.gov
O1 - Hosts: 129.6.13.197 icat.nist.gov
O1 - Hosts: 205.217.153.53 insecure.org
O1 - Hosts: 209.11.107.14 linuxsecurity.com
O1 - Hosts: 207.44.186.130 mindfuk.net
O1 - Hosts: 69.44.60.11 governmentsecurity.org
O1 - Hosts: 66.150.161.141 networkpunk.com
O1 - Hosts: 66.250.131.132 neworder.box.sk
O1 - Hosts: 69.55.238.6 phrack.org
O1 - Hosts: 38.118.142.215 qlinks.net
O1 - Hosts: 206.117.161.81 samspade.org
O1 - Hosts: 64.112.229.132 sans.org
O1 - Hosts: 192.117.232.213 securiteam.com
O1 - Hosts: 217.204.41.132 newsnow.co.uk
O1 - Hosts: 209.237.226.39 pgp.com
O1 - Hosts: 18.29.1.73 w3.org
O1 - Hosts: 198.128.39.4 ciac.llnl.gov
O1 - Hosts: 69.20.55.133 windowsecurity.com
O1 - Hosts: 213.219.122.11 zone-h.org
O1 - Hosts: 208.38.59.182 zonalabs.com
O1 - Hosts: 216.177.3.144 blackice.com
O1 - Hosts: 128.242.106.66 kerio.com
O1 - Hosts: 67.15.18.9 xblock.com
O1 - Hosts: 128.121.214.219 answersthatwork.com
O1 - Hosts: 193.0.0.203 ripe.net
O1 - Hosts: 137.132.19.218 singcert.org.sg
O1 - Hosts: 158.38.62.25 cert.uninett.no
O1 - Hosts: 210.148.223.10 apcert.org
O1 - Hosts: 203.5.112.15 auscert.org.au
O1 - Hosts: 204.101.134.78 cancert.ca
O1 - Hosts: 192.88.209.5 cert.org
O1 - Hosts: 210.148.223.8 first.org
O1 - Hosts: 202.138.228.74 cert.or.id
O1 - Hosts: 202.141.12.12 cert-in.org.in
O1 - Hosts: 192.228.139.10 mycert.org.my
O1 - Hosts: 66.235.192.69 pakcert.org
O1 - Hosts: 192.87.5.87 cert-nl.surfnet.nl
O1 - Hosts: 130.59.10.40 switch.ch
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {174E717E-29C3-4249-B725-092D82725F22} - C:\WINDOWS\System32\dpcbih.dll
O2 - BHO: (no name) - {31A23B51-9840-54B8-DD00-61550F87724A} - C:\WINDOWS\System32\mmdmwey.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {68F1310F-921A-02E2-8304-61550F87784E} - C:\WINDOWS\System32\rcsrtdj.dll (file missing)
O2 - BHO: (no name) - {79C03BC5-6C55-4B5B-921F-C02B6F1ABD7B} - (no file)
O2 - BHO: (no name) - {9C1B08BC-EB9C-EC3C-1D19-CF486DF60286} - C:\WINDOWS\apivs.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: SmartUI.lnk = ?
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\shlba.exe
O16 - DPF: {79C03BC5-6C55-4B5B-921F-C02B6F1ABD7B} - http://404.x-share.com/vvv/Pribi.exe
O18 - Filter: text/html - {96463C40-E432-4FCA-BC58-602D3C73CA61} - C:\WINDOWS\System32\dpcbih.dll
O18 - Filter: text/plain - {96463C40-E432-4FCA-BC58-602D3C73CA61} - C:\WINDOWS\System32\dpcbih.dll
Post #2
Download FxAgentB.exe from HERE and save it to your desktop. After downloading, double-click the FxAgentB file to run it and the program will scan your entire hard drive - this may take a while. When it is done, it will generate a log file called FxAgentB.log - save that information as you will need to paste it here later. Reboot when done.

Next click HERE to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1. Reboot when done.

Then click HERE to download Ad-Aware SE and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Click "Start", select "Perform Full System scan" and "Next" to start the scan. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done, rescan with HijackThis and post a new log here, together with the FxAgentB log.
Post #3
latest hijackthis information….i continue to delete registry entries, and the "about.blank" keeps coming back…this just amazes me… Logfile of HijackThis v1.98.2 Scan saved at 8:59:45 PM, on 11/14/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\HP\KBD\KBD.EXE C:\windows\system\hpsysdrv.exe C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe C:\Program Files\Scansoft\PaperPort\pptd40nt.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O1 - Hosts: 207.70.190.39 tomcoyote.com O1 - Hosts: 205.206.231.15 securityfocus.com O1 - Hosts: 66.132.229.196 bitdefender.com O1 - Hosts: 66.35.255.33 trendmicro.com O1 - Hosts: 216.49.88.12 mcafee.com O1 - Hosts: 207.44.236.84 agnitum.com O1 - Hosts: 66.98.132.62 emsisoft.com O1 - Hosts: 207.46.130.108 microsoft.com O1 - Hosts: 207.126.111.202 mozilla.org O1 - Hosts: 216.167.96.118 sygate.com O1 - Hosts: 208.185.174.44 zonelabs.com O1 - Hosts: 67.18.205.218 securitywonks.org O1 - Hosts: 67.18.205.218 wonksearch.com O1 - Hosts: 206.16.0.235 download.com O1 - Hosts: 69.28.135.160 snapfiles.com O1 - Hosts: 216.40.32.30 tucows.com O1 - Hosts: 67.18.205.218 securitywonks.net O1 - Hosts: 65.205.249.60 verisign.com O1 - Hosts: 208.254.45.200 geotrust.com O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe and Symantec Backdoor.Agent.B Removal Tool 1.0.1.2 Backdoor.Agent.B has not been found on your computer.
Post #5
sorry….to upset to read directions… Logfile of HijackThis v1.98.2 Scan saved at 6:11:14 PM, on 11/15/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\HP\KBD\KBD.EXE C:\windows\system\hpsysdrv.exe C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe C:\Program Files\Scansoft\PaperPort\pptd40nt.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Owner\Desktop\HijackThis.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
Post #8
as you can see, the start page continues to be changed Logfile of HijackThis v1.98.2 Scan saved at 7:51:23 PM, on 11/16/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\HP\KBD\KBD.EXE C:\windows\system\hpsysdrv.exe C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe C:\Program Files\Scansoft\PaperPort\pptd40nt.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Owner\Desktop\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
Post #10
Hi, I've typically used MSN.com as my homepage. To be honest with you, maybe I've deleted enough crap, because as of tonight, using RegAlyzer, I've not seen the signs of "about.blank" that were previously coming up in HKCU and HKLM. Is it possible?
Post #12
Thank you very much for your time on my issue. It's been a couple days now, and the log continues to look clean, without homepage hijack! You folks are all great to do this service for other users. Thanks once again!
Post #13
Please read through the ideas and free software listed below that will help to keep your computer clean.
Some of these you may already have installed or may have done already.

Install a firewall.ZoneAlarm FREE

Ensure that an Antivirus is updated weekly and running. AVG antivirus from Grisoft is a very good FREE antivirus program.

Make sure you have the latest critical updates from windows update.

SpywareBlaster will prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.

IE-SPYAD puts over 4000 known 'bad' sites into your IE restricted zone so that they cannot install malware on your PC.

Google toolbar has a very good built in popup blocker with a nice search bar. To provide privacy, select disable advanced features when installing.

Check your system for latest virus definitions with an online virus scan every week or two.
TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan

Check your system for latest trojan definitions with an Online trojan scan also every week or two.

And also see this link for additional security information.
So how did I get infected in the first place?

Please consider using Firefox
http://texturizer.net/firefox/index.html

Please read this
Post #14
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.


To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI