Printable View
I recently had my preferred start page hijacked by istarthere.com.
I posted and asked how to stop this from happening. I was told that I needed to do the
regedit hack. Suppisedly this was supposed to lock in my preffered homepage so that nothing could steal it.
That regedit hack hasn't worked. Is there some other way to get rid of istarthere and
stop this from happening?
PLEASE? HELP!!
Hi Dr Seven:
I thought you said this was solved ?
You need to do ALL of your windows critical updates. Start with those.
Go up to tools..then windows updates....then click on product updates. Let windows check to see what you don't yet have installed. When it's done.... download all critical updates.
Daizy
------------------
Hope this helps.
It's very probably something in startup that causes this.
Please do this:
Download StartLog.com from this site: http://home.earthlink.net/~rmbox/Ret...d/Only_IE.html
Doubleclick it, and it will generate a text file on your desktop that will list all the applications that start in the many places when you start Windows.
We don't need to see StubPath.txt, just Startup.Log
Just go to 'Edit/select all, then copy, and paste it into your reply.
Dr. Seven, See if the info at the link below will solve your problem. Check out the "Hijack Removal" link at the bottom of the page. Hope this helps. http://www.spywareinfo.com/hijacked.html
Hi Dr Seven,
I haven't seen the thread where you got help last time, so please excuse me if I repeat any suggestions that have been tried already. https://discussions.virtualdr.com/
Have you checked the "ieuinit.inf" file in the System folder? There are settings in there for the start page. You'll have to look closely beause there's a lot of stuff in there. Just be careful if editing! Be aware also that this file is changed every time you update IE.
Maybe cranking up your Internet Security settings will help.
Make sure your IE version is 5.5 or higher and updated with the latest security patches.
Make a note of the sites that force themselves on you, and add them to the "Restricted Sites" zone in your Internet Security options.
Read this MSKB article:
Home Page Setting Changes Unexpectedly, or You Cannot Change Your Home Page Setting (Q320159)
Here's another MSKB article that uses webcombo.net as an example. The information there may be of help to you.
------------------
Hello, Tech Support? How do I print my voicemail?
I am going to reply to everyone who answered. If you care to follow this further please look for your name to see what I said to you.
Daizy: I thought it was solved. It went to my preferred start page when I was still online. It only happened again after I shut my computer down and restarted it the next day. I looked at the list of the critical updates and it didn't give me a specific one about stopping hijacks as far as I could see. If it was talking about that it didn't mention it specifically. I hate to spend hours downloading stuff that I might not need.
Tufenuf: I already have Start Page Guard loaded on my computer. I aslo have Adaware loaded and used it last night. Istarthere comes back irregardless of having and using those programs.
Cellar Dweller: I checked out all those links that you provided. The process described was so complicated that it lost me.
How do I add the sites that are forcing themselves on me to the restricted zone? I know so little about working on a computer.
KleinKramer: You said this startup log would put a text file on my desktop. Then you said to go to edit/select all. How do I do that from my desktop? Unless I am more stupid than I thought, there is no way to click edit/select all from your desktop.
To all: I am not trying to be overly difficult. It just seems that you are assuming knowledge about the computer that I don't have. If someone could just break it down into "idiot steps" for me, I would appreciate it. Isn't there someway to fix this without having to spend hours and days on this?
I know this much. It is obviously spyware. The spyware detector and preventer that I have doesn't seem to be doing the job.
Is there anyway I can just delete Istarthere.com from my system and prevent it from coming back without having to do a major overhaul of my computer? Isn't there someway a person can find the code that is causing this and get rid of it?
I had a problem before and it was simply a matter of finding the code that caused it and removing it. Could it be possible that this is similar?
If you doubleclick a text file, it'll open in Notepad.
And in Notepad you'll find an 'Edit' menu option.
Just try it. Many people have done so before you https://discussions.virtualdr.com/
Chances are we'll find the culprit there, which will in turn tell us how to get rid of it.
[This message has been edited by Kleinkramer (edited 05-21-2002).]
To Kleinkramer:
I did a search in FIND looking for "text containing". I put in istarthere.com
it came up with a file called ghsp.vbs
Could this be the culprit?
Yes it could..
This quote is from this security site..
"www.globesearch.com - no verified fix yet. Possible fix (from examining suspect "Uninstall" binaries from the site): Find and delete the files: gshp.vbs, gsc0.txt, gsc1.txt."
http://www.cexx.org/adware.htm
(halfway down the page in the hijacking section)
EDIT> I see the reference to it in the startup log. I would remove that too.
[This message has been edited by fink (edited 05-21-2002).]
As you will see below, the gshp.vbs file I mentioned in the previous post is linked to HKEY Current User.
Sorry if I misspelled it in the prvious post.
---------- C:\WINDOWS\desktop\StartUp.Log
Start-Ups checked at 05-21-2002 4:05:37.93p
__________________________________________________________________________
__________________________________________________________________________
StartUp Log for Windows 95/98 - Freeware by rmbox
__________________________________________________________________________
__________________________________________________________________________
Comments:
This is a log of all the programs on your computer that
are starting automatically every time you start Windows.
Using this log can be a quick way to spot trojans.
StartUp Log (version 1.56) - Release Date 3/11/2002
__________________________________________________________________________
__________________________________________________________________________
StartUp Log Index
1. HKLM Run
2. HKCU Run
3. HKLM RunOnce
4. HKCU RunOnce
5. HKLM RunServices
6. HKLM RunServicesOnce
7. WIN.INI file
8. SYSTEM.INI file
9. AUTOEXEC.BAT file
10. StartUp folder
11. All Users StartUp
12. Misc. StartUp Configurations
__________________________________________________________________________
__________________________________________________________________________
The following is a list of your current Start-Ups
__________________________________________________________________________
__________________________________________________________________________
1. HKLM Run - Registry
[RegPath]
"StartUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe"
"AtiCwd32"="Ati2cwad.exe"
"AtiKey"="atiptkad.exe"
"Tray Temperature"="C:\\PROGRAM FILES\\AWS\\WEATHERBUG\\WEATHERBUG.EXE 1"
"LexStart"="Lexstart.exe"
"LexmarkPrinTray"="PrinTray.exe"
"EnsoniqMixer"="starter.exe"
"NPROTECT"="C:\\Program Files\\Norton Utilities\\NPROTECT.EXE"
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"Uninstall0001"="\"C:\\Program Files\\Common Files\\Totem Shared\\Uninstall0001\\upd.exe\" LASTCALL!adverts.stripsaver.com!StatsStripSaver"
==========================================================================
__________________________________________________________________________
2. HKCU Run - Registry
[RegPath]
"StartUp"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"zzgshp"="C:\\WINDOWS\\gshp.vbs"
==========================================================================
__________________________________________________________________________
3. HKLM RunOnce - Registry
[RegPath]
"StartUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
==========================================================================
__________________________________________________________________________
4. HKCU RunOnce - Registry
[RegPath]
"StartUp"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
==========================================================================
__________________________________________________________________________
5. HKLM RunServices - Registry
[RegPath]
"StartUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"AAATraySaver"="C:\\PROGRA~1\\TRAYSA~1\\TRAYSA~1.EXE"
"NPROTECT"="C:\\Program Files\\Norton Utilities\\NPROTECT.EXE"
"TrueVector"="C:\\WINDOWS\\SYSTEM\\ZONELABS\\VSMON.EXE -service"
"minilog"="C:\\WINDOWS\\SYSTEM\\ZoneLabs\\MINILOG.EXE -service"
==========================================================================
__________________________________________________________________________
6. HKLM RunServicesOnce - Registry
[RegPath]
"StartUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]
==========================================================================
__________________________________________________________________________
7. WIN.INI File - (c:\windows\win.ini)
Your win.ini run/load lines should look like run= and load= exclusively.
There should be nothing to the right of the equal signs.
These are the run and load lines in your WIN.INI file
run=
run=
load=
load=
==========================================================================
__________________________________________________________________________
8. SYSTEM.INI File - (c:\windows\system.ini)
Your system.ini shell line should look like shell=Explorer.exe exclusively.
You should only see Explorer.exe following the equal sign.
This is the shell line in your SYSTEM.INI file
shell=Explorer.exe
==========================================================================
__________________________________________________________________________
9. AUTOEXEC.BAT File - (c:\autoexec.bat)
(Some trojans have been known to start from this file)
These are your program startups and set paths in your autoexec.bat file
SET BLASTER=A220 I7 D1 H7 P330 T6
SET SBPCI=C:\SBPCI
@C:\PROGRA~1\NORTON~1\NAVDX.EXE /Startup
REM [Header]
@ECHO OFF
REM [CD-ROM Drive]
REM [Miscellaneous]
REM [Display]
==========================================================================
__________________________________________________________________________
10. StartUp Folder - (c:\windows\start menu\programs\startup)
Shortcuts to any program will automatically start when placed here.
These are the shortcuts located in your StartUp folder
C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Find Fast.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Office Startup.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Internet Answering Machine.lnk
==========================================================================
__________________________________________________________________________
11. All Users Folder - (c:\windows\all users\start menu\programs\startup)
Shortcuts to any program will automatically start when placed here.
These are the shortcuts located in your All Users StartUp folder
C:\WINDOWS\All Users\Start Menu\Programs\StartUp\zonealarm.lnk
==========================================================================
__________________________________________________________________________
12. Miscellaneous StartUp Configurations
-============================-
Registry StartUp Directories
-============================-
Should show the Start Menu StartUp and All Users StartUp directories
.....................................................................
[1] HKCU - Shell Folders
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
"Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"
.....................................................................
[2] HKCU - User Shell Folders
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
.....................................................................
[3] HKLM - Shell Folders
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders
"Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"
.....................................................................
[4] HKLM - User Shell Folders
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders
.....................................................................
-=======================-
Registry Shell Spawning
-=======================-
Open Commands for Executable File Types
@="\"%1\" %*"
(.exe file - RegPath = HKCR\exefile\shell\open\command)
@="\"%1\" %*"
(.com file - RegPath = HKCR\comfile\shell\open\command)
@="\"%1\" /S"
(.scr file - RegPath = HKCR\scrfile\shell\open\command)
@="\"%1\" %*"
(.bat file - RegPath = HKCR\batfile\shell\open\command)
@="\"%1\" %*"
(.pif file - RegPath = HKCR\piffile\shell\open\command)
@="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
(.hta file - RegPath = HKCR\htafile\shell\open\command)
-=========================-
HKLM RunOnceEx - Registry
-=========================-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]
-=========================-
HKU (.Default) Run - Registry
-=========================-
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run]
"zzgshp"="C:\\WINDOWS\\gshp.vbs"
-==============================-
HKU (.Default) RunOnce - Registry
-==============================-
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce]
-================================-
StubPaths - Registry (Partial Listing)
-================================-
(Please see the StubPath.txt on your desktop for complete listing)
HKLM\Software\Microsoft\Active Setup\Installed Components
"StubPath"="C:\\WINDOWS\\SYSTEM\\IE4UINIT.EXE"
"StubPath"="C:\\WINDOWS\\msnmgsr1.exe"
"StubPath"=""
"StubPath"="C:\\WINDOWS\\COMMAND\\sulfnbk.exe /L"
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:WIN9X /user /install"
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:WIN9X /user /install"
-=================-
DOSSTART.BAT File - (c:\windows\dosstart.bat)
-=================-
@echo off
REM Notes:
REM DOSSTART.BAT is run whenenver you choose "Restart the computer
REM in MS-DOS mode" from the Shutdown menu in Windows. It allows
REM you to load programs that you might not want loaded in Windows,
REM (because they have functional equivalents) but that you do
REM want loaded under MS-DOS. The two primary candidates for
REM this are MSCDEX and a real mode driver for the mouse you ship
REM with your system. Commands that you want present in both Windows
REM and MS-DOS should be placed in the Autoexec.bat in the
REM \Image directory of your reference server. Please note that for
REM MSCDEX you will need to load the corresponding real-mode CD
REM driver in Config.sys. This driver won't be used by Windows 98
REM but will be available prior to and after Windows 98 exits.
REM
REM This file is also helpful if you want to F8 boot into MS-DOS 7.0
REM before Windows loads and access the CD-ROM. All you have to do
REM is press F8 and then run DOSSTART to load MSCDEX and your real
REM mode mouse driver (no need to remember the command line parameters
REM for these two files.
REM
REM - You MUST explicitly specify the CD ROM Drive Letter for MSCDEX.
REM - The string following the /D: statement must explicitly match
REM the string in CONFIG.SYS following your CD-ROM device driver.
REM MSCDEX.EXE /D:OEMCD001 /l:d
REM MOUSE.EXE
C:\SBPCI\SBINIT
-=================-
WININIT.BAK File - (c:\windows\wininit.bak)
(name) (type) (size)(modified)(time)
wininit bak 44 04-28-02 3:12a
-=================-
[rename]
NUL=C:\WINDOWS\TEMP\_iu14D2N.tmp
-=====================-
Screen Saver Settings (Possible system.ini start-up)
-=====================-
SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\IMAGES~1.SCR
==========================================================================
__________________________________________________________________________
- Supplemental Environment Information -
TMP=C:\WINDOWS\TEMP
TEMP=C:\WINDOWS\TEMP
winbootdir=C:\WINDOWS
PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
COMSPEC=C:\WINDOWS\COMMAND.COM
SBPCI=C:\SBPCI
windir=C:\WINDOWS
File - c:\windows\Wininit.bak
File - c:\windows\deletefi.ini
==========================================================================
__________________________________________________________________________
- End -
When you say I should remove the gshp you see in the startup log do you mean remove it from the startup log or do you mean I should remove it from my computer>
I ask because I went back into find and tried to put in the path name specified and it told me it couldn't be found.
In the meantime, I deleted all those files you mentioned the vbs one and the text ones and did a shut down of my computer. I restarted and went to my browser. It went to the start page I prefer. Before, when I had shut the computer off and turned it back on istarthere came back.
This seems hopeful that istarthere didn't come back.
The startup log is just a record of the settings in your PC.. removing it from there would do nothing so you should remove it from the actual settings in the computer. In this case you may be able to remove it via msconfig..
click start>run> type in msconfig and hit enter... look at the startup tab and uncheck the line that refers to that .vbs file.. if it's there it should be obvious. If it isn't there then it will have to be done manually in the registry... We'll give you instructions on how to do that if necessary but check the msconfig option first.. it's safer.
We are on the right track so I think you're pretty much rid of that hijack problem.
[This message has been edited by fink (edited 05-21-2002).]
How annoyed with me and redundant will it sound when I say once again.......you need ALL the critical updates. None of them are unneccessary. They are patches and bug fixes for windows in general.
Cumulative Patch for Internet Explorer
Daizy
------------------
Hope this helps.
To Kleinkramer: I went into msconfig. Sure enough the gshp.vbs file was there under startup. I unclicked it to disable it. Then I was told that I needed to restart my computer for the new settings to take place. I did that. When I checked msconfig again gshp.vbs was still disabled and it was moved to something just called C:\windows.gshp.vbs
Does that seem like that should be the end of it?
To Daizy: I have IE 5.0
I appreciate your concern. But I downloaded the service pack awhile ago and it didn't help. It just caused me problems.
Again, thanks for caring!
Excellent.
You've disabled it from Startup, so it isn't active any more.
Now go to C:\windows, and delete the gshp.vbs file itself.
It doesn't belong there.
Cheers, Tony
I went under C:\windows and couldn't find it. The closet entry was GWHKEY.exe
I didn't delete that since I don't know if that was it.
I went into FIND and tried to find it that way. It didn't show up.
Do you think I should worry?
If you deleted it when I suggested you did last time and you can't find it now then it's gone. don't worry.
Just because it's listed in msconfig doesn't mean anything, then? I suppose it's one of those computer things that are left over with no practical application. One of those anomalies.
Thanks!
The msconfig listing is a command for windows to start that program when you boot. If the program isn't there (you deleted it) then the command to start it can't get implemented. We got you to uncheck it so it doesn't waste time or produce error messages looking for the vbs file that's no longer there.
Ah! I see! No program, no useless error messages!
Thanks for taking the time to clarify!