View Single Post
Old 06-29-2007, 03:37 PM   #5 (permalink)
TheBruce1
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Internet Explorer Start Page Hijacked...

Hello again

Please follow all instructions and in which order they come,if you have any questions,please ask before proceeding.


Only attached to posts when ask to do so.

------------------------------------------------------

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

O17 - HKLM\System\CCS\Services\Tcpip\..\{48D65D9A-EE32-4E43-9254-8CC51A70A258}: NameServer = 85.255.114.75
O17 - HKLM\System\CCS\Services\Tcpip\..\{B90BC071-7F85-4154-9A0B-05A3578F2485}: NameServer = 85.255.114.75
O17 - HKLM\System\CS1\Services\Tcpip\..\{48D65D9A-EE32-4E43-9254-8CC51A70A258}: NameServer = 85.255.114.75
O17 - HKLM\System\CS3\Services\Tcpip\..\{48D65D9A-EE32-4E43-9254-8CC51A70A258}: NameServer = 85.255.114.75


------------------------------------------------------

Reg Fix

Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now.

Open notepad and copy/paste the text in the quotebox below:
(don't forget to copy and paste REGEDIT4)

Quote:
REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spyware Doctor]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STOPzilla]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
"cpusave"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dmrya.exe]
Save the file as "Fix.reg". Make sure to save it with the quotes. Choose to "Save type as - All Files"
It should look like this:

Double click on the Fix.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.
-------------------------------------------------------

If you do not intend keeping Norton then run the Norton Removal Tool ,before beginning the next part of the fix.

----------------------------------------------------------------------

I see no evidence of an AntiVirus program on your system. This must be resolved. Connecting to the Internet without antivirus protection is a "Welcome" doormat for malware. It can take as little as eight seconds to infect an unprotected computer.

Please download and install this excellent and FREE anti-virus program:

Please download Active Virus Shield (powered by Kaspersky) and save it to your desktop.
  • Please remember to register for your Activation Code using a legitimate email address.
  • Double-click avs.msi to run the installer, but please uncheck "Install Security Toolbar" during the installation process:




  • Then please update the program and run a systemwide scan. Allow it to neutralize all that it finds.
  • When done, launch Active Virus Shield's main window.




  • Click the Scan button on the left, and then click Detected.




  • In the ensuing window, click the Save As button to save a copy of the log.
  • Copy and paste that log in your next reply.
Note: You must only use 1 (one) AV at a time because if you have 2 or more AVs running at the same time, they will conflict with each other and make your security less reliable.

-----------------------------------------------------------------

No Firewall Onboard

You don't seem to have a firewall program installed. Using a firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:.

-----------------------------------------------------------------

Please run Deckard System Scanner once again.

-----------------------------------------------------------------

Log Required
AOL Active Virus Shield Log
C:\Deckard\System Scanner\main.txt


Let us know how your system is behaving,thanks.
__________________
Member of ASAP since 2007
Member of UNITE since 2008


**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline