IO 7 - suspicious default web page (RESOLVED) Hey,
Hope you can help. I'm pretty useless at this pc stuff!
When I start IO7 my default web page has changed to www.virushelpzone.com.
I have followed your advice, although experiencing the following problems: hijackthis - tried to install, programme wone exceute. when i double click the exe file it freezes the screen. Spybot search & destroy wont work either, I have installed but it wont check for updates.
I am using windows defender, latest AVG anitvirus, avg anti-spyware 7.5, spyware bot and latest version of Ad-aware SE. All of these pick up what I think is the problem file , the file is removed by the programmes but comes back every time i restart the pc. These are what they pick up:
Windows defender - Settings Modifier - Medium alert level - C:\WINDOWS\system32\drivers\etc\hosts
AVG scan -virus hosts found - Object - C:\WINDOWS\system32\drivers\etc\hosts
SpywareBot - Type - Registry - Downloader - agent - hkey_local_machine\software\windows\currentversion \run@^lsass
Adaware se -
ArchiveData(auto-quarantine- 2007-07-12 21-18-03.bckp)
Referencefile : SE1R180 09.07.2007
================================================== ====
MRU LIST
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=MRU FileReference : C:\Documents and Settings\rIcH\recent\system32.lnk
obj[1]=MRU FileReference : C:\Documents and Settings\rIcH\recent\wscui.lnk
obj[3]=MRU RegReference : software\microsoft\direct3d\mostrecentapplication name
obj[4]=MRU RegReference : S-1-5-21-1104843395-1799248601-1087175339-1006\software\microsoft\windows\currentversion\exp lorer\recentdocs\.cpl
obj[5]=MRU RegReference : S-1-5-21-1104843395-1799248601-1087175339-1006\software\microsoft\windows\currentversion\exp lorer\recentdocs\Folder
obj[7]=MRU RegReference : S-1-5-21-1104843395-1799248601-1087175339-1006\software\microsoft\windows media\wmsdk\general computername
WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[6]=RegData : regfile\shell\open\command ""
TRACKING COOKIE
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[7]=IECache Entry : Cookie:rich@kontera.com/
obj[8]=IECache Entry : Cookie:rich@doubleclick.net/
obj[9]=IECache Entry : Cookie:rich@tribalfusion.com/
obj[10]=IECache Entry : Cookie:rich@atdmt.com/
obj[11]=IECache Entry : Cookie:rich@msnportal.112.2o7.net/
obj[12]=IECache Entry : Cookie:rich@questionmarket.com/
obj[13]=IECache Entry : Cookie:rich@adtech.de/
obj[14]=IECache Entry : Cookie:rich@clickbank.net/
obj[15]=IECache Entry : Cookie:rich@122.2o7.net/
anyway, hope this is enough info to help!
thanks
rich
