Annoying Default Homepage

[ashley75]

Hi all,

On one of my server, I kept getting the annoying homepage on my explorer, it's "

http://www.Iwantsearch.com",

no matter what I did, it kept default to this homepage. I did install couple software to clean out the reg but it doens't help.

could someone please give me some ideas to get rid of this sucker???

thanks,

 

[RobBentley]

Have you tried one of these adware/spyware remove tools?
It sounds like you've been surfing the web on your server. Very bad practice im afriad! Servers are for serving, not surfing. Any spyware/adware applications are just going to eat at precious server resources and effect clients.

Robert Bentley

SynergyworksHosting.co.uk
"reliable services at realistic prices

 

[mwiner]

Run the lastest versions of Adaware, Spy Bot Search & Destroy, and Hijackthis. I am sure you will find something.

If you need help with your Hijackthis, post the log here.

-Matt

 

[ashley75]

I did install spyware doctor and it found some stuffs, I removed them all but it still using this default.

 

[RobBentley]

Once you've removed whatever set the homepage, you'll need to set your normal homepage in IE.

Robert Bentley

SynergyworksHosting.co.uk
"reliable services at realistic prices

 

[ashley75]

Thanks all for all of the advises.

Ok, I did install hijackthis on this machine, it found the website so I remove this sucker. I also delete all of the temp file and cookies. I close Explorer, the first time it's deafault on the homepage I want and then on the second try it default to this sucker "Iwantsearch" again.

attached is the log file


Logfile of HijackThis v1.97.7
Scan saved at 11:05:24 AM, on 10/11/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\EPOAgent\naimas32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\r_server.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\EPOAgent\naimag32.exe
C:\Program Files\Spyware Doctor\spydoctor.exe
C:\Program Files\Embarcadero\DBA731\DBArt731.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINNT\System32\SCardSvr.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.iwantsearch.com

R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINNT\Downloaded Program Files\rundlg32.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINNT\Downloaded Program Files\rundlg32.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [NaimAgent_UI] C:\EPOAgent\naimag32.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\spydoctor.exe" /Q
O4 - Global Startup: sysgates.lnk = C:\WINNT\Help\netini\sysgate.exe
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) -

http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38224.3278472222

 

[cplbaum2]

I've had great luck with CWSHREDDER for instances of IE being hijacked (when other spyware products fall short). It is small, FAST and FREE. You can get it here:

http://www.softpedia.com/progDownload/CWShredder-Download-8114.html

 

[ricpinto]

Use mozilla at

http://www.mozilla.com