Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

homepages hijacked


  • Please log in to reply
19 replies to this topic

#1 bobalu4u

bobalu4u

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:39 AM

Posted 18 November 2013 - 11:45 PM

Hi,

I have WinXP sp3 Pro media edition. Last week "do search" hijacked all three of my browsers, IE8, Chrome and Firefox. I ran anti-malware bytes and they found 10 pups Amoung then "great arcade." I quarantined and deleted them. I thought that may have fixed the problem...not the case.

I also can't update my virus definitions on MS Essentials. I get error Ox80240022 when I try. I don't know if these two things are connected, but the fact they happened within a day of each other makes them suspect.

Hope you can help. Thanks.



BC AdBot (Login to Remove)

 


#2 Condobloke

Condobloke

    Outback Aussie @ 54.2101 N, 0.2906 W


  • Members
  • 5,860 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:06:39 PM

Posted 19 November 2013 - 01:20 AM

G'day bobalu4u, and Welcome to BC.

 

 

Download  MiniToolBox MiniToolBox, Save it to your desktop and run it.
Close any Firefox browsers you may have open
Checkmark the following boxes:
•Flush DNS
•Report IE Proxy Settings
•Reset IE Proxy Settings
•Report FF Proxy Settings
•Reset FF Proxy Settings
•List content of Hosts
•List IP configuration
•List last 10 Event Viewer log
•List Installed Programs
•List Users, Partitions and Memory size.
•List Minidump Files
 
Click Go and copy / paste the result (Result.txt).

 

 


Condobloke ...Outback Australian  

 

fed up with Windows antics...??....LINUX IS THE ANSWER....I USE LINUX MINT 18.3  EXCLUSIVELY.

“A man travels the world in search of what he needs and returns home to find it."

It has been said that time heals all wounds. I don't agree. The wounds remain. Time - the mind, protecting its sanity - covers them with some scar tissue and the pain lessens, but it is never gone. Rose Kennedy


#3 bobalu4u

bobalu4u
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:39 AM

Posted 19 November 2013 - 04:26 PM

Hi,

I ran the mini toolbox, got the results which I saved to Notepad and copied them but I can't paste them in this reply. For some reason "paste' isn't available. What now? thanx.



#4 Condobloke

Condobloke

    Outback Aussie @ 54.2101 N, 0.2906 W


  • Members
  • 5,860 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:06:39 PM

Posted 19 November 2013 - 04:40 PM

 
 

Try copying by going to 'edit' >>>select all.......then hit ctrlC (this copies).....then to the reply page, and hit ctrlV (to paste)....

 

and......there are other methods, which do not utilise the right click menu.....

 

http://lifehacker.com/5801525/help-new-pc-users-learn-how-to-copy-cut-and-paste

 

.......

 

Condobloke ...Outback Australian  

 

fed up with Windows antics...??....LINUX IS THE ANSWER....I USE LINUX MINT 18.3  EXCLUSIVELY.

“A man travels the world in search of what he needs and returns home to find it."

It has been said that time heals all wounds. I don't agree. The wounds remain. Time - the mind, protecting its sanity - covers them with some scar tissue and the pain lessens, but it is never gone. Rose Kennedy


#5 bobalu4u

bobalu4u
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:39 AM

Posted 19 November 2013 - 07:48 PM

Unfortunately none of the ways I tried to past the log here worked. What's up with that, dude? That's never happened before.



#6 Condobloke

Condobloke

    Outback Aussie @ 54.2101 N, 0.2906 W


  • Members
  • 5,860 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:06:39 PM

Posted 19 November 2013 - 08:56 PM

 
 

1) Start-> Run -> Services.msc     
2) Look for Desktop Window Manager Session Manager .  
3) Restart the Service

Try your copy/paste again.

 

If no joy .....try running scan in safe mode.

 

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/boot_failsafe.mspx?mfr=true

 

 

 

 

Question:;....do you have 'Advanced System Care' installed on your PC ?

 

 

 

Edited to add Question


Edited by Condobloke, 19 November 2013 - 09:17 PM.

Condobloke ...Outback Australian  

 

fed up with Windows antics...??....LINUX IS THE ANSWER....I USE LINUX MINT 18.3  EXCLUSIVELY.

“A man travels the world in search of what he needs and returns home to find it."

It has been said that time heals all wounds. I don't agree. The wounds remain. Time - the mind, protecting its sanity - covers them with some scar tissue and the pain lessens, but it is never gone. Rose Kennedy


#7 bobalu4u

bobalu4u
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:39 AM

Posted 19 November 2013 - 11:56 PM

Tried your suggestion...no luck. Very frustrating. No I don't have advanced system care. "dosearches.com" has hijacked my IE8 is it possible that it prevents me from right clicking PASTE?  And what do you mean for me to scan in safe mode? Thanks...



#8 Condobloke

Condobloke

    Outback Aussie @ 54.2101 N, 0.2906 W


  • Members
  • 5,860 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:06:39 PM

Posted 20 November 2013 - 02:26 AM

 
 

To enter Safe Mode:: Either follow the instructions in the link i provided :

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/boot_failsafe.mspx?mfr=true

Or...(thank you Grinler)

  1. Restart your computer.
  2. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
  3. Select the option for Safe Mode using the arrow keys.
  4. Then press enter on your keyboard to boot into Safe Mode.
  5. Do whatever tasks you require and when you are done reboot to boot back into normal mode

Your scan results from Notepad will be saved there also....attempt to copy and paste them to your post, while you are in safe mode.

 

While you are still safe mode ::

Please download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

* Double-click on the Rkill desktop icon to run the tool.
* A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
* If not, delete the file, then download and use the one provided in Link 2.
* Do not reboot until instructed.
* If the tool does not run from any of the links provided, please let me know.

 

Then,

 

Download Malwarebytes' Anti-Malware (aka MBAM): https://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the finish of the installation, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version. <<< most important )
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here in your next Reply

Be sure to restart the computer Now

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

 

Rebooting after running MBAM will have taken your PC back to normal mode.  Please run MBAM again in normal mode.

After it has rebooted.....See if Copy and paste will work

 

 

Condobloke ...Outback Australian  

 

fed up with Windows antics...??....LINUX IS THE ANSWER....I USE LINUX MINT 18.3  EXCLUSIVELY.

“A man travels the world in search of what he needs and returns home to find it."

It has been said that time heals all wounds. I don't agree. The wounds remain. Time - the mind, protecting its sanity - covers them with some scar tissue and the pain lessens, but it is never gone. Rose Kennedy


#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,199 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:39 AM

Posted 20 November 2013 - 01:02 PM

Also try running Rkill and see if you can post after

Please download Rkill by Grinler and save it to your desktop.
  • Link 1
  • Link 2
    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista, right-click on it and Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • If the tool does not run from any of the links provided, please let me know.
  • Do not reboot the computer, you will need to run the application again.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 bobalu4u

bobalu4u
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:39 AM

Posted 20 November 2013 - 06:34 PM

I don't get it. I CANNOT paste any of the results you guys asked for. I copy but there is no paste when I I try it. Have you got another solution? It's weird because I can do copy/paste within my system or to my email and I've pasted to other sites. Could it be IE8 has been so corrupted by "dosearches.com" that this is the result?



#11 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,199 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:39 AM

Posted 20 November 2013 - 07:41 PM

Hello run minitoolbox and RKill ,then PM me the logs and I will post them


How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#12 bobalu4u

bobalu4u
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:39 AM

Posted 20 November 2013 - 07:58 PM

Thanks. What does "PM" you mean?



#13 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,199 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:39 AM

Posted 20 November 2013 - 08:03 PM

:oopsign:  Personal Messenger

 

hover your mouse over my name and you will see a box saying "Send Message"


How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#14 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,199 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:39 AM

Posted 21 November 2013 - 11:11 AM

When you copy and then right click in the text area of the reply field.. there is NO paste?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#15 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,199 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:39 AM

Posted 21 November 2013 - 02:35 PM

This should work now
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users