I'm hoping you can help me. My home page has been hijacked, it now always comes up about:blank with a strange search engine. Also I am getting spyware alert pop ups with every web click ever since the hijack. I did a search, came to a site, http://www.securiteam.com/securityre...RP0L0UD5U.html that seemed good. When I clicked on a question series it started a download, which I interrupted. Still donot know what was coming, but something was for sure.
My computer seems to be running a little slow but it is hard to tell as I have disconnected the cable and gone to 56k dial up until this is resolved.

I am running Windows XP Home with all updates (service pack 1 plus auto update). For protection (not that it did me much good) I have Norton anti-virus 2004 (up to date), Zone Alarm Pro and Spybot Searh and Destroy 1.2 (updated). Spybot tells me I have AdAware as well but if so I did not set it up. Running IE version 6.

I see you have ben able to help some other folks so hopefully you can with me as well. One thing, I am not by any means a computer nerd, anything you tell me to do you will likely also have to tell me how to do it too!

You need to download the latest version of Spybot Search and Destroy for a start which includes a feature called Teatimer that leaves an icon in the System Tray (next to the clock) and constantly protects your computer. The latest version is available here.

Then to remove this Hijacker, you need to post a Hijack This log to the forum. To learn how, see the link in my signature.

Here it is Owen. many thanks. One detail, Teatimer does not show up on my tray (SpyBot S&D 1.3).
Logfile of HijackThis v1.98.0
Scan saved at 9:52:37 PM, on 12/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Optmouse.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Colin Riley\My Documents\Download\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\COLINR~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\COLINR~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\COLINR~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\COLINR~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\COLINR~1\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\COLINR~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {6CEFCE1C-F969-40DD-8CFE-3811C717943D} - C:\WINDOWS\System32\dkpjc.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OPTMOUSEMOUSE] C:\WINDOWS\System32\Optmouse.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXE
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.dll
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BA40962E-ED9A-499A-90BE-35F84E627681}: NameServer = 142.161.2.155 142.161.130.155
O18 - Filter: text/html - {6BF26A97-11E5-4393-B6E1-E35E06A73E91} - C:\WINDOWS\System32\dkpjc.dll
O18 - Filter: text/plain - {6BF26A97-11E5-4393-B6E1-E35E06A73E91} - C:\WINDOWS\System32\dkpjc.dll

When you install Spybot S&D there is an option to Enable it. You need to go into Advanced Mode and into settings and Enable TeaTimer now. Or you could just reinstall and ensure that you put a tick in the box, its a quick process.

I'm sorry to say you have a variant of CWS that I'm unable to instruct you to remove. The maker of a removal tool for it has taken the tool down for the time being. I'm going to ask a few knowledgeable people if they know of any other tools. Sorry about this, but please stay put for the time being.

In the meantime, as a temporary fix, restart Hijack This and put a checkmark next to the following entries:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\COLINR~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\COLINR~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\COLINR~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\COLINR~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\COLINR~1\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\COLINR~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O18 - Filter: text/html - {6BF26A97-11E5-4393-B6E1-E35E06A73E91} - C:\WINDOWS\System32\dkpjc.dll
O18 - Filter: text/plain - {6BF26A97-11E5-4393-B6E1-E35E06A73E91} - C:\WINDOWS\System32\dkpjc.dll

Click Fix Checked

Then ensure you enable the TeaTimer as mentioned above. It may be able to stop this pest returning for a temporary measure.

Okay. Done. TeaTimer now up and running (at least SpyBot Resident is). Items fixed. Out of curiousity what is CWS and how do I avoid it?

CWS is a Browser Hijacker that Hijacks you to many different sites, there are many variants. You have a CWS Variant that is very tricky to remove.

You can prevent CWS with regular spyware scans, keep Windows and IE up to date and have programs such as the TeaTimer running.

Please don't be alarmed if it comes back. It will, because we have not properly removed it. There are currently no removal tools available for this variant, there was one but the maker has removed it. This is just a temporary measure and I'll let you know when we have a fix.

Okay, guess we sit and wait. Not a perfect answer but then its not a perfect world either! Many thanks for your help so far and for keeping on truckin.

Owen;
I just downloaded the latest update to Norton anti-virus 2004. It immediately detected 'trojan.startpage' and got rid of it! yahoo! Not sure if it is gone forever but so far so good. Right browser homepage and spyware pop ups are gone. In the meantime what are my protection options?

Well that is brilliant if it is gone. Quite a lot of antivirus program do detect it, but not totally remove it.

You already have Spybot and the Teatimer which are brilliant programs for Spyware Prevention. I also suggest you download the free version of Ad-aware which is another spyware scanner and Spyware Blaster which will prevent the majority of nasties slipping through Internet Explorer.

We now have a method of removal for this variant, which I think I will be able to help you with. Its my first time using this, so please follow my instructions carefully. First of all, we need to check for an infection.

Copy the contents of the bold text to Notepad.
Name the file Appinit.bat
Save as type All Files
Save on the Desktop.

Reg save "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" windows1.hiv
ren windows1.hiv windows.txt

Double click on Appinit.bat
This will create a file on the desktop named windows.txt
Copy and paste the contents of windows.txt into your reply here at DAL