Spyware problems
I am posting this here because I am at the end of my patience with my computer. I KNOW I have a problem, I just don't know how to get rid of it.
My IE 6.0 has been hijacked. It now displays the "about:blank" as a home URL. This is the string that it displays in the Internet Options menu as the home page Address: "http://rl.webtracer.cc/-/?bayzm"
It also displays (sometimes) "http://rl.webtracer...." and others as the homepage address. It inserts a host of porn bookmarks in my Favorites menu, as it does not matter how many times I delete them, after I re-log or reboot they show up again.
I have tried many on-line guides in how to deal with the about:blank issue, none have (obviously) worked. I have also tried: Ad Watch, AdAware Professional, SpySubtract, ScanSpyware, Dr Delete, CW Shredder, Spybot S&D, CCleaner, and HijackThis. None have so far been able to eliminate this issue. Here is the HijackThis log:
Logfile of HijackThis v1.98.2
Scan saved at 5:27:24 PM, on 9/11/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\SYSTEM32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Sygate\SPF\smc.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Network Associates\Common Framework\FrameworkService.exe
D:\Program Files\Network Associates\VirusScan\Mcshield.exe
D:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\Program Files\InterMute\SpySubtract\SpySub.exe
D:\WINDOWS\System32\wbem\wmiapsrv.exe
D:\Program Files\Netscape\Netscape Browser\netscape.exe
D:\Documents and Settings\Administrator\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rl.webtracer.cc/-/?bayzm (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://rl.webtracer.cc/-/?bayzm (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
O19 - User stylesheet: D:\WINDOWS\stsheets.dat
I am trying hard not to have to re-install all the programs on my HD- that is a huge PAIN, so any help y'all may be able to give me, it would be more than welcomed. Thanks in advance.
My IE 6.0 has been hijacked. It now displays the "about:blank" as a home URL. This is the string that it displays in the Internet Options menu as the home page Address: "http://rl.webtracer.cc/-/?bayzm"
It also displays (sometimes) "http://rl.webtracer...." and others as the homepage address. It inserts a host of porn bookmarks in my Favorites menu, as it does not matter how many times I delete them, after I re-log or reboot they show up again.
I have tried many on-line guides in how to deal with the about:blank issue, none have (obviously) worked. I have also tried: Ad Watch, AdAware Professional, SpySubtract, ScanSpyware, Dr Delete, CW Shredder, Spybot S&D, CCleaner, and HijackThis. None have so far been able to eliminate this issue. Here is the HijackThis log:
Logfile of HijackThis v1.98.2
Scan saved at 5:27:24 PM, on 9/11/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\SYSTEM32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Sygate\SPF\smc.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Network Associates\Common Framework\FrameworkService.exe
D:\Program Files\Network Associates\VirusScan\Mcshield.exe
D:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\Program Files\InterMute\SpySubtract\SpySub.exe
D:\WINDOWS\System32\wbem\wmiapsrv.exe
D:\Program Files\Netscape\Netscape Browser\netscape.exe
D:\Documents and Settings\Administrator\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rl.webtracer.cc/-/?bayzm (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://rl.webtracer.cc/-/?bayzm (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
O19 - User stylesheet: D:\WINDOWS\stsheets.dat
I am trying hard not to have to re-install all the programs on my HD- that is a huge PAIN, so any help y'all may be able to give me, it would be more than welcomed. Thanks in advance.
0
Comments