Keep getting Hi Jacked

[diannekw]

I am at the end of my rope. I have downloaded and installed all of the appropriate sites, AdAware, CW Shredder, HiJAck This and I delete the junk when the experts tell me to when I run a scan. But everything keeps coming back like; All About Searching, ZestyFind.com, etc. Everytime I re-boot my home page changes back to one of those sites. Now my computer is operating very erradically and it won't let me view regular sites and completely shuts down regular sites and takes me back to my desk top. I guess I will have to have a PC Repair guy come in and look at it, but thought I would check with you guys one more time for any more advice you might be able to give me.

Thanks

[diannekw]

I am also getting RUNDLL Error windows saying, "Error loading wincore.dll Paging file toos small for this operation to complete" before the site shuts down and takes me back to the desktop.

[photolady]

If you still keep getting hijacked this problem could still be in your restore points. Have you cleared them? If not, go to "My Computer" and right click on this, then scroll to "Properties" and then click on the "System Restore" tab and put a check mark in "Turn off System Restore" restart your computer. This will clear any restore points you have and clear any nasties saved there. After restarting, go back to System Restore and take the check mark out enablig your system to create restore points again.

[crunchie]

Can you download the following app & run it, making sure to have one internet exploder window open. Save the log & paste the results back here.
VX2Finder

Next, type javascript:navigator.userAgent or just copy and paste it in your IE Address bar then hit enter.

Post the log from VX2Finder here along with the results from the address bar.

[diannekw]

Log:

Files Found---
C:\WINDOWS\System32\6co4svc.dll
C:\WINDOWS\System32\6ho4svc.dll
C:\WINDOWS\System32\6io4svc.cpy.dll
C:\WINDOWS\System32\6lo4svc.cpy.dll
C:\WINDOWS\System32\6no4svc.cpy.dll
C:\WINDOWS\System32\6no4svc.dll
C:\WINDOWS\System32\6po4svc.dll
C:\WINDOWS\System32\6ro4svc.cpy.dll
C:\WINDOWS\System32\6ro4svc.dll
C:\WINDOWS\System32\6so4svc.cpy.dll
C:\WINDOWS\System32\6so4svc.dll
C:\WINDOWS\System32\6wo4svc.dll
C:\WINDOWS\System32\6xo4svc.cpy.dll
C:\WINDOWS\System32\6zo4svc.dll
C:\WINDOWS\System32\abaamon.dll
C:\WINDOWS\System32\agaamon.dll
C:\WINDOWS\System32\aptxprxy.dll


Guardian Key--- is called: GuardianNQRWJ
Asynchronous 000
DllName C:\WINDOWS\system32\agaamon.dll
Impersonate 000
Logon WinLogon
Logoff WinLogoff
Version 124
ID {8DD6771F-700B-476A-9A60-C460220F868E}
IDex BM0

User Agent String---
{8DD6771F-700B-476A-9A60-C460220F868E}

[crunchie]

Download Killbox from http://download.broadbandmedic.com/VbStuff/KillBox.zip
Unzip to your desktop.
Run Killbox.exe. From the menu click “Fix L2M” then click “Kill VX2.BetterInternet"

Restart your system

Next, type javascript:navigator.userAgent or just copy and paste it in your IE Address bar then hit enter.

Post the complete result again. (That is, VX2finder log + the IE results)

[diannekw]

I also did the System restore thing that was suggested also.

Then I downloaded Killbox and did the Fix L2M, etc. just as you instructed.

I then rebooted (Note: I am still getting my home page re-directed to (http://www.spotresults.com/dns.php?url=about:blank)

typed the java script, etc in the IE Address bar and got "This page cannot be displayed" I also noticed at the very top of the screen after the blue "e" it said, "Invalid Syntax Error"

Here is the log from VX2finder:


Log for VX2.BetterInternet File Finder

Files Found---
C:\WINDOWS\System32\6co4svc.dll
C:\WINDOWS\System32\6fo4svc.cpy.dll
C:\WINDOWS\System32\6ho4svc.dll
C:\WINDOWS\System32\6io4svc.cpy.dll
C:\WINDOWS\System32\6lo4svc.cpy.dll
C:\WINDOWS\System32\6no4svc.cpy.dll
C:\WINDOWS\System32\6no4svc.dll
C:\WINDOWS\System32\6oo4svc.cpy.dll
C:\WINDOWS\System32\6po4svc.dll
C:\WINDOWS\System32\6ro4svc.cpy.dll
C:\WINDOWS\System32\6ro4svc.dll
C:\WINDOWS\System32\6so4svc.cpy.dll
C:\WINDOWS\System32\6so4svc.dll
C:\WINDOWS\System32\6wo4svc.dll
C:\WINDOWS\System32\6xo4svc.cpy.dll
C:\WINDOWS\System32\6zo4svc.dll
C:\WINDOWS\System32\abaamon.dll
C:\WINDOWS\System32\agaamon.dll
C:\WINDOWS\System32\aptxprxy.dll


Guardian Key--- is called: GuardianLIWHS
Asynchronous 000
DllName C:\WINDOWS\system32\agaamon.dll
Impersonate 000
Logon WinLogon
Logoff WinLogoff
Version 124
ID {8DD6771F-700B-476A-9A60-C460220F868E}
IDex BM0

User Agent String---
{8DD6771F-700B-476A-9A60-C460220F868E}

[crunchie]

That didn't fix it but it should have. We will do something else now & can I also get you to download hijackthis & post the log here. I am certain we can get it fixed for you, no charge.

Download the VX2 fix here.
You must run it three times in a row to completely remove the files registry keys.

Download HijackThis from here & unzip it into it's own, permanent folder, (not a temporary folder & not on the desktop). Start HJT & press the scan button. When the scan is finished the scan button will change to save. Save the log to a text file, copy the entire contents of the text file & paste it into the body of your post. DO NOT FIX ANYTHING YET. Most of what is there is harmless & even necessary to the running of your system.

[diannekw]

I already have Hi Jack This. That was suggested in an earlier posting a week or so ago. I have been continually scanning and removing items I know are bad (because of them appearing before) but I remove them and they come right back as soon as log onto the Internet. For ex; All About Searching and Zesty.com ALWAYS come right back. My home page shows it is a Pass Through All About Searching before my home page appears. Then my home page frequently changes to http://www.spotresults.com/dns.php?

But I will run the scan again and post it back here along with downloading VX2 and running it 3 times.

[diannekw]

Your hyperlink to VX2 does not work. I get an error page - document not found.

[diannekw]

Here is the URL when I click on your VX2 Hyperlink

http://download.broadbandmedic.com/VbSt...ternet.exe

[BigFred]

Hi Dianne

I think the link that crunchie wants you to go to is http://download.broadbandmedic.com/V.../VX2Finder.exe. BF

[diannekw]

I already had the VX2Finder. When you say to run it 3 times in a row - do you mean I should be removing the files in the lower box on every run or sending you a log and then you tell me what to fix?

[crunchie]

Originally posted by diannekw
I already had the VX2Finder. When you say to run it 3 times in a row - do you mean I should be removing the files in the lower box on every run or sending you a log and then you tell me what to fix?

Can you PM me an email address & I can send you the VX2 tool.

[diannekw]

sure - send away


[


Also....now my computer is running sooooo slow I have to wait forever for screens to change and I continually get Virtual Memory warnings saying they are upgrading my memory and some programs won't work. I checked my hard drive and I have 18 GB left, so that shouldn't be the problem.

What is virtual memory anyway?