Hijacked ?

Sorry, Crunchie ..... two screwups in 5 minutes, must be a record ... :( Anyway, my heart was in the right place, just not my brain .... sigh

Well, it IS 3:20 AM .... heh .....

- Dave

Cool :). It's 4.20 PM here. BTW. I deleted the original attachment after I pasted your log in :D.

Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uni--search.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uni--search.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://uni--search.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {D714A94F-123A-45CC-8F03-040BCAF82AD6} - C:\WINDOWS2\Downloaded Program Files\SbCIe02a.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS2\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS2\web\related.htm

O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/min...ransporter.cab?

Reboot and post another log. If you are still awake :D.

Crunchie (and all) -

I followed your instructions in your previous post. Then I did another virus scan, and came up with the items in the screen shot (attached to this post). Right clicking and asking for details brought up info which indicated that this item (the first of the three) DOES INDEED change the MSIE home page.

HOWEVER, I cannot figure out how to get rid of this garbage. AVG AntiVirus does not seem to offer a "fix" option, and does NOT seem to indicate that it fixed or quarantined anything. Any ideas ?


- Dave

Try this.

Clear out your Temporary internet files and other temp files.
Go to Start > Settings > Control Panel >Internet Options.
Under the General tab click the Delete temporary internet files,
delete all Offline content as well. Clear out Cookies.

Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)

C:\Documents and Settings\username\Local Settings\Temp\

In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

Empty the Recycle Bin.

Please go here & install ALL critical updates required for your system.

Well, thank you for the comments and ideas. I followed what you said, including the .TMP files. I also followed the idea of another site that recommended searching for .HTA files and moving them to a different folder.

I have repeatedly cleaned out temp files, cookies, etc. and also questionable History items. I have run half a dozen spyware/adware/trojan/hijacker finder/eradicator programs and STILL this stupid homepage keeps putting itself back.

I wouldn't care so much if it were easy to remove, but whoever programmed this little demon has a truly demented mind.

I am about to give up, wipe my C: partition and reinstall WinXP

Well, thank you for the comments and ideas. I followed what you said, including the .TMP files. I also followed the idea of another site that recommended searching for .HTA files and moving them to a different folder.

I have repeatedly cleaned out temp files, cookies, etc. and also questionable History items. I have run half a dozen spyware/adware/trojan/hijacker finder/eradicator programs and STILL this stupid homepage keeps putting itself back.

I wouldn't care so much if it were easy to remove, but whoever programmed this little demon has a truly demented mind.

I am about to give up, wipe my C: partition and reinstall WinXP :mad:


- Dave

Go here and download and run Silent Runners.vbs. It generates a log, please post the information back in this thread.

And another hijackthis log please.

Quote:

---

Originally posted by crunchie
Go here and download and run Silent Runners.vbs. It generates a log, please post the information back in this thread.

And another hijackthis log please.

---

----------------------------------------------------------------

Crunchie,

Thanks for your reply -- I followed your instructions, using both basic and "RED" versions of SilentRunners (the latter recommended for WinXP).

Attached are the files you requested. I combined the following onto one text file, separated by "double-double" lines:

SilentRunners log
SilentRunners (RED) log
new HijackThis log


Cheers,
Dave

I think we have it :).

Download the Pocket KillBox
Unzip the file to your desktop.
Run Pocket Killbox and paste the full file path of the following in the box and click on Standard File Kill and End Explorer Shell While Killing File. Click on the button with the red circle and an X in the middle after you enter it.

C:\WINDOWS2\System32\delaybuf.dll

Reboot afterwards if the file is successfully deleted.

If it is not deleted, do not reboot yet. Run Pocket Killbox again and paste the full file path in the box and click on Delete on Reboot. Next click on the button with the red circle and an X in the middle. You will get a message saying "File with be deleted on next reboot, Process and Reboot now?" Click "Yes" to reboot.

Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uni--search.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uni--search.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://uni--search.com

Hope that get's it for you.

hello, i ran into this thread while searching for info on "uni--search.com". tried all the things you mentioned, adware programs etc., norton, microsoft. none worked. couldn't locate the .dll you mentioned. any further news on what is causing this or how to solve it?

thanks.

tom