Browser hijack help

Reply Subscribe

Thread Tools

Search this Thread

30 December 2004, 08:26 PM

MadGrip

Scooby Regular

Thread Starter

Join Date: Jul 2003

Location: Leeds

Posts: 3,175

Likes: 0

Received 0 Likes on 0 Posts

Browser hijack help

can anyone tell me how to get rid of this pice of crap thats hijacking my browser ??

http://vaffe.netfirms.com/vaffe

it tries to download something to my pc everytime I open IE

I've used spybot , which finds it & deletes it
I've used adaware that finds it & deletes it
I've searched, deleted and renamed the registry files that are associated with it
I've turned off system restore

but as soon as I boot up the PC the fooking thing is back

I've clicked the link above which says that the site is deleted , but thats the URL that appears in my default browser settings

any help greatfully appreciated

Phil

Last edited by MadGrip; 30 December 2004 at 08:29 PM.

Reply Like

30 December 2004, 08:37 PM

Daz34

Scooby Regular

Join Date: Feb 2002

Location: here

Posts: 10,641

Likes: 0

Received 0 Likes on 0 Posts

Get a program called HijackThis from http://www.spychecker.com/program/hijackthis.html then run it & copy & paste the log file it creates onto a new thread on this forum http://www.spywarewarrior.com/viewfo...677b7d07ad6602 and you will be told what you need to delete.

Darren

Reply Like

30 December 2004, 08:58 PM

MadGrip

Scooby Regular

Thread Starter

Join Date: Jul 2003

Location: Leeds

Posts: 3,175

Likes: 0

Received 0 Likes on 0 Posts

cheers mate, did what you said, just waiting for a reply now, unless anyone else knows what this lot means

Logfile of HijackThis v1.99.0
Scan saved at 20:50:30, on 30/12/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Phil W\Desktop\hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://vaffe.netfirms.com/vaffe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HGTXPEI] C:\WINDOWS\System32\FirstReboot.exe
O4 - HKLM\..\Run: [SoundFusion] RunDll32 hercplgs.cpl,BootEntryPoint
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1104430440087
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA69CF37-A740-4824-88A8-5EBC21CA8D50}: NameServer = 194.72.9.34 194.74.65.68
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Reply Like

31 December 2004, 02:06 AM

Boro

Scooby Regular

iTrader: (1)

Join Date: Jul 2003

Location: Cornwall

Posts: 7,222

Likes: 0

Received 0 Likes on 0 Posts

Sorry i dont understand the hijack this lists BUT i did have a similar experience a while back. Did everything u have mentioned and no joy until i ran spybot in safe mode. That seemed to stop it coming back. Hope that helps.

Reply Like

31 December 2004, 02:54 AM

Soulgirl

Scooby Regular

Join Date: Dec 2002

Location: Here!

Posts: 5,145

Likes: 0

Received 0 Likes on 0 Posts

Or.. hows about not opening IE? Download and install Firefox (obviously using IE for the last time)

Reply Like

31 December 2004, 02:58 AM

Soulgirl

Scooby Regular

Join Date: Dec 2002

Location: Here!

Posts: 5,145

Likes: 0

Received 0 Likes on 0 Posts

Quote:

Originally Posted by MadGrip

Cant see anything untoward there except messenger...

click Start, Run, and type msconfig... click services and un-check Messenger.

Reply Like

31 December 2004, 11:47 AM

Rodge

Scooby Newbie

Join Date: Mar 2003

Location: Haddington

Posts: 26

Likes: 0

Received 0 Likes on 0 Posts

I use this program all the time on customer's PC's...

I would delete the R0 value and the 017 value, then try opening your homepage. It *might* set it to "about:blank" but you can change this back to whatever you had before in "Internet Options"

Also this....

O4 - HKLM\..\Run: [HGTXPEI] C:\WINDOWS\System32\FirstReboot.exe

Another good free utility I found a few months back is called Cleanup! Works VERY well..!!

http://cleanup.stevengould.org/

Reply Like

Trending Topics

exhaust help please

10

182
Boot torsion bar -2003 Sti

10

382

31 December 2004, 01:45 PM

cong

Scooby Regular

Join Date: Feb 2004

Posts: 1,063

Likes: 0

Received 0 Likes on 0 Posts

fixed the below
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://vaffe.netfirms.com/vaffe
O4 - HKLM\..\Run: [HGTXPEI] C:\WINDOWS\System32\FirstReboot.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA69CF37-A740-4824-88A8-

not sure about this one it looks dodgy, do you have the computer networked?
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA69CF37-A740-4824-88A8-5EBC21CA8D50}: NameServer = 194.72.9.34 194.74.65.68

Reply Like

31 December 2004, 03:47 PM

Fuzz

Scooby Regular

Join Date: Jul 2002

Location: Under your bonnet

Posts: 9,173

Likes: 0

Received 0 Likes on 0 Posts

Quote:

Originally Posted by Soulgirl

Or.. hows about not opening IE? Download and install Firefox (obviously using IE for the last time)

By the running processes I see he uses MSN Messenger therefore he must have a hotmail account, clicking the link within MSN will open IExplorer whether he has Firefox as default web browser or not.

(I've even removed the "windows component" IExplorer.. and it still opens??)

Madgrip,
I'd also lose the windows messenger while your at it mate.
easy to add a "D-Word" Named "Hide Messenger" value "2" to the registry in.
HKEY_LOCAL_MACHINE\Software\Microsoft\Outlook Express.

If you use OE you'll find is starts faster too.

Andy

Andy

Reply Like

31 December 2004, 03:55 PM

#10

Fuzz

Scooby Regular

Join Date: Jul 2002

Location: Under your bonnet

Posts: 9,173

Likes: 0

Received 0 Likes on 0 Posts

Actualy I'm talking bollox again MSN messenger is msnmsgr.exe.

Still lose the windows messenger though.

Andy

Reply Like

31 December 2004, 04:05 PM

#11

john_s

Scooby Regular

iTrader: (1)

Join Date: Dec 2002

Location: Preston, Lancs.

Posts: 2,977

Likes: 0

Received 0 Likes on 0 Posts

Before sponning the nameserver line, just check whether or not they are your ISP's nameservers.

John.

Reply Like

31 December 2004, 04:06 PM

#12

wez_sti

Scooby Regular

Join Date: Apr 2004

Location: All over...so who needs a car!

Posts: 1,739

Likes: 0

Received 0 Likes on 0 Posts

i hate these f*cking HIjack thingys. if i found someone who made one of these i'd kick the living **** out of em! SO FRUSTRATING!!!

ps. i've fixed mine now! spybot/adaware etc...

Good luck mate!