TechSpot

secure32 hijacked my homepage

By elric1911
Dec 29, 2005
  1. please help me remove this, attached is my HJT log. thanks for the help.
     

    Attached Files:

  2. vhunter

    vhunter TS Rookie Posts: 84

    First, boot into Safe Mode and remove the following files:

    c:\secure32.html
    J:\WINDOWS\system32\paytime.exe

    Then run HJT again, and place a check next to these items:

    J:\WINDOWS\system32\paytime.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
    O4 - HKLM\..\Run: [PayTime] J:\WINDOWS\system32\paytime.exe
    O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs7b.instantservice.com/jars/customerxsigned33.cab

    Hit "Fix Checked", then reboot. Run Ad-Aware SE and Spybot S&D once you're finished, to ensure that your system is clean.
     
  3. elric1911

    elric1911 TS Rookie Topic Starter

    thank you.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...