Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations SkipVought on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

exploer goes to yahoo/geocities when I type a URL?

Status
Not open for further replies.
bgingras99

bgingras99

Technical User
Oct 25, 2003
14
0
0
US
Almost evrytime I manually enter a URL into explorer it goes immediately to geocites/yahoo login screen. If I exit explorer and re-load is will allow me to go to the site I type. Also when I enter a URL it will jump to yahoo and say that the site the specific file is not found as though it's ignoring the URL and automaticly looking at yahoo.com as the url and searches for the file there? Does any of this make sense? I've checked with spybot and hijack this and have found nothing.
 
Sort by date Sort by votes
Well, a couple of Immediate thoughts come to mind based on what you Wrote, (in No particular order)
1. go into windows device manager in Safe Mode and see if there are any Duplicates or stuff that doesn't Belong there
2. Check the Startup items, in both the Start/programs/startup folder and the regestry, the regestry is HKEY_local machine\Software\microsoft\windows\current Version\Run and see whats Loading, there is also a run services folder in the same area
3. and perhaps simpler running msconfig and removing items from the startup till the behavior goes away,
4. Running Scandisk & defrag (fixing any problems it might find)
5. Deleteing any Temp files,

also it Might Depend on your ISP, if you connect through dialup networking or if you start some other program then click on internet Explorer
 
Upvote 0 Downvote
in SpyBot - Tools - Brwoser Pages ...what's listed?

are you surew you know what to look for in HijackThis?

are you trying from Windows Explorer or IE?

Windows Exp (or IE) may have a proxy server attached to it - on a Network?

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs
 
Upvote 0 Downvote
Also - SpyBot - Tools - System Startup will show you all items listed in Msconfig and more -- (MSinfo32 - left pane - will show all as well) - just like HijackThis will also

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs
 
Upvote 0 Downvote
It's from internet explorer

here is the log:
Logfile of HijackThis v1.97.7
Scan saved at 3:43:26 PM, on 11/25/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\CREATIVE\SHAREDLL\CTNOTIFY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\CREATIVE\SBPCI512\AUDIOHQ\AHQTB.EXE
C:\PROGRAM FILES\KEMAILKB\KEMAILKB.EXE
C:\WINDOWS\SYSTEM\HPOOPM07.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP PSC 700 SERIES\BIN\HPODEV07.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP PSC 700 SERIES\FRU\REMIND32.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\CREATIVE\SHAREDLL\MEDIADET.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP PSC 700 SERIES\BIN\HPOEVM07.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP PSC 700 SERIES\BIN\HPOSTS07.EXE
C:\WINDOWS\SYSTEM\HPOIPM07.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\TEMP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBPCI512\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [KEMailKb] C:\PROGRA~1\KEMAILKB\KEMailKb.EXE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\SYSTEM\hpoopm07.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
O4 - Startup: Hewlett-Packard Recorder.lnk = C:\Program Files\Hewlett-Packard\hp psc 700 series\FRU\Remind32.exe
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: MoneySide (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - O16 - DPF: JT's Blocks - O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - O16 - DPF: {4C226336-4032-489F-9674-67E74225979B} (OTXMovie Class) -
 
Upvote 0 Downvote
First off - have HijackThis fix this

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
Once you remove it go into SpyBot and LOCK the IE page
If you want (without opening IE) go into IE Options and set the Home Page to "Use Blank" - so when you fire up Internet Exploder, you don't get hurt

---------------------------
If you want to rid of all yahoo - kill these;
C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - O16 - DPF: JT's Blocks - --------------------------------

This I don't like

C:\PROGRAM FILES\KEMAILKB\KEMAILKB.EXE
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [KEMailKb] C:\PROGRA~1\KEMAILKB\KEMailKb.EXE

you know what they are?

If not Boot into Safe Mode - have HT fix em, and find the Folder in Program Files and Delete


TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs
 
Upvote 0 Downvote
Kemail is the drivers sotware for my enhanced keyboard with audio controls, etc.

I'll remove the yahoo stuff and see what happens.
 
Upvote 0 Downvote
Bgingras99-
I currently have the same issue. Did any of the proposed solutions work for you?
 
Upvote 0 Downvote
hi jklein8708;
D/l and run HijackTHis and post your log in Forum760
"Virus/Spyware Discussion"

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs
 
Upvote 0 Downvote
Have you checked your hosts file for anything strange? The fact you can sometimes load another site probably means it's OK, but I don't know enough to be certain.
 
Upvote 0 Downvote
O16 - DPF: {4C226336-4032-489F-9674-67E74225979B} (OTXMovie Class) - this can be a nasty

as well as these which can be either nasty or just quite annoying and serious resource hogs
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

Not clear on whether this one is legit or not;
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

Flinx
  • Locked
  • Question
the SAGA of trying to get a computer to sleep and wake up on a schedule
Replies
1
Views
252
Flinx
Flinx
jjjthird333
  • Locked
  • Question
rename a doamin computer when it is offline?
Replies
3
Views
168
goombawaho
goombawaho
pjw001
  • Locked
  • Question
How to configure Bookmarks in Chrome 2
Replies
4
Views
123
pjw001
pjw001
DTGMI
  • Locked
  • Question
WIN 10 Pro PC & Adding back to our Network
Replies
1
Views
97
pjw001
pjw001
Marguerite Bourgeois
  • Locked
  • Question
I have a document in which margins
Replies
2
Views
75
goombawaho
goombawaho

Part and Inventory Search

Sponsor

Back
Top