Default Home Page - HELP!!!!!

[Lee Macro]

I've got some weird homepage that keeps coming up when I go online. There seems to be some sort of spanish (?) dial-up network file thats somehow appeared and alos have a IE icon that looks vert similar but its spelt "exsplorer". Anyone got any ideas how I can get rid of all this crap as I've got no iead where it came from?? Is it spyware or anything like that??

[drdude]

Definately sounds like spyware to me mate. Please try the following steps to see if we can shift this:

* (This step is optional, the steps below should cure your problem without me needing to look at your HiJackThis log!) Download HiJackThis from Major Geeks and extract to the Desktop. Run the program and click "Do a system scan and save a logfile". Once this is complete, the logfile should open in Notepad. Post what it contains here. I will have a look through it and see what you have.

* Download ATF-Cleaner, but do not run it yet.

* Download ewido (now called AVG Anti-Spyware), install ensuring that under "additional options" that you uncheck "Install background guard" and "Install scan via context menu". Run the program once installed, update but do not scan yet.

* Reboot and go in to safe mode.

* Run ATF-Cleaner, tick the select all box, then empty selected.

* Now run ewido and do a scan. If/when a popup comes up ensure you put a tick in the boxes that say "Perform action with all infections" and "Create encrypted backup", then press clean.

* Reboot back in to Windows normally

* Scan your computer with Panda's ActiveScan and ensure you click "Local Disks" before starting.

Let us know how it goes

[Lee Macro]

Doing a scan from the link right now....................Right, this is what its got

Virus:Trj/Downloader.KRG
Virus:Bck/Webber.BF

Anyway I can get rid of these?????

[drdude]

Sorry I my initial reply was a tad lame and half-arsed, and now I've edited it to be a little more comprehensive. Could you try the revised steps posted above, and see if that resolves it? (I'm about until 5 if you want us to have a look at a HiJackThis log)

[Lee Macro]

This is the HiJack This log

Logfile of HijackThis v1.99.1
Scan saved at 15:30:27, on 01/12/2006
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PQSC\PROGRAM\SCTRAY.EXE
C:\WINDOWS\MHOTKEY.EXE
C:\PROGRAM FILES\AHEAD\INCD\INCD.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\PROGRAM FILES\INSTANT MESSENGER NAMES\IM-SVR.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\TEMP\MXGR5.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\PROGRAM FILES\TMENTOR\MENTOR FOR WINME\MINITRAY.EXE
C:\PROGRAM FILES\FINEPIXVIEWER\QUICKDCF.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE
C:\PROGRAM FILES\EASY SPYREMOVER\EASYSPYREMOVER.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\WINRAR\WINRAR.EXE
C:\WINDOWS\TEMP\RAR$EX01.355\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Class - {F9738B44-D04D-BF9C-F08C-CB38E0A3C66E} - C:\WINDOWS\UGIBD1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Starware - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - C:\PROGRAM FILES\STARWARE\BIN\STARWARE.DLL
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [PCCIOMON.EXE] "C:\Program Files\Trend PC-cillin 2000\PCCIOMON.EX_"
O4 - HKLM\..\Run: [WebTrap.exe] "C:\Program Files\Trend PC-cillin 2000\WebTrap.ex_"
O4 - HKLM\..\Run: [pop3trap.exe] "C:\Program Files\Trend PC-cillin 2000\pop3trap.ex_"
O4 - HKLM\..\Run: [SecondChance] C:\PQSC\PROGRAM\SCTRAY.EXE
O4 - HKLM\..\Run: [CHotKey] mHotkey.exe
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [IMprocess] C:\PROGRAM FILES\INSTANT MESSENGER NAMES\IM-SVR.EXE
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [MXGR5.EXE] C:\WINDOWS\TEMP\MXGR5.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [PCCIOMON.EXE] "C:\Program Files\Trend PC-cillin 2000\PCCIOMON.EX_"
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] "C:\WINDOWS\is-6A4VA.exe" /REG
O4 - HKLM\..\RunServicesOnce: [*QY] "C:\PROGRAM FILES\COMMON FILES\SYSTEM\KVP.EXE" WDsX
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
O4 - HKCU\..\Run: [WinMedia] "C:\WINDOWS\TEMP\okln1075365.exe "
O4 - HKCU\..\Run: [WinUpdate] "C:\WINDOWS\TEMP\okln1087004.exe "
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Mentor Tray Icon.lnk = C:\Program Files\tMentor\Mentor for WinMe\minitray.exe
O4 - Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZNxmk696JHGB
O8 - Extra context menu item: Send Image to Photo Library - file://C:\Program Files\MGI\MGI PhotoSuite III SE\Temp\MGI00000.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Mentor - {3892CA40-9B9A-11d4-8D73-00105A296A2A} - "C:\Program Files\tMentor\Mentor for IE5\IE5Help.chm" (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL (file missing)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.extremeaccess.info
O15 - Trusted Zone: http://www.contentdiscount.info
O15 - Trusted Zone: http://www.archiviosex.net
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/potg_x.cab
O16 - DPF: Yahoo! Checkers - http://download.games.yahoo.com/game...ts/y/kt4_x.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt3_x.cab
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/bej...ploader_v6.cab
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/...gameloader.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...up1.0.0.15.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game07.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O21 - SSODL: FYpylcsbi - {436A17EE-E9C0-BD44-04AB-7D3C6B4B0EC9} - C:\WINDOWS\SYSTEM\YVT.DLL
O21 - SSODL: FYpylcsbi - {436A17EE-E9C0-BD44-04AB-7D3C6B4B0EC9} - C:\WINDOWS\SYSTEM\YVT.DLL

The 3 it relates to are the "O15" items (I think) but this pc is never used for porn as the kids use it so have no idea where the fuck its coming from

Also these 3 items are also in my "trusted sites" in my Internet Options but I can't get rid of them. Any ideas

[drdude]

Okies, you definately are infected with spyware, those being easiest to identify are Starware and MyWebSearch.

I didn't realise you were running Windows ME so I would avoid using ATF-Cleaner in this instance (I've not tested that on Windows ME) and replace that with CleanUp!.

Do the following:

* If System Restore is enabled, temporarily disable it whilst you are trying to clean your system up.

* Download CleanUp!, but do not run it yet.

* Download ewido (now called AVG Anti-Spyware), install ensuring that under "additional options" that you uncheck "Install background guard" and "Install scan via context menu". Run the program once installed, update but do not scan yet.

* Uninstall "Instant Messenger Names", it's infected with spyware. Also uninstall "Spyware Doctor" and "Easy Spywareremover". Although these aren't necessarily bad program, running these along with everything else is just slowing your computer down

* Reboot and go in to safe mode.

* Run CleanUp!, go to Options, move the arrow down to "Custom CleanUp!" then ensure that only Empty Recycle Bins, Delete Cookies, Delete Prefetch files and Cleanup! All Users are checked. Now go OK, press "CleanUp!" and if it asks you if you want to reboot say no.

* Now run ewido and do a scan. If/when a popup comes up ensure you put a tick in the boxes that say "Perform action with all infections" and "Create encrypted backup", then press clean.

* If ewido has not deleted the following or the uninstallers have not worked, delete the files or folders as indicated:

C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\INSTANT MESSENGER NAMES\ (delete the entire folder, including all subfolders)
C:\PROGRAM FILES\SPYWARE DOCTOR\ (delete the entire folder, including all subfolders)
C:\PROGRAM FILES\EASY SPYREMOVER\ (delete the entire folder, including all subfolders)
C:\PROGRAM FILES\STARWARE\ (delete the entire folder, including all subfolders)
C:\PROGRAM FILES\MYWEBS~1\ (may be shown as MyWebSearch or something like that. Delete the entire folder, including all subfolders)
C:\Windows\Temp\okln1075365.exe
C:\Windows\Temp\okln1087004.exe

>> I am not sure what these files are but don't like the look of them, so either delete or preferably move them to another folder like "C:\Crap\" for the time being (unless you are 100% that it is required for something!)

C:\WINDOWS\TEMP\MXGR5.EXE
C:\PROGRAM FILES\COMMON FILES\SYSTEM\KVP.EXE
C:\WINDOWS\is-6A4VA.exe


Lastly run HijackThis and click "Do a system scan only." Place a check next to the following entries (if they are still there):

O3 - Toolbar: Starware - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - C:\PROGRAM FILES\STARWARE\BIN\STARWARE.DLL
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O4 - HKLM\..\Run: [IMprocess] C:\PROGRAM FILES\INSTANT MESSENGER NAMES\IM-SVR.EXE
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
O4 - HKLM\..\Run: [MXGR5.EXE] C:\WINDOWS\TEMP\MXGR5.EXE
O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] "C:\WINDOWS\is-6A4VA.exe" /REG
O4 - HKLM\..\RunServicesOnce: [*QY] "C:\PROGRAM FILES\COMMON FILES\SYSTEM\KVP.EXE" WDsX
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
O4 - HKCU\..\Run: [WinMedia] "C:\WINDOWS\TEMP\okln1075365.exe "
O4 - HKCU\..\Run: [WinUpdate] "C:\WINDOWS\TEMP\okln1087004.exe "
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZNxmk696JHGB
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL (file missing)
O15 - Trusted Zone: http://www.extremeaccess.info
O15 - Trusted Zone: http://www.contentdiscount.info
O15 - Trusted Zone: http://www.archiviosex.net
O21 - SSODL: FYpylcsbi - {436A17EE-E9C0-BD44-04AB-7D3C6B4B0EC9} - C:\WINDOWS\SYSTEM\YVT.DLL
O21 - SSODL: FYpylcsbi - {436A17EE-E9C0-BD44-04AB-7D3C6B4B0EC9} - C:\WINDOWS\SYSTEM\YVT.DLL

* Reboot back in to Windows normally and see if you are back to normality!

[Lee Macro]

Well it took me a while but its all sorted. You're instructions were spot on. Cheers m8 K+

[drdude]

Excellent news :emot77: Cheers for the K+ :emot83: