[hijackedAL]

Hi Geeks,

Ive been batteling with a start page redirector for a few days and it's got the better of me, so I think it's time to get some help from you guys, if you are willing.

The symptoms that I'm experiencing are the following. Whenever I start my internet explorer, I get redirected to the page http://a-search.biz/?wmid=1010, even though my home page hasn't been changed.
I've recently started using this computer and the problem has existed as long as I've had the computer.
I've tried a number of programs, Adaware, Spybot, Registrar lite ...etc, and I still cant remove this thing.

I've downloaded the most recent version of hijackthis that I could find and I get the following log

Logfile of HijackThis v1.98.2
Scan saved at 16:00:03, on 27/09/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
E:\Program Files\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\ptssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ScsiAccess.EXE
C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ControlPanel] C:\WINNT\system32\systems.exe internat.dll,LoadKeyboardProfile
O4 - HKCU\..\Run: [SpySweeper] "E:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe

Can anyone tell me how to get rid of this thing??
If you have the time to help me, thanks very much,
if not, I'll just break out a typewriter and use that instead!!!

Thanks for any help you can give me.

[Advertisements]

hijack-
please see the thread I started. I had the same problem, a-search.... anyway, someone found a FAIRLY SIMPLE FIX.
I am running it right now.

garthpro

[garthpro]

hijack-
please see the thread I started. I had the same problem, a-search.... anyway, someone found a FAIRLY SIMPLE FIX.
I am running it right now.

garthpro

[admin]

Here's the post that garthpro is refering to:

It works, it works!! YAY!!

Okay... Here's what to do...

Go to http://www.mwti.net/...e_utilities.asp

Download the program there and run it (it's called eScan Antivirus Toolkit Utility)

Make sure when you run it, check all the boxes for files and everything like that, and make it so it scans all files and not just program files... Then click on "Scan Clean"

It may take a while, and may also find some trojans/viruses/adware that you had no idea that you had! It found 197 Viruses/Trojans/Adware on my computer! AGH!!

Once it's finished, restart your computer, and walla! All fixed!!

*sighs in relief* I'm glad that's over...

Hope that helps Garth... And thanks Coach, because it was all your help that put me on the right track to finding that program...

http://www.geekstogo...wtopic=3898&hl=

[hijackedAL]

Geeks to go,

You guys rule. Thank you very much for your help as my web browser now goes where I ask it to, amazing. Thank you also for your site. I was very happy to see a site which offers good help for free. I hope that my meagre donation will help to keep this site free for a long time to come.

garthpro, thanks a lot for being the first reply I got and setting me on my way to freedom, I hope you're enjoying your clean computer too.

Thanks again guys.
hijackedAL

[coachwife6]

If you want, we can take a look a closer look at what is running on your PC. We'll need you to use a free diagnostic tool (HiJackThis) and post a log back here with the results.

Click the HijackThis Guide in my signature, download it and follow the instructions in the guide.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.

[hijackedAL]

Thanks coachwife6 but your colleagues already managed to sort out my problems. I have used hijackthis and it really is very usefull.
Thanks for offering your help.
hijackedAL