What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser Hijack

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am trying to clean up a friend's Compaq Preario. It is running Avast! AV and Microsoft firewall. Avast was disabled when I got to the computer, friend says that he did not disable it.

I scanned with Avast!, which found the following: Win32:CTX; Win32:Kuang2; Win32:Adware-gen[ADW]; Win32:Trojan-gen{UPX!}

Subsequent scans with Spybot S&D, Ad-Aware, Trendmicro Housecall, turned up: Rxtoolbar; iLookup.Begin2Search; Trojan.dumaru.

Scanning with Stopzilla produced:Giantexplorer; Dotcom toolbar. I did not purchase the software indicated for their removal.

While running these, I could get the use of a browser by running in safe mode, and then switching to full OS to run the software. Today, safe mode no longer provides a working browser. I burned a copy of Hijackthis from my computer and ran it on the Compaq. Everything else seems to work on that computer but the browsers.

Here is its HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 4:41:10 PM, on 5/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: Add To Compaq Organize… - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Golden Palace Poker - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\GOLDEN~1\client.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\AIM95_c1\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Royal Vegas Poker - {FA4904B4-1FAF-4afd-886C-C19D2297BA62} - C:\Program Files\royalvegasMPP\MPPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - AppInit_DLLs: PAVWAIT.DLL C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

Any help is much appreciated.
Post #3
Thanks for your quick reply, LDTate, much appreciated. I had run the Winsock repair applet without effect. I did run it again just now, to make sure, and the problem still remains. On IE 7, the attempt to load a page like Yahoo.com yields "Internet Explorer cannot display the webpage. Most likely causes…." On Firefox, the attempt yields "The connection was reset. The connection to the server was reset while the page was loading. …" This last leads me to suspect that a browser hijacker is at work, but I cannot seem to find its source.
Post #4
Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you, combofix.txt.Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Post #5
Hi LDTate; Once again, thank you for your prompt reply. It appears that combofix cannot be installed on that computer. It tells me that the following files cannot be created: swxcacls.cfexe vfind.cfexe ERDNT.e_e ERDNTDOS.LOC ERDNTWIN.LOC ERUNT.LOC findcombo.vbs I tried to install it on my machine (same OS) and it loaded fine. RM
Post #7
Hi; The only unchecked items in msconfig are the boot options in BOOT.INI. I did a system restore a few days ago, whereupon the browsers worked for a few hours and then went back to their errant behavior. One of the attempts to scan and remove malware required that I disable System Restore, so I no longer have any usefull restore points. Typical of Compaq, they do not provide an OS CD. Rather, they set up a D: partition and install the OS on that. It can only be accessed through a "System Recovery" function available during bootup. I have yet to try this, as I suspect that it might require me to locate and save all of the user data. RM
Post #10
Lets try this:
Click Start » Run - then copy/paste this into the run box & click OK :

"%userprofile%\desktop\combofix.exe"

When finished, it shall produce a log for you. Post that log in your next reply along with a new Hijackthis log.

NOTE : Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Post #11
Hi; It tries to run, but quickly produces an error box entitled "Windows-No Disk" "Exception processing Message c0000013Parameters 79b6bf9c 4 75b6bf9c 75b6bf9c" Options Cancel Try Again Continue
Post #12
Use Add/Remove Programs and remove if listed:
Viewpoint <–All Viewpoint programs
QuickTime
Real Player

Now try it again.
Post #13
When I clicked "Cancel" on the notice, the hard drive started to spin. Rather than risking further damage, I have let it run to completion. It has popped up a dozen or so such notices, each one of which I cancelled. It now tells me that it cannot find Notepad. It now appears to have finished. I will check that notepad is still on the machine and run again after removing the applications you indicated. I will await your further instructions before running combofix.exe again.
Post #15
Yes there is. The options for openning it do not contain wordpad. I could use MS Word or Wordpad. I can copy the file to my computer, scan it for malware, then copy and paste to here. RM

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI