I Am Pissed Off Over This Site Bug!

[55urdead55]

Well.... the internet usually works... but now... everytime i get on any site... the same site shows up... it doesnt have its own URL and its annoying me everytime... its this weird website on this chinese primary school and i cant read chinese!! AND WHAT THE HELL IS IT DOING BLOCKING ME FROM GOING TO ANY OTHER SITES?!?!??! WTF!!!!!! ALSO... MY MSN WONT EVEN WORK... I TRIED EVERYTHING,.. REPAIR.. UNINSTALL REINSTALL IT WONT WORK.. SAME GOES FOR THE WINDOWS MESSENGER AND NOW.. IM HAVING TO USE THIS LAPTOP THAT I CANT USE ALL THE TIME ON WIRELESS INTERNET!!! HELP ME BEFORE I RIP MY HAIR!!!

 

[howard_hopkinso]

Hello and welcome to Techspot.

Sounds like it might be cause by a virus/spyware problem.

Go and read this thread HERE. Post a HJT log as an attachment into this thread and I`ll take a look and advise.

Regardes Howard :wave: :wave:

 

[55urdead55]

well.. i did ran a virus scan with this bitdefender 9.. able to detect viruses and moved them.. didnt really have any effect on the IE and msn problem

 

[howard_hopkinso]

That`s why I`d like to see a HJT log.

Regards Howard

 

[maniac_lonestar]

55urdead, you should listen to howard, get a hijack this from another computer, and upload it to your infected comp. Then just post a log for Howard or somone to see. It worked for me.

And btw, I had the same problem like that before, and I know why, its due to bad surfing for Porn or Piracy lol.

 

[howard_hopkinso]

I have deleted your other two threads on this subject. Please don`t open any more threads for this.

Post your HJT log into this thread only.

Regards Howard

 

[55urdead55]

help! (HJT log)

well.. my computer is screwed over and... yeah.. u no what to do

 

[howard_hopkinso]

I have merged your new thread into this one.

That makes four threads you have opened for this.

Two have been deleted and one has been merged.

Do not open any more threads for this.

I will analyse you HJT log and get back to you.

Regards Howard

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

Xvfwk
Aopl
MediaGateway
ISTsvc

Close control panel.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

MediaGateway.exe
hjmsr.exe
istsvc.exe
Vwcp.exe
Tgna.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 218.189.222.222:80<Only fix this if you didn`t set this proxy yourself, or don`t know what it is.

R3 - Default URLSearchHook is missing

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)

O4 - HKLM\..\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe

O4 - HKLM\..\Run: [Á³# K"h'þ9Óœ÷3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\hjmsr.exe

O4 - HKLM\..\Run: [Clellxz] C:\Program Files\Aopl\Vwcp.exe

O4 - HKLM\..\Run: [Jbbjfncf] C:\Program Files\Xvfwk\Tgna.exe

O16 - DPF: {50652C4E-AE14-4C1B-8D04-AF7F9B8493CD} (SFLauncher Class) - http://www.sf.in.th/activex/starter.cab

O16 - DPF: {8E82893F-7ED1-4811-A247-580DCC0E2629} (SFLauncherTDE Class) - http://www.sf.in.th/activex/StarterSFTDE.cab

O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Seekmo/ie/bridge-c24.cab

O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} - http://nprotect.ini3.com/nProtect/KeyCrypt/npkcx.cab

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\Program Files\Xvfwk
C:\Program Files\Aopl
C:\Program Files\ISTsvc
C:\WINDOWS\hjmsr.exe
C:\Program Files\MediaGateway

Reboot into normal mode and turn system restore back on and rehide your protected OS files.

Post a fresh HJT log and let me know how your system is running.


Regards Howard

This thread is for the use of 55urdead55 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[55urdead55]

thank u soo much.. =P its been going on for weeks! here are the results =P

 

[howard_hopkinso]

Well done, your HJT log is clen.

If you have anyfurther virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of 55urdead55 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.