![]() |
Hijacked
My google has been hi-jacked when using IE.. I mean I use google as home page .. no prob.. but when I type in any search the results come up but click on a result to go to that page I get re-directed to adverts..strange! I have had my home page hijacked in the past but managed to get rid.. but this one seems to be embedded somewhere..deleted all my "temp" files and no trojans named in my anti-virus.... tried hijack this and the results are....
Logfile of HijackThis v1.97.7 Scan saved at 01:39:35, on 08/04/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ukonline.co.uk R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3** - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E** - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F** - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43** - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4** - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7** - c:\program files\google\googletoolbar2.dll O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0** - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll O2 - BHO: (no name) - {C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB** - C:\WINDOWS\system32\navshext.dll O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE** - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0** - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88** - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F** - c:\program files\google\googletoolbar2.dll O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E** - (no file) O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [cmssSystemProcess] c:\windows\system32\mcsmss.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [BlockChecker] C:\Program Files\Block Checker\block-checker.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [dmdyq.exe] C:\WINDOWS\system32\dmdyq.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [wupd] C:\WINDOWS\system32\win32.exe O4 - HKCU\..\Run: [STManager] "C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet O4 - HKCU\..\Run: [Rapl] "C:\Program Files\uilc\aane.exe" -vt mt O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O14 - IERESET.INF: START_PAGE_URL=http://www.ukonline.co.uk O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C** (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B** - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6** - http://static.windupdates.com/cab/Cl...ridge-c284.cab O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6** - http://static.windupdates.com/cab/We...bridge-c18.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000** (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700** (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB** - http://ak.imgfarm.com/images/nocache...up1.0.0.15.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB** (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE** (Office Update Installation Engine) - http://office.microsoft.com/officeup...tent/opuc3.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537** (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C** (WUWebControl Class) - http://update.microsoft.com/windowsu...?1126666066031 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3** (MUWebControl Class) - http://update.microsoft.com/microsof...?1126667359734 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D** (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F** - http://v4.windowsupdate.microsoft.co...197.6031712963 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000** (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {EC5A4E7B-02EB-451D-B310-D5F2E0A4D8C3** (webhelper Class) - http://register.btinternet.com/templ...control023.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6963161C-C0E2-485B-83F3-1BC2B620F317**: NameServer = 85.255.116.162 85.255.112.111 O17 - HKLM\System\CCS\Services\Tcpip\..\{8F381B8E-4A01-465A-8EC9-978FD4908E8B**: NameServer = 85.255.116.162,85.255.112.111 O17 - HKLM\System\CCS\Services\Tcpip\..\{92B74767-01DA-4D88-8DA2-79864A594FE2**: NameServer = 85.255.116.162,85.255.112.111 O17 - HKLM\System\CCS\Services\Tcpip\..\{E76931EB-DBAB-4884-9DB6-8C271611F594**: NameServer = 85.255.116.162,85.255.112.111 I know its abit long but anyone got any ideas? |
Re: Hijacked
I do apologise for posting the above.. just looked at it again and its all gobbledigook!!
|
All times are GMT. The time now is 18:22. |
Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2025, vBulletin Solutions Inc.
Search Engine Friendly URLs by vBSEO 3.6.1
© 2003-2013 AccringtonWeb.com