Computer Support Forum

Solved: index.html not displaying after upload

Question: Solved: index.html not displaying after upload

i have tried to create an index.html file using

word
visio
publisher
web engine v2

just pasted a jpg into open file and saved as web page

the page displays the info perfectly when i view it locally
but after uploading to my hosting co
its empty

what am i missing? ...not a web designer...duh!

Relevance 100%
Preferred Solution: Solved: index.html not displaying after upload

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

Answer: Solved: index.html not displaying after upload

Are you uploading both the picture file and HTML file to your server?

Are you sure you are putting both files in the correct location on the hosting company's server? If the picture file and html file are in different folders on your computer are you duplicating that in the sub-directory structure on the server?

Are you trying to access the index.html page in your browser as www.domainname.com or www.domainname.com/index.html?

3 more replies
Relevance 71.75%

I've seen this posted before but now I have the same problem. Everytime I boot up my computer, IE pops up and trys to launch this " 63.246.131.130/index.html "....I've scanned my computer with Norton, S&D, adaware, and CWShredder.They come up with nothing?.....any help would be greatly appreciated!!!!!!

Here's my HJT log:

Logfile of HijackThis v1.97.7
Scan saved at 11:22:43 AM, on 11/23/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Norton Personal Firewall\ISSVC.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common ... Read more

Answer:Solved: 63.246.131.130/index.html help

8 more replies
Relevance 70.11%

Hi, I saw some other posts with people encounter the same problem with a .dll file and IE... I try to follow one of the solution gived by flrman1, but all the files named are different and I don't really know what is good or not for my computer. If someone can help me, it will be great !
Here is my hijack This log :

Thank !!!
Bobby Prévost

Logfile of HijackThis v1.98.0
Scan saved at 19:07:04, on 2004-06-30
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\atlal.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\atlal.exe
C:\WINDOWS\crhm32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Bobby\B... Read more

Answer:[Solved] Yeah, again - res://vckxv.dll/index.html

16 more replies
Relevance 70.11%

I read other posts, and I hope I did this right. If someone could help me with my review I guess it's called from the Hijack This, I would really grateful!

Thanks! Why must stupid people make viruses, making our lives miserable?

Logfile of HijackThis v1.97.7
Scan saved at 4:02:58 PM, on 5/8/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\HP\KBD\KBD.EXE
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\PROGRA~1\SYSTEM~1\soap.exe
C... Read more

Answer:Solved: res://mshp.dll/index.html#37049

16 more replies
Relevance 70.11%

Hey everybody!

I've been having this problem for some time now. Whenever I set my startpage it always returns to res://mshp.dll/index.html#37049. This is off course a major annoyance. I read about how you can get rid of it in another thread and I tried it, but I couldn't get rid of it I'm sorry to say. I've got spybot, hijackthis, cwshredder, and ad-aware. Any/all help is greatly appreciated.

Thanx

Here's my hijackthis log:
Logfile of HijackThis v1.97.7
Scan saved at 00:24:33, on 11.06.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\GEARSEC.EXE
C:\Programfiler\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Programfiler\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe
C:\Programfiler\iTunes\iTunesHelper.exe
C:\programfiler\ssi\silent ... Read more

Answer:[Solved] res://mshp.dll/index.html#37049 PLEASE HELP!!

16 more replies
Relevance 70.11%

Could a knowledgeable person comment on this log from HijackThis? I downloaded the HijackThis program a couple of hours ago. I am using Windows XP SP1, Adaware, Spybot, NAV2005 and SpywareBlaster, and keep signatures updated. I have a broadband internet connection through Verizon, with Firefox 1.07 as browser.
Task manager lists the following message: "Browser hijacked by kndex.html#37049$MSsearch".

Logfile of HijackThis v1.99.1
Scan saved at 5:19:11 PM, on 10/4/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe
C:\Program Files... Read more

Answer:Solved: HijackThis Log - index.html#37049

9 more replies
Relevance 70.11%

Hi -- I am new here. Been working on this since last night with help from other threads. Here is where I am: Ad aware says I am clean. Spy bot keeps coming up with one last thing, DSO Exploit HKEY_USERS\DEFAULT\Software\Microsoft\Windows
I click on fix it but it is still there when I run Spy bot again. When I restart my computer I get this error: error: could not execute Main: the system could not find the file specified.
Almost everytime I use anything in the My Computer folder the computer will stop responding.
I have run hijack this and am including the current log:
Logfile of HijackThis v1.97.7
Scan saved at 11:31:47 AM, on 5/14/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\AGRSMMSG.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\LXSUPMON.EXE
C:\PROGRAM FILES\ADAPTEC\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\SYSTEM\A.EXE
C:\WINDOWS\SYSTEM\DCVXTLKP.EXE
C:\WINDOWS\DOWNLOADED PROGRAM FILES\WINHLP32.EXE
C... Read more

Answer:(Solved) res://mshp.dll/index.html#37049

7 more replies
Relevance 70.11%

Hi...i'm new here....not excessively pc literate when it comes to hardware..I have the above virus showing up on my internet in my home page. Any ideas on how to get rid of it? Would be greatly appreciated !!!
 

Answer:[solved]res://dfhpy.dll/index.html#37094

16 more replies
Relevance 70.11%

Hey guys,

Sorry but I have very little experience in developing but here it goes.

I have an existing program and I have been tasked with adding a help section via HTML. I have the HTML help working but I wanted to try and integrate it in the app instead of opening IE. I'm stuck and clueless

Here is what I have so far (pretty much nothing) but I want to point the WPF control WebBrowser to a specific location and index.html file "\\mysrv\help\index.html"
Code:
<Page x:Class="AppName.PageHelp"
xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
ShowsNavigationUI="False"
mc:Ignorable="d"
d:DesignHeight="768" d:DesignWidth="1024"
Title="Help">
<Grid>
<Grid.RowDefinitions>
<RowDefinition Height="*"/>
</Grid.RowDefinitions>
<ScrollViewer Grid.Row="0" Margin="0">
<WebBrowser Height="768" Width="1024"/>
</ScrollViewer>
</Grid>
</Page>
Like I said I'm clueless and I'm not married to what I have above so if there is a better control to use... Read more

Answer:Solved: Help in C# VS WebBrowser to open Index.HTML

NM i figured it out.
 

6 more replies
Relevance 70.11%

I keep getting this homepage when I open a new window, regardless of how many times I reset the internet settings. How do I get rid of it? Should I use AdAware? HijackThis?

- Liz
The Newbie
 

Answer:[Solved] res://mshp.dll/index.html#37049 help

16 more replies
Relevance 70.11%

had a geocities web page for one year although i barely knew how to build,change and manage the site.

JUST NOW,on the file manager page, i deleted 2 files of 3 causing a mistake.

i now get a "warning you do not have an "html.index or"index.htm"file. when i type my page in a search site, i get a page saying index page.

how can i go back ?
 

Answer:Geocities web page building:Deleted index.html/index.htm

by going to this site, i was able to solve muy this problem
http://help.yahoo.com/help/us/geo/gfiles/gfiles-22.html

thanks for the viewing.
 

1 more replies
Relevance 69.29%

My IE 6.0 (using XP Home) has been taken over by res://aemrz.dll/index.html#96676. I have tried everything (Ad-Aware 6.0, Spy bot, Hihjackthis, Panda Software, HouseCall, Buster 1.5, etc). They all remove the unwanted files(some easily recognised by aemrz), but these come back each time I use IE again. I've even requested help from Google Ask abd have received lot's of ideas (http://answers.google.com/answers/threadview?id=379892).

Below if a copy of my laest log file from Hihjackthis. Any ideas:

Logfile of HijackThis v1.97.7
Scan saved at 12:09:14 p.m., on 01/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Dell\AccessDirect\dadapp.exe
C:\Archivos de programa\Synaptics\SynTP\SynTPLpr.exe
C:\Archivos de programa\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\DSentry.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe
C:\Archivos de programa\Dell\AccessDirect\DadTray.exe
C:\Archivos de programa\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Archivos de programa\QuickTime\qttask.exe
C:\WINDOWS\system32\appyr.exe
C:\Archivos de programa\Messenger\msmsgs.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\Archivos de programa\Olympus\DeviceDetector\DevDtct2.exe
C:\Archivos de programa\Nikon\NkView4\NkVwMon.exe
C:\Archivos de programa\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\sdkkz.exe
C:\Archivos de programa\Palm\HOTSYNC.EXE
C:\Documents an... Read more

Answer:[Solved] IE highjacked by res://aemrz.dll/index.html#96676

16 more replies
Relevance 69.29%

I was on the web early this morning and according to Symantec AntiVirus picked up Trojan Byte Verify and Bloodhound Exploit.10

I am unable to restore my default home page as I would wish, and I hope someone can help me solve this problem.

I am running IE 6.0.2800.1106

I downloaded Hijack and a current log follows:

Logfile of HijackThis v1.97.7
Scan saved at 6:18:32 PM, on 6/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\appay32.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\System32\1XConfig.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\mstv32.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Progra... Read more

Answer:[solved]Hijacked: res://lfeai.dll/index.html#96676

16 more replies
Relevance 68.88%

I have recently been hijacked and my homepage has been reset to res://ghtba.dll/index.html#96676 . I have read the faq and have run norton, cwsshredder, adaware, and spybot all updated and nothing has changed. I have also read the other posts but am very confused about what to do. I dl'd hijackthis and my current log file is as follows. Please help me in any way you can. Thank you.

Logfile of HijackThis v1.97.7
Scan saved at 6:21:27 PM, on 6/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\winuu.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\CTHELPER.EXE
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\... Read more

Answer:[Solved] homepage changed to res://ghtba.dll/index.html#96676

16 more replies
Relevance 68.88%

The other day, another user (Popeye) posted an almost identical problem, only his/her browser had been hijacked to res://mcenu.dll/index.html#96676.

The moderator adviced Popeye to download the following file:
http://tools.zerosrealm.com/dllfix.exe

I figured I'd do the same. However, on Zeros Realm this warning comes up:

Please note: This fix applies to those who have browsers hijacked to res://ewfom.dll#2342 and NOTHING else.

Since this is not the exact same link that has hijacked my browser I hesitated downloading and extracting the file.

Instead I tried to run the XP system recovery, but apparently the spyware has blocked this feature - no matter which date I try, it cannot recover my system.

Hope someone can help me out here.

Cheers,

Emo-Ebbe
 

Answer:[Solved] I have my IE browser hijacked to res://amfcn.dll/index.html#96676

16 more replies
Relevance 68.06%

Hi, I'm a newbie in this forum,
I justy realised that my computer is now reseting my
Home page sets itself to res://mshp.dll/index.html#37049 everytime I start
Internet Explorer.

here's my hjt log so you guys can see if anything is wrong...this is frustrating

thanks for your help!

Pierre
Logfile of HijackThis v1.97.7
Scan saved at 18:28:59, on 2004-04-09
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\r_server.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\Explorer.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\System32\devldr32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C... Read more

Answer:[Solved] Home page sets itself to res://mshp.dll/index.html#37049

9 more replies
Relevance 66.42%

Hi]
can we not substitute index.html with main.html

are these equivalent

http://www.geocities.com/foo/index.html

http://www.geocities.com/foo

cause they both load the main page?

Answer:can we not substitute index.html with main.html?

Depends on the server configuration.

4 more replies
Relevance 62.32%

Can't get rid of whatever it is that keeps changing my homepage to res://rxseq.dll/index.html#37049.

I've run CWShredder and Ad-aware and all the other programs and here's a log of what's left:

Logfile of HijackThis v1.97.7
Scan saved at 01:04:39, on 18/06/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\msqx32.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\ntfy32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Documents and Settings\Adam Holownia\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\rxseq.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://rxseq.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://rxseq.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Se... Read more

Answer:[Solved] Another "res://rxseq.dll/index.html#37049" problem

8 more replies
Relevance 61.09%

When I go START->HELP AND SUPPORT->INDEX the left pane where the index is to display is blank with only a red x in a small box in the upper left corner. I right click the red x then properties and location shows hcp://system/panels/subpanels/index.htm. I find index.htm in C:\windows\pchealth\hlpctr\system\panels\subpanels\index.htm.

Can someone please help me resolve this problem so the index text will display?
 

Answer:help and support index not displaying

I had that problem a long time ago after installing an update. I think I used System restore and repeated the update process in a different order.

In any case there is a help page for the problem here that gives other alternatives:

http://windowsxp.mvps.org/helpctrindex.htm
 

1 more replies
Relevance 60.68%

My website front page uses index.html (normal). I decided to add a photo album and this uses index.htm.However, the server selects the htm and not the html. This is big problem, since the wrong front page appears. Does any kind soul know a way around this problem ?Colin

Answer:index.html and index.htm

Tell me where the album files are in your site structure. I suspect you have them in the root, which means the same place as your index.html file. Also tell me how people view your album - is it accessed via a navigation button? If it is, create a new folder in your site structure and call it 'album'. Then put all the album files into it, and set the navigation button to link to the index.htm file in that folder.

3 more replies
Relevance 59.86%
Relevance 59.86%
Question: index.html

if i get the url of someones website - is there a way to find and search all of their webpages even if they are not all linked to their index.html page.
 

Answer:index.html

sorta, if using some sort of linux can use wget, http://www.computerhope.com/unix/wget.htm
or can download the wget for windows package.
 

1 more replies
Relevance 59.86%
Question: index.html

Hi everyone, I am trying to get my website up and running but I have a problem I just cannot get over. I have my site ready to publish but everytime I upload it, the index.html page changes its name to index.html.htm. Also the site does not show at all. When i go to the site address I only see two lines of text. One line says "parent directory" and the next line down says "index.html.htm. I have tried to upload the index file on its own but the same happens. If you go to my site address you will see what I mean.............click here I have contacted the technical dept of talktalk and after trying for 20 minutes to get them to help me sort it out they just turned around and said " sorry we cannot help, do a google search to find out" then put the phone down on me. So if anyone has got a website on talktalk or knows how to get it there can you please help me. I have tried the "ftp" transfer on internet explorer and "coreftp". I get the same results. Thanks to anyone who trys to help me.

Answer:index.html

to design your site?

9 more replies
Relevance 59.04%

I deleted all the web pages on my site click here to start again, but I can't publish anything now, presumably because I don't have an index file. But it won't let me create one click hereI have logged in.

Answer:Can I have my index.html back?

Always forget! Click bottom right to enlarge.

10 more replies
Relevance 59.04%

My website homepage shows a malware infection to visitors, I have run every spyware, anti virus known to man, the problem seems to be from a hidden file that I can't find. Here is the hijack this log. This is really annoying as I keep replacing the index.html on the ftp and it repairs it briefly.If anyone can help that would be great.
 

Answer:Index.html keeps getting infected

I have tried every spyware remover and anti virus software under the sun and just when i think i have solved the problem by clearing the temp cache and deleeting everything discovered by the spyware programmes and replace the infected index.html on the ftp location the malware is detected again by visitors a day later, can anyone help??
 

11 more replies
Relevance 59.04%

I know that browsers tend to pull up index.html or index.htm when a site is loaded. I've seen often where an index file was not specified and instead you got a directory listing of that folder. Is there a way (a switch or something) that will show the directory listing even if there is an index.html file in that directory?

I've tried various :, *, list, etc. commands - but haven't found the right one yet.
 

Answer:Avoiding the index.html

part of that depends on if the admin has allowed directory browsing. As far as I know, the server will point to the default page and that's that.
 

1 more replies
Relevance 59.04%

Just got this. Resets the IE homepage and adds a toolbar. Appreciate help to remove.

Thanks in advance
 

Answer:res://msaps.dll/index.html help

Please follow all the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal


If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.

NOTE: In order to resolve the issues you are having it is very important that you at least try to perform all the steps as outlined. If you have any difficulty please post back letting us know what steps you have completed, what you found while doing the scans if anything and details about any problems you have encountered in completing the steps. The more details you can provide the better.
 

1 more replies
Relevance 59.04%

flrman1 and Crunchie, many thanks for assisting folks like me whose PC had the same problem(s) as did haste's. I Googled the offending URL, which was the same one that had hijacked haste's system, and discoverd Tech Support Guy and the helpful two of you.

I followed your advice, installing and running CWShredder, Ad-Aware and Spybot Search & Destroy and installing all Windows critical updates and service packs. A scan of my system's hard drive found and quarantined the Trojan Byte Verify virus. Thanks to you two, I believe my system is now trouble-free. Anything else I should do? Would running that Hijack thing be beneficial?

Trotter
 

Answer:res://mshp.dll/index.html

trotter, post a hijackthis log to check whether anything else is running please

please post it in a new thread as it gets confusing helping 2 people in one thread

go to http://www.thespykiller.co.uk/files/HijackThis.exe and download 'Hijack This!'.
make sure it is placed into it's own folder, not a temporary folder. Then doubleclick the Hijackthis.exe.
Click the "Scan" button, when the scan is finished the scan button will become "Save Log" click that and save the log.
Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in a reply.
It will possibly show issues deserving our attention, but most of what it lists will be harmless or even required,
so do NOT fix anything yet.
Someone here will be happy to help you analyze the results.
 

2 more replies
Relevance 59.04%

ok ive read some threads about this and i did the hijack thingy

this is what i got

Logfile of HijackThis v1.97.7
Scan saved at 12:16:27 AM, on 3/13/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\netdde.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Antivirus Titanium\Pavsrv51.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Panda Software\Panda Antivirus Titanium\AVENGINE.EXE
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Antivirus Titanium\apvxdwin.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\AIM95\aim.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\program files\steam\steam.exe
C:\Program Files\Panda Sof... Read more

Answer:res://mshp.dll/index.html

8 more replies
Relevance 59.04%

Hello, fairly new to this. I have managed to upload my index.html file via FTP software to a web host. I also have a domain name. What is the next step to getting this index.html file to actually appear as my webpage when i load the website address?
Many thanks Sam

Answer:getting my index.html to appear as my webpage

When you type in your web site address the index page is the first one to show. All other pages are linked to that one.

10 more replies
Relevance 58.63%

Been having problems with this "res://vukhf.dll/index.html#841298243" thing for a day or so and it has taken over my browser homepage. I've fixed with HJT and the problems come back. I've scanned with Spybot and CWShredder for what it's worth, and they each find no problems. At one time it changed from vukhf.dll to mshp.dll, but that doesn't happen anymore.
Here's the hijackthis log and whatnot
Logfile of HijackThis v1.97.7
Scan saved at 10:55:43 AM, on 6/15/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\Mixer.exe
C:\WINDOWS\netzu.exe
C:\WINDOWS\System32\wuamgrd32.exe
C:\WINDOWS\System32\SSTray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\WinPoET Broadband Connection\WrOS.EXE
C:\WINDOWS\system32\javaff32.exe
C:\Program Files\Winamp\winamp.exe
C:\Documents and Settings\ain soph aur\Desktop\HijackThis.exe
C:\P... Read more

Answer:res://vukhf.dll/index.html#841298243 help!

10 more replies
Relevance 58.63%

Every time I launch my web browser I am receiving this address(res://mshp.dll/index.html#37049) in my address bar and I cannot get ride of it. I have seen similair threads relating to this. How do I get rid of it?
 

Answer:res://mshp.dll/index.html#37049

Logfile of HijackThis v1.97.7
Scan saved at 1:47:40 PM, on 6/14/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\System32\ltmsg.exe
C:\WINDOWS\System32\tp4serv.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINDOWS\System32\RunDll32.exe
C:\progra~1\c4ebreg\c4ebreg.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\atlxv32.exe
C:\Program Files\Zone Labs\Integrity Client\iclient.exe
C:\Program Files\Common Files\efax\Dllcmd32.exe
C:\WINDOWS\System32\drivers\trcboot.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\IBM\Personal Communications\PCS_AGNT.EXE
c:\sdwork\issimsvc.exe
C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Dantz\Retrospect\Launcher.exe
C:\WINDOWS\System32\svchost.exe
C:\epricer\tomcat\bin\jk_nt_service.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\epricer\jdk\bin\java.exe
C:\WINDOWS\System32\drivers\ldlcserv.exe
C:\Program Files\c4ebreg\isamsmt.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\Program Files\AT&T Network Client\NetClient.exe
C:\PKWARE\PKZIPW\pkzipw.exe
C:\PKT... Read more

2 more replies
Relevance 58.63%

Hi; I think our computer's been hijacked -- can't get rid of this annoying homepage -- res://mshp.dll/index.html#37049

I don't have any experience with all this (even having trouble figuring out the posting procedure here!).

I'm running XP, but beyond that, I don't know what info you'd need to help me. Can anybody help me clean this parasite out? Step by step, please! Thanks! David
 

Answer:can't get rid of res://mshp.dll/index.html#37049

13 more replies
Relevance 58.63%

Hi Tech Support:

I noticed that people are encountering this problem now, I have just got it on my computer as well. I ran HiJackThis and here is what I got.

I will wait for your message before continuing with deleting.

Thank you for your support, you are doing a fantastic job!

Craig

Logfile of HijackThis v1.97.7
Scan saved at 6:31:05 PM, on 2/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\WINDOWS\System32\dvdupgrd.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\CKM\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://mshp.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://mshp.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://mshp.dll/index.html#37049
R1 - HKLM\Sof... Read more

Answer:HELP:::::: rev://mshp.dll/index.html#37049

11 more replies
Relevance 58.63%

This showed up on my INTERNET explorer home page and is affecting a web site i am about to post
how do i blow this away:
res://mshp.dll/index.html#37049
 

Answer:res://mshp.dll/index.html#37049

Download CWShredder from http://209.133.47.200/~merijn/files/CWShredder.exe & run it. Select the fix button & it will get rid of everything related to CoolWebSearch. Close ALL other programs including IE before running CWShredder.
 

1 more replies
Relevance 58.63%

Hi,

First of all, I'm new to this forum and I'm looking for some help please!

I need some help about this problem, I get the "res://mshp.dll/index.html#37049" as my homepage whenever I open the browser. Is there someone to guide me through, solving this problem?

And I have another problem and I don't know if it has to do with the above problem or not. Each time before turning off the PC or logging off, I'm receiving this popup menu error:

--------------------------------------------------------------------------------------------------

End Program - rundll32.exe

This Program is not responding.

Tho return to Windows and check the status of the program click cancel. If you choose to end the program immediately you will lose any unsaved data. To end the program now, click end now.

---------------------------------------------------------------------------------------------------

Thanks in advance!
 

Answer:need to get rid of:res://mshp.dll/index.html#37049

7 more replies
Relevance 58.63%

I think my home computer has a bug. We use Yahoo as our home page. Recently whenever we do a search in Yahoo another search program pops up in front and then it changes our home page from www.yahoo.com to

res://mshp.dll/index.html#37049

This is getting to be a pain in the butt....how do I correct the problem.
Thanks
 

Answer:res://mshp.dll/index.html#37049

10 more replies
Relevance 58.63%

I have Windows XP. I use a Firefox browser. I have downloaded a program called Digital Pali Reader. I have used it with no problems several times. I started getting warnings that Windows did not have enough disk space so I tried removing some programs. I removed a program called 7-Zip. The next time I opened the Digital Pali Reader I got this error message "Windows cannot find C|Index.html" and then within one second the Digital Pali Reader would load. I downloaded a beta version of 7-Zip since I figured that deleting the previous 7-Zip program caused this error message. Now when I click on Digital Pali Reader it sometimes loads without the error message and sometimes loads preceded by the error message. Does anyone know why the error message is coming up?
What would I need to do to stop it from coming up?

Please give simple step by step instructions assuming that I am a beginner not an advanced computer user.

thanks,
Dipa
 

Answer:Windows cannot find C|index.html

Pressuming this error pops up whenever you open your browser do the following. Open the browser, and when you encounter the error just click OK to get past it. Then manually set the home page by typing something like CNN.com in the address bar or whatever URL you want, then :
Click on Tools » Options » Main » Use Current Page
Click OK to apply settings.
Let me know if this works.
 

2 more replies
Relevance 58.63%

I have seen many people with the same situation, but I have yet to find a solution. My home page resets to res://dmkc.dll/index.html#96678, and my internet is running slow. I have scanned my computer with Norton Antivirus, Spybot, Ad-aware, and aboutbuster, but have had no luck. I have downloaded Hijackthis, but I have not run it yet. I am using windows XP, and have a 3.0 cable connection. If anyone can help I would greatly appreciate the time. Thanks!
 

Answer:Help???...res://dmekc.dll/index.html#96678

8 more replies
Relevance 58.63%

res://mshp.dll/index.html#37049.............How do I get rid of this. I do not know how to get rid of this. I'm kinda new at computers.
 

Answer:res://mshp.dll/index.html#37049

Here's a how to article:

http://www.pchell.com/support/lookfor.shtml

Steve
 

1 more replies
Relevance 58.63%

"Home Search Assistent" strikes again! Here is my latest Hijackthis log:

Logfile of HijackThis v1.97.7
Scan saved at 11:37:11 PM, on 6/21/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wapisvsu.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\ntez.exe
C:\WINDOWS\system32\ipow32.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\unzipped\hijackthis\H... Read more

Answer:res://ccvbc.dll/index.html#96676

7 more replies
Relevance 58.63%

Greetings, I am new to this sort of thing and really am impressed with the amount of help and software avalible to help with this. I would like to say I have read a bit, looked around and tried to solve the problem on my own. However I am not having much luck and below I will explain what I have done. (1) I downloaded the CoolWebShredder and ran it, it detected nothing on my computer and claimed it to be clean, and that was after I scanned for updates.(2) I downloaded HijackThis and ran it. I saw several of the malious files and checked them all, only the ones I knew for sure were the problem, containing the name //pmyqy.dll/index.html#96676. However after fixing them, I reset my homepage, opened explorer, closed explorer, it stuck which told me it was not gone. I then opened Explorer and bam. Its back! Please let me know what else needs to be done, I know maybe its something in the registry but I am not 100% how to or what to do. Please help, thank you.Below I have included my HijackThis log.Logfile of HijackThis v1.97.7Scan saved at 4:15:14 PM, on 6/18/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEX... Read more

Answer:pmyqy.dll/index.html#96676

Please do not open Internet Explorer during any portion of this process.Please make sure that you can view all hidden files. Instructions on how to do this can be found here:How to see hidden files in WindowsStep 1:Click on start, the control panel, then administrative programs, then services. Look for a service called Network Security Service. Double click on the that service and click stop. Also write down the name and path of the file listed in the Path to executable field. This filename must be deleted below.Step 2:Press control-alt-delete to get into the task manager and end the follow processes if they exist:C:\WINDOWS\apiuo32.exeC:\WINDOWS\system32\winnl32.exeStep 3:I now need you to delete the following files:C:\WINDOWS\apiuo32.exeC:\WINDOWS\system32\winnl32.exeThe file from the services above. Probably C:\WINDOWS\apiuo32.exe already listed. Need to make sure thoughC:\WINDOWS\system32\pmyqy.dllC:\WINDOWS\winlc32.dllAlso delete any files that have the same name as these files but end with a dll. You should see them right next to each other.If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.Step 4:Then run hijackthis and fix these entries:R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\pmyqy.dll/sp.html#... Read more

13 more replies
Relevance 58.63%

i have read some of the posts on hijackers and have tried a bunch of different spywares on how to get rid of spyware. can someone give me specific info on res://xziwb.dll/index.html#37794 which i haven't seen. i have windows 2000

thanks a million in advance
 

Answer:res://xziwb.dll/index.html#37794 bug

16 more replies
Relevance 58.63%

Hello,
I found some information pertaining to my problem but it's not an exact match. There was a post from Tordis that was very similar. Anyway... The internet explorer on the problem machine will not take me to the internet. Everytime I start IE it comes up with the Microsoft Office window stating that it is installing components. It will supposedly finish installing components and then redirect to the location above and there will also be a small pop-up window open. I have uninstalled and reinstalled office and Internet Explorer. I'm fairly sure that there are no virus' on the PC. (symantec corporate edition) So I'm not sure where to go from here. I ran the CwShredder and it only found and fixed CWS.Winshow. Below is the Hack This log from the machine after Shredder was run. Would appreciate any help possible. Thanks.

Logfile of HijackThis v1.97.7
Scan saved at 7:12:33 AM, on 7/6/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\mnmsrvc.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Analog Dev... Read more

Answer:res://tcqwc.dll/index.html#37049

Found the answers I needed from flrman and dvk. Thanks for the help!!
 

2 more replies
Relevance 58.63%

hi there, I've got a nasty little cws variant I can't remove with adaware, cwshredder, about:buster, or norton. If some one could walk me through the hijack this deletion process it would be greatly appreciated.
Logfile of HijackThis v1.98.2
Scan saved at 7:18:18 PM, on 8/7/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\TPWRTRAY.EXE
C:\WINDOWS\System32\TFNF5.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\system32\javahc.exe
C:\WINDOWS\System32\wlfcupw.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\AOL Companion\companion.exe
C:\toshiba\ivp\ism\ivpsvmgr.exe
C:\WINDOWS\system32\apird.exe
C:\WINDOWS\system32\crjb32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search ... Read more

Answer:res://nsqei.dll/index.html HELP please. log posted

by the way the trojan is on a different machine, not hooked up to the internet, or being rebooted. so the log should stay the same.
 

3 more replies
Relevance 58.63%

I ran both Norton(Updated) and adaware(Updated). Still my homepage keeps getting changed to res://wedmd.dll/index.html.

I have manually changed it back and it seems to work about once. Then it goes back to res://wedmd.dll/index.html.

Also, now I keep getting this popup with the title, 'Only the best'.

Any help?
 

Answer:IE Hijacked!! res://wedmd.dll/index.html

unclematty said:



I ran both Norton(Updated) and adaware(Updated). Still my homepage keeps getting changed to res://wedmd.dll/index.html.

I have manually changed it back and it seems to work about once. Then it goes back to res://wedmd.dll/index.html.

Also, now I keep getting this popup with the title, 'Only the best'.

Any help?Click to expand...

try running spybot search and destroy, make sure you have the latest updates. see if that helps, then maybe if still no luck post a hijack log?
 

2 more replies
Relevance 58.63%

Have a website barendh.com with a simple structure, starting with index.html.
Whenever I update some files this works fine, but when I try to replace index.html still the old version is shown, even when I just rename it to index.htmlBAK.
I suppose it's some sort of refreshing thing, but I can't seem to find an option in Firefox 11 nor in IE.

Answer:Website: index.html does not register

press F5 in internet explorer. fixed?

1 more replies
Relevance 58.63%

When I type www.localhost, where is index.html

I have asked this question on other news groups even Microsoft. Why is this such a hard question to answere. I have installed Apachi web server on my PC but when I type www.localhost into a web browser, I find myself looking at a difrent file.

HELP

Answer:When I type www.localhost, where is index.html

Hi Otuatail,

Try typing just localhost and leave out the www. That may work. If not, you can try typing 127.0.0.1

Hope that helps!
Snarks

9 more replies
Relevance 58.63%

Anyone know how to get rid of a jpeg with spyware built into it. It is in my Temporary Internet file and I cannot delete it. It has taken over my home page and keeps asking me to buy some software to remove spyware. I used Spybot S&D and it did not clean this file and i still have the same problem.
 

Answer:res://oopuq.dll/index.html#96676

16 more replies
Relevance 58.63%

How do I fix this? I ran Hijack This and this is what it says...

Logfile of HijackThis v1.97.7
Scan saved at 10:42:14 PM, on 4/23/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\config\services.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Program Files\hijackthis1977[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://mshp.dll/index.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.html
R0 - HKLM\Software\Microsof... Read more

Answer:res://mshp.dll/index.html#37049

11 more replies
Relevance 58.63%

I am running WIN 2000 and I can't get rid of the above home page. Following is my file after I run HiJackThis. Any help would be appreicated. Thanks.

Logfile of HijackThis v1.97.7
Scan saved at 11:33:26 AM, on 4/7/2004
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\DSentry.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.enjoysearch.info/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Mai... Read more

Answer:res://mshp.dll/index.html#37049

Click on the link below to download CWshredder.
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Run the program and let it do it's thing. Make sure to click on "Fix" and not scan only.

Next:

Download Spybot http://www.sherrylynn.us/privacypolicy.htm

Make sure to follow the instructions for updates prior to running the scan.

Click on "Search For updates" After the search has completed, the available Updates will be listed. Choose which Updates you would like to Download. Click "Download updates." The Updates will self install. The screen will change and the program will come back and be ready to use.

Sometimes the default Download Location will produce an Error. If that happens, look in the right panel. There you will find a small arrow next to the name of the current Download site. Click on it for a list of alternate sites. One of those should be able to retrieve the files you have selected.

Scan, click on fix problems then reboot.

Post another HJT log.
 

2 more replies
Relevance 58.63%

Hello everyone:

I did a search for "res://mshp.dll/index.html#10213" which is keep resetting my homepage to this URL. But I didn't find any info on it. I must have downloaded some other junk as well because I keep getting pop-ups too. Please let me know how I can remove this. Also I wanted to donate some money but when I clicked on the VISA donation banner, a message came up and didn't let me make a donation.

Thank you,

ARS01760
 

Answer:res://mshp.dll/index.html#10213

16 more replies
Relevance 58.63%

My home page is reset to res://ghtba.dll/index.html#96676 I have run cwsshredder, adaware, and spybot. i am currently scanning with norton. Here is my hijack log file. Any help you can give me would be appreciated! Thank you!

Logfile of HijackThis v1.97.7
Scan saved at 5:16:17 PM, on 6/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\winuu.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\CTHELPER.EXE
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\SysAgent\SysAgent.exe
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe
C:\Program Files\Verizon On... Read more

Answer:res://mshp.dll/index.html#37049 PLEASE HELP!!

dat1greek, I've split you into your own thread. Please don't post your log in another person's thead, it's too hard to assist two people in one thread.

Go here http://www.zerosrealm.com/index.php?page=dllfix and download About:Buster
Don't run it yet!

You need to post another HJT log and don't reboot until you get assistance.
 

1 more replies
Relevance 58.63%

Help me, please! I've been running both Spybot Search & Destroy and Ad Aware to fight this thing and it's not solving it. (And I just read in this forum that it only aggravates the problem!)

I saw the post from fireman1 about how to go offline and fight this thing. And I started following those directions. I went to Start> Run and typed in services.msc and the appropriate window popped up.

but when I right-clicked on Network Sercurity Services and clicke Properties, I was given this error message:

Configuration Manager: A required entry in the registry is missing or an attempt to write to the registry failed.​

Below is my Hijack This log. Any help you can provide will be much appreciated and if we can solve this I will gladly donate to the site. Thanks!

Logfile of HijackThis v1.97.7
Scan saved at 10:05:33 PM, on 7/7/2004
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system\digisc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\mgabg.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\win... Read more

More replies
Relevance 58.63%

Hello I need some help.

Everytime I run internet explorer I get this:
res://lovcd.dll/index.html#37049

And also the windows installer is activated for MS Office XP. If I run any program the installer is activated. I have no idea how or why.

I did run all the adware programs possible and still nothing.

Please help
Heres the log:

Logfile of HijackThis v1.97.7
Scan saved at 5:48:14 PM, on 6/16/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\ieqi.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\atlyu.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\lovcd.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://lovcd.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://lovcd.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\lovcd.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://lovcd.... Read more

Answer:res://lovcd.dll/index.html#37049

First install SpywareBlaster from www.javacoolsoftware.com This will prevent reinfection Make sure you update it first.

Then check these for fixing:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\lovcd.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://lovcd.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://lovcd.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\lovcd.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://lovcd.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\lovcd.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: (no name) - {2816A669-5396-432D-C6A2-978A8E8A9E63} - C:\WINDOWS\msnq.dll
O4 - HKLM\..\Run: [atllh32.exe] C:\WINDOWS\system32\atllh32.exe
O4 - HKLM\..\RunOnce: [atlwl.exe] C:\WINDOWS\atlwl.exe
O4 - HKLM\..\RunOnce: [ntrz.exe] C:\WINDOWS\ntrz.exe

next delete in safe mode lovcd.dll, atllh32.exe, atlwl.exe and ntrz.exe
 

2 more replies
Relevance 58.63%

i am designing a website and for some reason the domain xyz.com is not showing the same content as xyz.com/index.html any ideas? thanks for any help
im uising webplus x8

Answer:domain name not showing same as index.html

Are you saying that you have uploaded the site files to the server, but the content when viewed in a browser is not what you uploaded?

1 more replies
Relevance 58.63%

Here is my hijackthis log.

Logfile of HijackThis v1.97.7
Scan saved at 12:39:57 AM, on 6/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\mfcby.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\apifj32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\pqgad.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://pqgad.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://pqgad.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\pqgad.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://pqgad.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\pqgad.dll/sp.html#37049
O2 - BHO: (no name) - {EAF849B0-D48F-42B8-2286-38E91D0091E5} - C:\WINDOWS\apifj32.dll
O3 -... Read more

Answer:res://pqgad.dll/index.html#37049

Looks similar to the mshp.dll problems and my very own ortlx.dll problem which I just posted about an hour ago.... is there something new spreading around we don't know about?
 

2 more replies
Relevance 58.63%

I am having problems with pop-up and my IE 6 continue to start res://mshp.dll/index.html#10213 I have also noticed that it takes quite long time to open programs such as Outlook, Word etc. Norton Antivirus 9.05.15 is not able to locate the problem.

I have down-loaded HijackThis v1.97.7 (below is the logfile). Your assistance would be highly appreciated

Logfile of HijackThis v1.97.7

Scan saved at 18:12:55, on 2004-01-08

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\System32\ctfmon.exe

C:\PROGRA~1\MICROS~4\Office10\OUTLOOK.EXE

C:\WINDOWS\System32\Ati2evxx.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Analog Devices\SoundM... Read more

Answer:res://mshp.dll/index.html#10213

Click on the link below to download CWshredder
http://www.merijn.org/files/cwshredder.zip

Run the program and let it do it's thing.

Make sure you follow the advice about the security updates listed at the bottom of the page, in order to prevent re-infection.

Reboot.

Now post another log and let's see what's left.
 

2 more replies
Relevance 58.63%

Help! I've been following threads on how to fix this problem. I get the "res://mshp.dll/index.html#37049" URL whenever I open the browser. I've been trying suggestions posted here to no avail. it keeps coming back. hijackthis.log is attached.

i tried everything,ad aware 6, Spybot - Search & Destroy, HijackThis, CWShredder.

how do i get rid of that

thanks
 

Answer:res://mshp.dll/index.html#37049

Welcome to TSG!!

Double click on Hijackthis.exe then click on the "Scan" button, then click on "Save Log".

Copy and paste it back here and someone will be happy to review it.

Don't make any changes until instructed to do so.
 

1 more replies
Relevance 58.63%

Can someone please help me get rid of this home search webpage, here is my HijackThis Log, Thank you

Logfile of HijackThis v1.97.7
Scan saved at 1:06:42 PM, on 6/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\appmg32.exe
C:\WINDOWS\iery32.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Temp\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\mfsdq.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://mfsdq.dll/index.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://mfsdq.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\mfsdq.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://mfsdq.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\mfsdq.dll/sp... Read more

Answer:res://mfsdq.dll/index.html#96676 HELP!! here is the log

Please don't duplicate post, keep replying back to your same thread.

http://forums.techguy.org/showthread.php?t=240618
 

1 more replies
Relevance 58.63%

I have the same problem as the previous user has hijacked my computer homepage and I am too much od a novice to follow what you told him. Please help get rid of the res://mshp.dll/index.html#37049 problem.

adam
 

Answer:res://mshp.dll/index.html#37049 PLEASE HELP!!

13 more replies
Relevance 58.63%

I have been following your thread and have been trying to fix a similar problem dealing with "res://mshp.dll/url_error.html#yahoo.com/" and the pop-up "only the best" or.

Can you help me also?

Logfile of HijackThis v1.97.7
Scan saved at 9:29:44 AM, on 6/14/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
C:\WINDOWS\System32\LMSXXD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\Bin\HPOstr05.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\bin\HPOVDX05.EXE
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\US\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: . - {D34F08C5-4F18-477c-86CB-1A9BEECFE37B} - C:\Documents and Settings\US\Ap... Read more

Answer:res://mshp.dll/index.html#37049 PLEASE HELP!!

12 more replies
Relevance 58.63%

Hi, I'm having some problems with spyware. Whenever I open up my IE my homepage is set to "res://zqnfr.dll/index.html". Also, whenever I search for anything using google, other "searching" pages come up like "http://search-to-find.com/" and "lookingfor.cc". On top of this pop-up adds are occasionally popping up. I've used ad-aware and HiJackThis, but it hasn't worked. Also, I noticed some unusual running processes, closed them down and removed them from startup using msconfig. I've done what I can, but my IE is still messed up.
I'm posting my HiJackThis log. Thank you in advance for your help.

Logfile of HijackThis v1.97.7
Scan saved at 1:13:54 PM, on 6/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMg... Read more

Answer:ARGH! res://zqnfr.dll/index.html

6 more replies
Relevance 58.63%

Hi everybody,

I seem to be having a problem with my home page staying put. It was originally changed to res://mshp.dll/index.html#37049 and when I opened IE it would start the windows xp installer dialog box and then ask for my windows xp cd to find some file. So I gave it the cd and it seemed to be content with that. I have Ad Aware with the latest updates and I have run that several times and it always finds something, but it isn't curing the home page problem or getting rid of these random popups I keep getting. I have also downloaded Hijackthis and tried that.....but I didn't fix very many things that it found because I really have no clue what it is telling me! Now everytime I open IE it has a different homepage. The current one is res://mgzer.dll/index.html#37049. It always seems to change the dll filename portion.

Anyone have any ideas???
Thanks to all,
A
 

Answer:Help! res://mgzer.dll/index.html#37049

I can't help but i ran into the same thing today...ended up reinstalling the OS.
 

3 more replies
Relevance 58.63%

My Hp Pavillion 510c running: xp proffesional is been bombarded by :
res://xypmb.dll/index.html#96676
I looked at other threads with the same problem, but each had different names and I was unsure of what to delete.
I'll post my log from HJT. If anyone knows how to solve this riddle, please help.
Jay

Logfile of HijackThis v1.97.7
Scan saved at 12:42:44 PM, on 6/22/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\d3zu32.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\javahr32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\My Documents\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xypmb.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Star... Read more

Answer:res://xypmb.dll/index.html#96676

16 more replies
Relevance 58.63%

Please HELP. I can't delete this.

Thanx in advance.
Logfile of HijackThis v1.97.7
Scan saved at 16:37:50, on 30-06-2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAMAS\FICHEIROS COMUNS\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAMAS\FICHEIROS COMUNS\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\HPZSTATX.EXE
C:\PROGRAMAS\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\ATLQN.EXE
C:\WINDOWS\CRJO32.EXE
C:\WINDOWS\CRJO32.EXE
C:\WINDOWS\SYSTEM\MFCVM32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\AMBIENTE DE TRABALHO\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\jvels.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://jvels.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://jvels.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\jvels.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://jvels.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res... Read more

More replies
Relevance 58.63%

How do I get rid of this!
 

Answer:res://iafsz.dll/index.html#37049

Hi Verna,

Please do this. Click here to download Hijack This. Run Hijack this.
Click the "Scan" button when the scan is finished the scan button will become "Save Log" click that and save the log.

Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in a reply.

DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required. Someone here will be glad to advise you on what to fix.

*Note: When you download Hijack This Do Not download it to a temp folder or to the desktop. Create a permanent folder somewhere like in My Documents and name it Hijack This and put it in that folder.
 

1 more replies
Relevance 58.63%

First off...I just want to thank everyone that contributes to this site, you all have help me sort out most of my problems. As indicated I was hijacked by CoolWebSearch. After checking this site at work, especially the thread from e-liam dated Feb 15, 2004, I forwarded the fixes, including CoolWebShredder, Highjack this, Spybot search and destroy, Windows updater and ad-aware. I was fortunate that my e-mail operated as I was unable to get my internet explorer operating as it was freezing upon opening on CoolWebsearch. Anyhow...thanks again.

I have attached a hijackthis.log, if anyone cares to take a look and possibly give me any further pointers.

Thanks in advance!

Logfile of HijackThis v1.97.7
Scan saved at 9:02:26 PM, on 17/05/04
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\FINDFAST.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OSA.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.... Read more

Answer:res://mshp.dll/index.html#37049 ....I have done what I can!!!!

6 more replies
Relevance 58.63%

First off, I note that this problem is being discussed in another thread, but I didn't want to 'hijack' that person's thread, so I apologise in advance if I've committed a tech guy sin, and please merge if appropriate.

I have tried a million things to get rid of this crap: spybot, hijackthis, ad-aware, cwshredder, but to no avail. From everything I've read thus far, it looks like the only thing to do is post my hijackthis log and get some genius' help so PLEASE HELP!

I've also been getting this pop-up page when I do searches in google, as well as a left-hand side bar thingy (?).: http://search-777.com/sec.php?qq=fdfs
Not sure if this is related to the stupid coolwwwsearch crap or some other wonderful disaster all to itself.

Logfile of HijackThis v1.97.7
Scan saved at 12:39:40 PM, on 6/13/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 4\CREATECD\CREATECD.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\MSOFFICE.EXE
C:\PROGRAM FILES... Read more

Answer:res://mshp.dll/index.html#37049

Hi chim, welcome to TSG.

You did the right thing starting your own thread. I know you're waiting for a genuis to help here, but you got me instead.
Okay, close your browser and check the following entry in HJT, click Fix and then REBOOT.

O4 - HKLM\..\RunServices: [SystemSAS] system32.exe
After rebooting, find and delete this file:

system32.exe
Now, I don't see any antivirus application running or firewall.

Good idea to go here for a free online AV scan:

http://housecall.trendmicro.com/housecall/start_corp.asp
 

3 more replies
Relevance 58.63%

Hello,
I found some information pertaining to my problem but it's not an exact match. There was a post from Tordis that was very similar. Anyway... The internet explorer on the problem machine will not take me to the internet. Everytime I start IE it comes up with the Microsoft Office window stating that it is installing components. It will supposedly finish installing components and then redirect to the location above and there will also be a small pop-up window open. I have uninstalled and reinstalled office and Internet Explorer. I'm fairly sure that there are no virus' on the PC. (symantec corporate edition) So I'm not sure where to go from here. I ran the CwShredder and it only found and fixed CWS.Winshow. Below is the Hack This log from the machine after Shredder was run. Would appreciate any help possible. Thanks.

Logfile of HijackThis v1.97.7
Scan saved at 7:12:33 AM, on 7/6/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\mnmsrvc.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Analog Dev... Read more

Answer:res://tcqwc.dll/index.html#37049

very similar to the problem i am having.. HOME PAGE PROBLEMS ...down lower have a look at some of the suggestions
 

2 more replies
Relevance 58.63%

this has taken over my IE and I am not smart enough to fix please....... ran adware ..norton....spybot.... cwshredder...... nothing is working
 

Answer:res://fodsc.dll/index.html#12802 ..... please help

omg .....someone ???????????????????
 

1 more replies
Relevance 58.63%

I have been having a lot of problems with my computer changing its home page to 'res://amymw.dll/index.html#37049' and a lot of popups from "Only the best." The problem was dealt with in a similar situation here http://forums.techguy.org/showthread.php?t=237754, but from following that I can't quite get rid of it. The .dll file in the address bar keeps changing when I try to follow those instructions, and I can't seem to figure out what is causing it to recreate. Please Help, I have tried ad aware and spybot which don't really do much.

Heres the 'Hijack this' log:

Logfile of HijackThis v1.97.7
Scan saved at 12:36:59 PM, on 6/28/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common files\WinTools\WToolsS.exe
C:\WINDOWS\system32\crvo32.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\IEHost.exe
C:\WINDOWS\System32\gljhvswy.exe
C:\WINDOWS\system32\d3cj32.exe
C:\WINDOWS\System32\S3tray2.exe
C:\Program Files\Common files\Win... Read more

Answer:HELP WITH 'res://amymw.dll/index.html#37049'

Welcome to TSG

Un-install "WinTools" in add/remove programs.
Do not run any scans or re-boot your machine yet!

Please download this tool called About Buster from:
http://www.atribune.org/downloads/AboutBuster.zip
Created by RubberDucky
Unzip it to your desktop but don't run it yet.

Now start Hijackthis and tick the boxes next to these items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50093
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\amymw.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://amymw.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://amymw.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\amymw.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://amymw.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\amymw.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50093
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50093
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A1... Read more

1 more replies
Relevance 57.81%

Just had the shock of my life to see my home page overwritten.Won't say what it said or what it advertised, as I don't want to "promote" whatever it is.Have just e-mailed my web host informing them of time & date the page was uploaded. Probably a good idea to change my password as well.Any other suggestions? Are these sort of incidents a 1 off?g-g

Answer:Home page (index.html) hacked

It's a shock when it first happens. There are three common possible causes, and you need to investigate them to prevent a repeat:Your FTP password may been grabbed one of the examples of malware that are design specifically for that purpose. No security software has 100% detection - it's not practically possible.If you have a shared server, as most people do, someone else's server space was compromised to an extent that allowed access to your account, which can easily happen if the host's own security measures are not good enough. This can be spotted if other sites with the same host are also hacked. If you can find evidence for this, move to another host.Your PHP scripts are not up to scratch security-wise and someone with the skill to do it was able to exploit that. Similarly, your php.ini file may need some adjustment. If you have any PHP programs on your server but you don't have a php.ini file, you need one!The last option is the most common method of hacking websites.

3 more replies
Relevance 57.81%

Here is the hijackthis file. If anyone can help I would greatly appreciate it.
Thanks, Big T



Logfile of HijackThis v1.97.7
Scan saved at 12:38:26 PM, on 12/18/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\system32\stisvc.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\GWMDMMSG.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Zone Labs\Z... Read more

Answer:hijacked by: www.bettersearch.biz/face2/index.html

I think that the tools will get this stuff.

Please download Ad-aware SE and install it if you don't have it already. Make sure it's the newest version and check for any updates before running it. Also go here to get the plug-in for fixing VX2 variants. To run this tool, go into Ad-aware->Add-ons and select VX2 Cleaner. Then click Run Tool and OK to start it. If it's clean, it will say Status System Clean. Otherwise, you will have to click on the Clean button to remove the VX2 infection. Also make sure to customize the settings in Ad-aware for better scan results. Run the scan and fix everything that it finds.

If you have a fast internet connection (broadband), run an online virus scan at TrendMicro. Make sure to select the Autoclean option. Otherwise, make sure your antivirus program has the latest definitions and run a full system scan.

Then, please reboot your computer and post a new log.

While you are waiting for a reply...


To help prevent future spyware installations/infections, please read the Anti-Spyware Section and use the tools provided.

3 more replies
Relevance 57.81%

Hi all,

A popup window began appearing on my website a few days ago saying it was infected with malware and that I should go to a website to find out about the problem. I didn't click on the link, nor am I going to post it here, but it ended with .ru

Looking at my website's files in FileZilla it appeared all my index.html files had been modified on the same date, not by me. My site is new, so all the files online were just testing files and not important, all deleted now. The hosting company changed all passwords for me and mentioned I should check for keyloggers.

AVG and Malwarebytes have not found anything on my computer. A few months ago AVG did find some suspicious 'twain32' files - these were quarantined/removed and further scans by AVG and other software found nothing. However with my website being hacked in the last few weeks I'm now starting to worry if anything malicious is on my computer.

Would appreciate some advice with this.
Specs: PC running Windows XP Pro SP3 updated.

Answer:index.html files on my website hacked

Please download DrWeb-CureIt and save it to your desktop. DO NOT perform a scan yet.Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".Scan with Dr.Web CureIt as follows:Double-click on launch.exe to open the program and click Start. (There is no need to update if you just downloaded the most current versionRead the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.The Express scan will automatically begin.
(This is a short scan of files currently running in memory, boot sectors, and targeted folders).If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All. (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media.In the top menu, click Settings > Change settings, and unheck "Heuristic analysis" under the "... Read more

11 more replies
Relevance 57.81%

I have a web site which I use to show photos etc to family and friends. Recently NTL cut out (I am on Broadband) while I was uploading a revised Index page. Now when I open the site it shows the old Index page as the homepage, but if I use a drop-down list to navigate to another page, and then use it again to return to the "homepage" I get sent to the new Index page (called Index.html)How can I get rid of the old one?The website is at click here

Answer:Homepage is not latest Index.html file

I confess that I couldn't take that mouse trail for more than a few seconds, but I think you need to upload again. You can only have one index.html file, although browsers will look for index.htm as well.

10 more replies
Relevance 57.81%

Ok, im not too good with Computers but my homepage has changed to res://mshp.dll/index.html#37049 and I dont know how to get rid of it. I heard something about using the hijackthis.exe So i did that and here are my results. PLEASE HELP ME!!

Logfile of HijackThis v1.97.7
Scan saved at 7:09:46 PM, on 2/27/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\wt\updater\wcmdmgr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\DELL\AccessDirect\dadapp.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AIM95\aim.exe
C:\PRO... Read more

Answer:res://mshp.dll/index.html#37049 homepage

9 more replies
Relevance 57.81%

My wife clicked into some site that borked her notebook rather nastily with a custom, non removable homepage and a boatload of unstoppable pop-ups. Turned out to be an app called "homepage hijacker". Here is how to remove it: http://www.pchell.com/support/lookfor.shtml
 

Answer:Homepage = res://mshp.dll/index.html#10213

Wow, they're getting trickier and trickier. Thanks for the heads up.
 

2 more replies
Relevance 57.81%

Hi all,

This is my first time on this forum, actually on any forum. I have got this problem with my browser where it has been Hijacked by "Home Search"? Actually, I don't even know what it is. I have searched everywhere for a solution, but nothing specific to the "mcmenu.dll" page.

I have found helpful information on this forum to do with programs like "Hijack This". After several attempts at trying to remove it, it still resides on my pc somewhere. Can someone please help. Thanks in advance.

Here's the log file from "Hijack This":

Logfile of HijackThis v1.97.7
Scan saved at 6:27:09 PM, on 17/06/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winzg32.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Logitech\ImageStudio\LogiTr... Read more

Answer:[Resolved]Can Someone help with res://mcenu.dll/index.html#96676

10 more replies
Relevance 57.81%

Ok this is probably not possible but I will run it past you folks. I have two similar domains let's say click here and click here.Currently I have both pointed to a single hosted site.Normally of course a domain would be pointed to direct or forward for an index,html file as homepage.However I would like to be able to point the click here to a particular page hosted on the existing site - eg. use a small amount of the already set up hosting space to effectively run a second very small site - which would probably be only one page -Having tried with 1 & 1's control panel it doesnt seem possible as the convention is to redirect an url to a home page called index.html but I wonder if I am missing something.In essence, I am just trying to avoid having to pay for more hosting tfor a small unconnected site when my current hosted space is underutilised though it msy not be possible.

Answer:Pointing.rediredting a domain to non index.html

Ps the click heres (forgot about those!) should be read as theoretical examples only eg wwww mysite co uk and wwww mysite.com

6 more replies
Relevance 57.81%

I have WINDOWS ME and just started having this problem a couple of days ago. My startpage always returns to res://mshp.dll/index.html#37409. I've tried spybot, as-aware, avg, and tried follow along another thread with hijackthis but that was for an XP platform so that didn't work. Anybody know how to get rid of this annoyance?
 

Answer:Help remove res://mshp.dll/index.html#37409

Hi,

As far as I am aware running spybotbot on all O/S is the same. Here is a tutorial, it would certainly help if we could get that log:

http://www.bleepingcomputer.com/forums/index.php?showtutorial=43
http://www.safer-networking.org/index.php?page=spybotsd
This program may also remove the problem: CWS SHREDDER

http://www.spywareinfo.com/~merijn/downloads.html

Wizzkid
 

1 more replies
Relevance 57.81%

Hello everybody and help!

I have been having this problem for the last four weeks. Whenever I set my IE startpage it always returns to res://jsykc.dll/index.html#96676 and usually includes pop ups. I used spybot, ad-adware and Norton Antivirus Pro to try to eliminate the threats identified, however could not eliminate most of them even after viewing the hidden files & folders. Today, Norton identified a Trojon Horse virus which I quarantined. I have a home network with one other computer that also has adware pop ups. This is driving me crazy and any assistance would be very much appreciated. I am a new user and had seen that Tordis had a similar problem that firman1 was able to remedy. Hope someone can help me.
Thanks

Here's my hijackthis log:
Logfile of HijackThis v1.97.7
Scan saved at 5:22:58 PM, on 16/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Sym... Read more

Answer:res://jsykc.dll/index.html#96676 Need help badly!

16 more replies
Relevance 57.81%

When ever I open up Internet Explorer it always goes to this as my homepage: res://hgptq.dll/index.html#96676 I can't change my homepage to anything else because it always changes back. When I search on google a second search page comes up searching for the same same thing Ive just typed in on google. The site that pops up is http://search-to-find.com . Ive run Ad-aware and its always detected a process(which comes back when i delete in in Ad-aware or in task manager. Sometimes it disapears and a new one replaces it), some registry values and sometimes registry keys and a few files but it can't delete them all permanently. They always come back. Please help me! Here is my HijackThis log:

Logfile of HijackThis v1.97.7
Scan saved at 8:19:58 PM, on 6/27/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SAV\DefWatch.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\System32\cba\pds.exe
C:\PROGRA~1\SAV\Rtvscan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ams_ii\hndlrsvc.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\ams_ii\iao.exe
C:\WINDOW... Read more

Answer:IE hijacked to res://hgptq.dll/index.html#96676 PLZ HELP

any help would be greatly apreciated(sorry this thing is getting to me).
 

1 more replies
Relevance 57.81%

I have a Dell laptop and having major performance problems with this. I keep getting this pop up hxxp://pcspeedmaximizer.s3.amazonaws.com/index.html and also you have won a Walmart card. performance is extremly slow. I have Norton on there but it seems to still have prblem. Can anyone help me with this issue?

Answer:http://pcspeedmaximizer.s3.amazonaws.com/index.html

Hello,Please follow the instructions in ==>This Guide<==. If you cannot complete a step, skip it and continue.Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Please include a description of your computer issues and what you have done to resolve them.If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.Orange Blossom

1 more replies
Relevance 57.81%

I got here through a link recomended in a support forum

Have the same problem as Tordis - in link :

http://forums.techguy.org/showthread.php?t=237754

It seems to me he has some diffrences in his log so i decided to pop the problem here again.

Here is my log
Logfile of HijackThis v1.97.7
Scan saved at 20:19:59, on 20/07/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\GEARSEC.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\ipnj.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Barak013\fts.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\BARAK013\FWPortal.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\mfchp32.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\hagai\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WI... Read more

More replies
Relevance 57.81%

Hi....Every few times I open FF, another window opens to: hxxp://9newstoday.net/hoj/hoj/index.html. Ive run malwarebytes and Spybot, but they don't find anything. Ive read through several threads on this forum and others and didn't want to go any further without asking for help...

Answer:FF 9.0.1 Hijacked to: http://9newstoday.net/hoj/hoj/index.html

Please download GooredFix from one of the locations below and save it to your DesktopDownload Mirror #1Download Mirror #2Ensure all Firefox windows are closed.To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).When prompted to run the scan, click Yes.GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).=====================================================================Download Security Check from HERE, and save it to your Desktop. * Double-click SecurityCheck.exe * Follow the onscreen instructions inside of the black box. * A Notepad document should open automatically called checkup.txt; please post the contents of that document.=============================================================================Please download Farbar Service Scanner and run it on the computer with the issue.Make sure the following options are checked:
Internet ServicesWindows FirewallSystem RestoreSecurity CenterWindows UpdatePress "Scan".It will create a log (FSS.txt) in the same directory the tool is run.Please copy and paste the log to your reply.====================================================================================Please download MiniToolBox and run it.Checkmark following boxes:Report IE Proxy SettingsReport FF Proxy SettingsList content of HostsList IP configurationList Winsock EntriesList l... Read more

60 more replies
Relevance 57.81%

res://biioh.dll/index.html#96676

this is the stupid URL that my internet browser opens up with... maybe someone can help remove?

i tried searching google for biioh.dll with no help.
Anyone know of a possible fix/help or SOMETHING for this stupid BASTARD of a browser hi-jacking Son Of A Bitch?

(I've already run SpyBot, and NAV and it has not changed anything.... as well as doing a browser cleanup, and a registry search to remove ALL biioh.dll from registry and all related res:// links)
ANY USEFUL INFORMATION WOULD BE *G*R*E*A*T*L*Y* APPRECIATED...

THANKS GUYS!.

(P.S. another thing is that I keep getting redirected to this stupid "Zy Search" page or some weird crappy thing like that...)

here are some other annoying sites that I keep getting pop-ups/redirects to:
http://www.lookfor.cc/index.php?pin=96676
http://search-to-find.com/sec.php?qq=redirect&pin=96676
http://69.31.87.248:81/cgi-bin/index.cgi?c=0
 

Answer:res://biioh.dll/index.html#96676 ??? WHAAAAAT????

CWShredder?
 

3 more replies
Relevance 57.81%

I have studied the same hijack on your thread 240137, but that was on a WinNT and I am on WinXP. So can you walk me thru your fix for XP using this Safe-Mode HijackThis log ?
Tks

Logfile of HijackThis v1.97.7
Scan saved at 5:09:49 PM, on 6/29/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/sbcydsl/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.yahoo.com/customize/sbcydsl/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://scigz.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/sbcydsl/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\scigz.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = re... Read more

Answer:res://scigz.dll/index.html#96676 hijack

I think I can help.

First close all open browser windows. Then click to fix the following. You may want to print this.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://scigz.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\scigz.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://scigz.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\scigz.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://magicsearch.us/browser/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://magicsearch.us/browser/

O2 - BHO: (no name) - {CC99040E-760C-7B3F-DB14-4EE4EB7AA49E} - C:\WINDOWS\mfcyk32.dll

O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: Cloudmark SpamNet for OE.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk ... Read more

3 more replies
Relevance 57.81%

Logfile of HijackThis v1.97.7
Scan saved at 10:52:58 AM, on 10/20/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATIPTAXX.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\ZIPCD\DIRECTCD.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
C:\WINDOWS\SYSTEM\MSWHEEL.EXE
C:\PROGRAM FILES\IOMEGA\TOOLS\IOWATCH.EXE
C:\PROGRAM FILES\IOMEGA\TOOLS\IMGICON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS10
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://msaps.dll/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://msaps.dll/index.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://msaps.dll/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://msaps.dll/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://msaps.dll/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://msaps.dll/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssista... Read more

Answer:res://msaps.dll/index.html--- as start up page

Welcome to TSG!!

Create a permanent folder on your hard drive for Hijackthis, like My Documents\HJT
Click on this link to download the new version of Hijackthis post a log using that version from your permanent folder.
 

3 more replies
Relevance 57.81%

Here is my log file. Will someone help me please? Thank you.

Logfile of HijackThis v1.98.0
Scan saved at 8:40:48 AM, on 7/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\MMKeybd.exe
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\Program Files\Netropa\Traymon.exe
C:\Program Files\Netropa\OSD.exe
C:\PROGRA~1\STREAM~1\Remote\zremote.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\PROGRA~1\ADPOPU~1\ADPOPU~1.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\WINDOWS\SYSTEM32\tbctray.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Road Ru... Read more

Answer:res://msaps.dll/index.html homepage hijack

when i restart my computer, the default homepage becomes the ms search page. Any ideas?
Thank you.
 

1 more replies
Relevance 57.81%

My Home Page has bee Hijacked. This is the start page! res://mshp.dll/index.html#37049. It's annoying. ANy help would be much appreciated.

Here is the Hijack This log.

Logfile of HijackThis v1.97.7
Scan saved at 10:48:26 PM, on 14/03/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\WINDOWS\DELAYRUN.EXE
C:\PROGRAM FILES\MOTIVE\MOTMON.EXE
C:\PROGRAM FILES\MICROSOFT WORKS\WKSSB.EXE
C:\PROGRAM FILES\ADAPTEC\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 700\BIN\HPOSTR03.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FIL... Read more

Answer:Hijacked by res://mshp.dll/index.html#37049

15 more replies