TechSpot

secure32 hijacked my homepage

By elric1911
Dec 29, 2005
  1. please help me remove this, attached is my HJT log. thanks for the help.
     

    Attached Files:

  2. vhunter

    vhunter TS Rookie Posts: 89

    First, boot into Safe Mode and remove the following files:

    c:\secure32.html
    J:\WINDOWS\system32\paytime.exe

    Then run HJT again, and place a check next to these items:

    J:\WINDOWS\system32\paytime.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
    O4 - HKLM\..\Run: [PayTime] J:\WINDOWS\system32\paytime.exe
    O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs7b.instantservice.com/jars/customerxsigned33.cab

    Hit "Fix Checked", then reboot. Run Ad-Aware SE and Spybot S&D once you're finished, to ensure that your system is clean.
     
  3. elric1911

    elric1911 TS Rookie Topic Starter

    thank you.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.