Hijacked

[troy]

Hi all,

I get sick of getting fucking hijacked.

It is getting worse by the day.Today I had one which installed not only his start page but also put 7 folders in my favorites,installed a pageview program I also had to rebood my PC cos it made my PC as slow as a snail.
I had to run spybot and ad-aware 2 times cos I had to set them on deep scanning for all the shit to get removed.

Is there something you can do against these people?

How do they do it?Are that surtain script.

I hate those fuckers

What do they think they accomplisch with it except pissing of surfers.

[Cleo]

I use a Mac. Non of this crap happens to Macs.

[troy]

hi Cleo

But its also hard to get software
A friend of mine got inspired by my work and want to start but has a lot of trouble finding software.

Is there any free HTML editor and FTP manager for the mac he can use?

I myself use easy Html

http://www.toniarts.com/ehtmle.htm

and WS-FTP
I recomeded him to start with that but they don't work on mac

[Cleo]

I use Adobe GoLive and BBEdit for my html needs. In fact I use Adobe for most of my needs.

Many also prefer MacroMedia's products like DreamWeaver which also runs on a Mac along with their other products.

For a stand alone FTP client I use Interarchy
http://www.interarchy.com/

There is lots of software for the Mac.

Html editors, many free
http://www.macupdate.com/search.php?...x=0&button.y=0

FTP clients and servers
http://www.macupdate.com/search.php?...x=0&button.y=0
CuteFTP is even making a Mac client now, http://www.cuteftp.com/cuteftpmac/

You can also run a lot of open source software on a Mac.

Best places to by Mac products and software is mailorder. There are a bunch of places to choose from. I personally use MacMall a lot. http://www.macmall.com/

Mac is basically a flavor of unix now. Apache and all the other *nix open software including MySQL and stuff like that is part of Mac OS X.
http://www.apple.com/macosx/

No virues, no worms, no problems, it just works.

[DangerDave]

Keep your browser up to date.

http://www.windowsupdate.com/

Check out http://www.spywareinfo.com/forums/ regularly.

DD

[troy]

Cleo he is using dreamweaver now but in 30 days he must pay for it and I think a creazy amount of money for it.

Is there not a free or cheaper HTML editor out there.

Hi Dave
I just updated from IE5 to IE6 and today this shit happend so that did not work for me

[troy]

Oooeeps sorry Cleo didn't read your replay good about the HTML editor thanks for the link

[Cleo]

I was surfing the Mac boards and saw this. $10 WYSIWYG html Editor. I know nothing about it, but it looks interesting.

[troy]

Great Cleo looks good

About the hijaking
I can't get rid of it
I updated spybot and adaware did run them both they find the files I remove them rebood my PC and there they are again.
Icons on my desktop of 2 searchingines 7 folders from those search engines and my strat page goes to a hardcore site


What must I do?

[urb]

Try this:

http://www.doxdesk.com/parasite/

download this:

http://www.merijn.org/files/hijackthis.zip

Have you tried using Mozilla instead of IE?

[troy]

Thanks Urb

I have run hijack this and see the url from my start page but there is a big list and don't know what to remove and what not?

What do you mean with monzilla the browser I have it but a lot of page look really funny with it especialy the pages I made

[urb]

Copy and paste the results into a post on this forum. http://forums.net-integration.net/index.php?c=15

And while you are there, download this http://downloads.net-integration.net/cwshredder.zip

I know this sounds like trial and error, but if the above doesn't sort it out for you, then we'll need more details.

You should really check all your work in more than just IE. Mozilla, Netscape & Opera are used by more people than you would expect.

[troy]

Ok Urb thanks

I already have the chredder and run it but found nothing

I will try some things and if it still not works i post my result to the forum.
Thanks again

[Cleo]

Originally posted by troy
What do you mean with monzilla the browser I have it but a lot of page look really funny with it especialy the pages I made

Guess what all the other people that see your pages that look really bad in it also looks really bad for them to.

Properly coded pages look about the same in IE or Mozilla, at least mine do.

[Frank]

I like hijackers :-)


When u catch them it's (free traffic)
When not, it's a waste on your BW.

Use java redirects and send those fuckers where u wish:-)
Either you'll make money off the free traffic or send them 2 hell.

[troy]

Hi Frank,

Can you tell me how to do that?

[troy]

In monzilla I don't have the hijack?

Cleo all my pages look good in monzilla only my link list looks different the bordercolor is gone and the spaces between lines are bigger.

I still got the hijack now while I writh this my PC starts to download programs and connect with some strange site.
I immunize after I had run spybot yesterday but still those same fucking programs and other shit appears godammit

[MrMaryLou]

Have you tried this one http://www.doxdesk.com/parasite/

[troy]

Yes MrMarylou
Your browser has been checked for parasites. None were found. (However this script cannot detect all of them!)

I now posted my hijackthis logfile to the board Urb gave me and hope they can help me

[DangerDave]

Troy is that board doesnt do it..

This one will
http://www.spywareinfo.com/forums/

These are the guys that wrote SpybotS+D

DD

[Pornstar Dames]

pestpatrol is good for spyware and similar problems http://www.pestpatrol.com/

If youve still not got rid of it using all the anti spyware progs youll have to remove it manually

If you tell us what pages your home page gets set to and whats added to your favourites it will help identify what spyware you have so you can remove it from the registry and anywhere else it is installed.

[troy]

Hello pornstar dames
Thanks for the link but as with hijack this they only give a list of possible infections wich you only can remove if you are scilled because some things you better not remove.
I am not skilled.

I constantly get fault in kernel 32 runtime error 32 at 00403BSE

Here is a copy og my hijackthis logfile

Logfile of HijackThis v1.97.7
Scan saved at 11:33:43, on 25-1-2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\CD-WRITER PLUS\HP SIMPLE TRAX\HPCRON.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
C:\PROGRAM FILES\ICQLITE\ICQLITE.EXE
C:\PROGRAM FILES\ERASER\ERASER.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\MSOFFICE.EXE
C:\PROGRAM FILES\TYPEITIN\TYPEITIN.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\OLEHELP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\APPSYS.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.omega-search.com/go/panel_search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.omega-search.com/go/panel_search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.omega-search.com/go/panel_search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://teenhqpics.com/?homepage.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeler.nl
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.omega-search.com/go/panel_search.html
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar_en_2.0.95-deleon.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar_en_2.0.95-deleon.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HP Simple Trax] C:\Program Files\CD-Writer Plus\HP Simple Trax\hpcron.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\Program Files\CD-Writer Plus\DirectCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\COMMON~1\ADAPTE~1\CREATECD\CREATE~1.EXE -r
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKCU\..\Run: [Eraser] C:\PROGRAM FILES\ERASER\ERASER.EXE -hide
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\PROGRAM FILES\ICQLITE\ICQLITE.EXE -trayboot
O4 - Startup: Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office Werkbalk.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Startup: Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: TypeItIn.lnk = C:\Program Files\TypeItIn\TypeItIn.exe
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\GOOGLETOOLBAR_EN_2.0.95-DELEON.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\GOOGLETOOLBAR_EN_2.0.95-DELEON.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\GOOGLETOOLBAR_EN_2.0.95-DELEON.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\GOOGLETOOLBAR_EN_2.0.95-DELEON.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page - res://C:\WINDOWS\GOOGLETOOLBAR_EN_2.0.95-DELEON.DLL/cmtrans.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.freeler.nl
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...964.1201157407
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

Can't I do something against this person?
I found his adress
Diablo company
Garvard 2-10
Oklahoma

I am at this for 4 days now

How is it possible that i remove all his shit trough spybot and adaware and hijackthis and 1 minute later all is back?????????

[urb]

OK, read this page and check that you have the latest version.
http://www.merijn.org/cwschronicles.html

[troy]

PFFFFfff Urb Thanks man

I did not have the latest version of the chredder I updated it and run it and now it found 8 infected places and restored it.

I think its DEAD now.

Thanks again Urb this is the second time you help me out


Lets smoke one |rasta|

[jscott]

hey troy, i've had the same problem for a while now too, my startpage resets everytime to:
http://4-counter.com/?b=lili111 (I SUGGEST YOU DONT CLICK THIS LINK)

everytime i turn on my computer i have to go to control panel -> internet options and change my startpage back to yahoo, then when i click "home" on my browser it still goes back to that 4-counter.com url.

i'm used to it now so it doesnt bother me that bad. i've run spybot search & destroy, and ad aware but niether can fix this