Jump to content

HELP! HEEEEELP!!!


Guest Geordie Boyo
 Share

Recommended Posts

Guest Geordie Boyo

I've got a major problem and I need....well you know...!

 

After a search for new downloads I came across something that has enabled this to happen and its driving me crazy...! No matter how many times I try and change the Address in Internet properties it wont work! This is my current home page...!

 

 

c:\secure32.html

 

 

 

Detected SPYware! System error #384

__________________________________________________________________________

 

Your IP address is.......Using this address a remote computer has gained anaccess to your computer and probably is collecting the information about the sites you've visited and the files contained in the folder Temporary Internet Files. Attention! Ask for help or install the software for deleting secret information about the sites you visited.

 

__________________________________________________________________________

 

Your computer is full of evidences!

 

 

ISP of transmission: CO

Your IP address:

They know you're using: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Supplied by blueyonder)

Your computer is: Windows XP

Risk status for further investigation: VERY HIGH RISK

 

My drive recently knacked up. I had some bloke come out to take it away to fix it. He installed new software, avest etc. Is there some way I can sort my home page out and get everything back to normal?

 

 

 

 

Link to post
Share on other sites

Guest Geordie Boyo

Andy, I did what you said. Spybot couldn't find anything, so I downloaded hijackthis. I used it, clicked on all the boxes that appeared and clicked on fix problems. Should I have done that?  bluedead.gif

 

 

Link to post
Share on other sites

Errr... NO NO NO NO NO!

 

I said "post a logfile" not "click whatever you fancy and UTTERLY DESTROY your operating system".

 

Restart your computer and cross your fingers. Then post a logfile.

 

 

Link to post
Share on other sites

Guest Geordie Boyo

D'oh!

 

I used to have an Avast icon at the bottom right-hand corner which is no longer there because of it...! I don't think its running anymore because I did that...!  bluecry.gif

 

 

Logfile of HijackThis v1.99.1

Scan saved at 22:55:14, on 02/01/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\WINDOWS\system32\slserv.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\wpabaln.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\DOCUME~1\nil\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

 

 

Link to post
Share on other sites

Dear god, that's the most empty logfile I've ever seen :lol:

 

Anyway:

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html

 

Tick the boxes next to them (JUST them ;)) and click fix. Afterwards, restart your PC and post another logfile.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

×
×
  • Create New...