[farahya]

My homepage keeps being changed every time I turn my computer back on. I have tried to change it by going to internet options in internet explorer and typing my preferred homepage address (www.comcast.net) in the homepage box, but once I reboot, it automatically changes to the address adfreesearch.com. I have tried editing my registry by removing any references to this web site, but once I reboot, it sets itself up as my homepage again. Is there some other way that I can finally get my own homepage back? Are my suspicions correct that this is some type of spyware program? I've tried the adaware program, but that didn't seem to correct the problem.

[Advertisements]

Let us take a closer look at what is running on your PC. We'll need you to use a free diagnostic tool (HiJackThis) and post a log back here with the results.

Click the HijackThis Guide in my signature, download it and follow the instructions in the guide.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.

[admin]

Let us take a closer look at what is running on your PC. We'll need you to use a free diagnostic tool (HiJackThis) and post a log back here with the results.

Click the HijackThis Guide in my signature, download it and follow the instructions in the guide.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.

[farahya]

Thank you Geeks to Go staff for coming along to my rescue! Well, as you requested, here is the log from the hijack This program:

Logfile of HijackThis v1.97.7
Scan saved at 6:00:17 PM, on 2/26/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\Support.com\bin\tgcmd.exe
D:\PROGRA~1\mcafee.com\agent\mcagent.exe
D:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
D:\WINDOWS\SM1BG.EXE
D:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
D:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
D:\Documents and Settings\Sisi\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://tooncomics.com/main/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://tooncomics.com/main/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://tooncomics.com/main/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tooncomics.com/main/hp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.comcast.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://tooncomics.com/main/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...=ie&ar=iesearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsof...search.asp?p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.comcast.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.comcast.net
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [PromulGate] "D:\Program Files\DelFin\PromulGate\PgMonitr.exe"
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [tgcmd] "D:\Program Files\Support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [MCAgentExe] d:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] D:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SM1BG] D:\WINDOWS\SM1BG.EXE
O4 - HKCU\..\Run: [iedll] C:\WINDOWS\iedll.exe
O4 - HKCU\..\Run: [loader] C:\WINDOWS\loader.exe
O4 - Global Startup: KeenValue.lnk = D:\Program Files\Common Files\KeenValue\keenvalue.exe
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://d:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://d:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://d:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://d:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Translate Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macr...director/sw.cab
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://makeover.subs...ve/makeover.cab
O16 - DPF: {40289096-9F72-4A04-BCB3-E434ECDCEE33} (AppDLCtrl Class) - http://download.howu...nload/appdl.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...72/mcinsctl.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.c...ient/isetup.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab

[admin]

Not too bad, your computer has a few spyware programs that we need to remove, including Cool Web Search. For more info on spyware see the Spyware Tools link in my signature.

Let's start with a couple of free programs:
CWShredder is the first to run. Here's why: If a CoolWebSearch variant is indeed running on your system, it may actually prevent you from running spyware scans. It is smart enough to detect efforts to detect it, and stop them. Download CWShredder to your desktop or other location. Close all browser windows, double click the CWShredder icon to run, then click the Fix -> button. When finished, reboot and run Spybot Search & Destroy.

Spybot Search & Destroy Download and install. Start Spybot S&D using the "Spybot-S&D (easy mode)" link from your Start menu . Click the Search for updates button, if any are found then click the Download Updates button. After all updates are downloaded, click the Check for problems button. When the scan is complete, place a check next to anything marked in red, then click the Fix selected problems button. You may need to run Spybot S&D multiple times to remove all infections.

When finished, Reboot your computer. Finally, reply to this post with a new HiJackThis log so we can look for any nasties that may have been missed.

CLICK HERE to download CWShredder
CLICK HERE to download Spybot S&D

[Eratosthenes]

the one toolbar you really want to look out for , is from a sinister place,, called CoolWWWSearch. It's the infamous AZESearch (crap)bar - toolbar.
I always use. Google , or www.refdesk.com

anyway: I had the same, simular prob. you are asking about. the root files in your system folder need deleting ( manually ). First things first, depending on your operating system. 1st thing to do, is download both Spybot - Search & Destroy, & Spyware Blaster. They are both FREE. This will help : run a system virsus scan from either Symantec homepage for Norton, or micro :

http://housecall.tre.../start_corp.asp

If you don't have good anti-virus software. Go Google: & get AVG (free) After you run the virus check, view the list. It may not be a virus, but it is what is called -- Dialers or Adware -- for sure that causes this mess. Instructions for removal or on symantec site. recommended. www.symantec.com

Next: If you don't know how? You will need to run the computer in SAFE MODE. depending on your version of windows, look for instructions on how to run your op.
in safe mode. When you are in safe mode, run the virus scan , in AVG , or whichever. AVG helped me with the AZESearch @%#X!bar garbage.
Still in Safe mode, run Spybot Search & Destroy. Then run Spyware Blaster. It's also good to use CWshredder, as well. as a 3rd step. Then , go through, when you found the names of the corrupted files & the source of the toolbar or -- "hijacker" --that is taking your browser & delete it / them. Use a search to find any related files with that name & then DELETE them all. Reboot,out of safe mode, with all settings back to normal config. (be sure to have system restore back on & all settings set back to normal , before you reboot your comp.) & this solved my prob.
Be sure to set system restore. To set this , go to START. Select RUN & type msconfig. Then where it says Advanced ( next to Launch system Restore ), go to troubleshooting, & be sure Enable Start Menu is unchecked. All this is in instructions on how to turn Safe Mode on, & to reboot with Safe Mode back off. in Control Panel, go to Internet Options. Type in the name of the browser homepage. Exam. http://www.google.com/ Then click Apply. OK. This takes awhile, & my instructions are a bit boggled. But , this will work, done correctly.

Attached Thumbnails

•