Uninvited cookies

[OH6A]

My home page has been kidnapped....... I have SPYBLASTER, CLEAN SPACE 8, BHODEMON, HIJACKTHIS,SPYBOT, AD-AWARE, STARTUPLIST...........
Still automatically I see that web pages are trying to load.
While hooked up to the internet I see that cookies are loading ????
I tweaked the registry to keep my home page in place, but the cookies keep on coming.
Another problem is IEDLL, I renamed it but another showed up, the real name of the file is HOLE.EXE, what is that all about?
Thank you in advance for the time to answer.
Cheers, Raymond

 

[steamwiz]

iedll.exe shows you have been hijacked by coolweb - download and run this :-

http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Also you say you have "hijackthis" - run it, save the log and then copy and paste it into a new post here.

steam

 

[OH6A]

Logfile of HijackThis v1.96.1
Scan saved at 2:26:55 PM, on 10/1/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Compaq\Compaq Advisor\bin\compaq-rba.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svcinit.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Washer\washer.exe
C:\windows\removed.exe
C:\WINDOWS\System32\svc.exe
C:\WINDOWS\System32\shellexp.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Raymond_NEW\Dowload\hijackthis196\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\TechSmith\SnagIt 6\SnagIt32.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =

http://pornokopec.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://pornokopec.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://pornokopec.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://pornokopec.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://pornokopec.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://www.fastwebfinder.com/sp.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =

http://na-proxy.alcoa.com:80

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP =

http://pornokopec.com/

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - C:\Program Files\Panicware\Pop-Up Stopper Companion\CCHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Pop-Up Stopper &Companion - {8F05B1A8-9D77-4B8F-AF54-6B2202066F95} - C:\Program Files\Panicware\Pop-Up Stopper Companion\popupus.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [hpppta] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\hpppta.exe /ICON
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Tapicfg.exe] \tapicfg.exe
O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0
O4 - HKCU\..\Run: [iedll] c:\WINDOWS\iedll.exe
O4 - HKCU\..\Run: [removed] C:\windows\removed.exe
O4 - HKCU\..\Run: [svc] C:\WINDOWS\System32\svc.exe
O4 - HKCU\..\Run: [rundll32] C:\Program Files\Common Files\System\MAPI\1033\nt\rundll32.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O9 - Extra button: Support (HKCU)
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O19 - User stylesheet: C:\WINDOWS\Web\win.def

 

[steamwiz]

Download and run this :-

http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Then post a new hijackthis log - there will be more to do

steam

 

[OH6A]

While waiting for an anwser I downloaded update version SP1 of IE6........
when going to Internet Options most of the buttons are grayed out, can not delete files, cookies, history
Security all grayed, etc... all options are looked.
Downloaded Cool Web Shredder and ran it.

Cheers

 

[steamwiz]

OH6A

Please post a new hijackthis log so that we can see if coolwebshredder worked ok

Did you lock the control panel with spybot ?

Click the immunize button - scroll down to the bottm of the page....

There are 2 boxes to tick....

Lock IE Start page ... and ... Lock IE control panel

If you have the second one ticked - that's why your boxes are greyed out - if not...do this :-

close all browser windows - run hijackthis - and tick to "fix" this entry :-

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Reboot and you should be OK

good luck

steam



steam