Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HELP ME! http://t.swapx.cc/h.php?aid=20009


  • Please log in to reply
1 reply to this topic

#1 mauroponce

mauroponce

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:09:33 AM

Posted 26 November 2004 - 08:39 AM

tengo este problema, mi pagina de inicio cambia cada vez a esta direccion: http://t.swapx.cc/h.php?aid=20009 , aplique el primer programa "HijackThis" y sergun el no tengo esta contaminacion, pero igual me aparece y se cambia mi pagina de inicio, por favor HELP ME!!!

Thanks


P.D. les envio el archivo de LOG que genero el primer programa

Attached Files



BC AdBot (Login to Remove)

 


m

#2 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,395 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:33 AM

Posted 27 November 2004 - 01:21 AM

I want you to fix some of those entries. Please do the following:

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then click the Fix button:


R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://win-eto.com/sp.htm?id=31130123321003
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://win-eto.com/sp.htm?id=31130123321003
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://win-eto.com/sp.htm?id=31130123321003
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://win-eto.com/hp.htm?id=31130123321003
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://win-eto.com/sp.htm?id=31130123321003
O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\SYSTEM\LYRXWO~1.DLL
O4 - HKLM\..\Run: [Control handler] C:\WINDOWS\SYSTEM\URVK7W6K34KMO7THD.EXE
O4 - HKCU\..\Run: [romahere3] C:\WINDOWS\SYSTEM\JEJYYGDR99VFO.EXE
O16 - DPF: ChatSpace Java Client 2.1.0.95 - http://200.74.171.188:8000/Java/cs4ms095.cab
O16 - DPF: {DDF44FD9-749F-4761-89BB-E8A59339E459} - http://akamai.downloadv3.com/binaries/Live...ervice_9_ES.cab
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q678340.exe

Reboot your computer into Safe Mode

Then delete these files or directories (Do not be concerned if they do not exist)


C:\WINDOWS\SYSTEM\LYRXWO~1.DLL
C:\WINDOWS\SYSTEM\URVK7W6K34KMO7THD.EXE
C:\WINDOWS\SYSTEM\JEJYYGDR99VFO.EXE

Reboot your computer to go back to normal mode and post a new log.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users