Hijacked ?

Well, thank you for the comments and ideas. I followed what you said, including the .TMP files. I also followed the idea of another site that recommended searching for .HTA files and moving them to a different folder.

I have repeatedly cleaned out temp files, cookies, etc. and also questionable History items. I have run half a dozen spyware/adware/trojan/hijacker finder/eradicator programs and STILL this stupid homepage keeps putting itself back.

I wouldn't care so much if it were easy to remove, but whoever programmed this little demon has a truly demented mind.

I am about to give up, wipe my C: partition and reinstall WinXP :mad:


- Dave

Go here and download and run Silent Runners.vbs. It generates a log, please post the information back in this thread.

And another hijackthis log please.

Quote:

---

Originally posted by crunchie
Go here and download and run Silent Runners.vbs. It generates a log, please post the information back in this thread.

And another hijackthis log please.

---

----------------------------------------------------------------

Crunchie,

Thanks for your reply -- I followed your instructions, using both basic and "RED" versions of SilentRunners (the latter recommended for WinXP).

Attached are the files you requested. I combined the following onto one text file, separated by "double-double" lines:

SilentRunners log
SilentRunners (RED) log
new HijackThis log


Cheers,
Dave

I think we have it :).

Download the Pocket KillBox
Unzip the file to your desktop.
Run Pocket Killbox and paste the full file path of the following in the box and click on Standard File Kill and End Explorer Shell While Killing File. Click on the button with the red circle and an X in the middle after you enter it.

C:\WINDOWS2\System32\delaybuf.dll

Reboot afterwards if the file is successfully deleted.

If it is not deleted, do not reboot yet. Run Pocket Killbox again and paste the full file path in the box and click on Delete on Reboot. Next click on the button with the red circle and an X in the middle. You will get a message saying "File with be deleted on next reboot, Process and Reboot now?" Click "Yes" to reboot.

Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uni--search.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uni--search.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://uni--search.com

Hope that get's it for you.

hello, i ran into this thread while searching for info on "uni--search.com". tried all the things you mentioned, adware programs etc., norton, microsoft. none worked. couldn't locate the .dll you mentioned. any further news on what is causing this or how to solve it?

thanks.

tom

I have PM'd the OP on two occasions regarding this matter, but so far have not received a reply :(.
Hopefully it was not a wasted effort on my part.
If you are having problems, you are welcome to post a log in the hijackthis forum, along with a silent runners log. The text file it creates will be in the same folder you run it from.
Please run Adaware and Spybot S&D first if you decide to post :).

stargazer777. If you read this, can you also do a search for C:\windows\Hires.dat and delete that also if found.

okay- problem solved- i downloaded the silent runner program and found a startup program called "resetuponreboot.exe" or something (i wish i saved the name) that was located in the windows/temp directory. after erasing the temp directories and eliminating that item from the registry and rebooting the computer- it seems to have gone away. funny that norton or any other spyware/adware programs could not catch this, and i tried them all. btw- i updated all the most recent winxp updates available- don't know if that helped any- but it seemed many of them were security and adware related.

Quote:

---

Originally posted by crunchie
stargazer777. If you read this, can you also do a search for C:\windows\Hires.dat and delete that also if found.

---

Nope, did a full search in that directory path and .... nothing.



- Dave

All,

I did another scan with Silent Runner, and I have attached the resulting file.

- Dave

You still have C:\WINDOWS2\System32\delaybuf.dll on board. That is why you are still being hijackrd :).
Please post another hijackthis log and we can go from there.

Well, I deleted everything I previously was told to. I can only surmise it is somehow being reinstalled.

I tried to delete it, and a message window informed me that I could not delete the file, that "access is denied". How do I get around this so I can ditch it ?

- Dave

That's why I wanted a hijackthis log. Then the complete process can be undertaken. Do you still have the killbox? It will be required again, unless you can delete the delaybuf file in safe mode.

crunchie,


Here is a new HijackThis log as requested.

I'm late to work but will check for replies from there.

I'll be coming home early and should have plenty of time this afternoon to work on killing this thing. Hopefully it won't be a too-involved process.

Thanks again for comments and info.


- Dave

Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

O2 - BHO: BHO Class - {575A5AE9-B68E-4BEB-BACB-FE430448C654} - C:\WINDOWS2\System32\WinSuck.dll
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS2\System32\IETie.dll
O2 - BHO: BHO Class - {F6053709-5723-454E-AB9D-7FC7E681AFA5} - C:\WINDOWS2\System32\WinTitle.dll

O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS2\Downloaded Program Files\SbCIe02a.dll
O9 - Extra button: (no name) - {578FC4E3-151E-456c-AF8E-B63061EFE228}} - (no file)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)


Run Pocket Killbox again and paste the full file path of the file in the box and click on Standard File Kill and End Explorer Shell While Killing File. Click on the button with the red circle and an X in the middle after you enter the file.

C:\WINDOWS2\System32\delaybuf.dll

Reboot afterwards if the file is successfully deleted.

If the file is not deleted, do not reboot yet. Run Pocket Killbox again and paste the full file path in the box and click on Delete on Reboot. Next click on the button with the red circle and an X in the middle. You will get a message saying "File with be deleted on next reboot, Process and Reboot now?" Click "Yes" to reboot only after the last file you enter.

After the reboot please post another hijackthis log and a silent runners log.