Member Panel

MandyG

Hi, I'm new to this forum and need fairly basic advice! Whenever I search and click on a link i get a totally different site coming up. It takes 2 or 3 attempts to get the correct site. I've tried running both spybot and AVG and it still keeps happening HELP!!

joe5

Hya Mandy , welcome to PCHF.

If you click on the "Prework" link (below in my sig) , follow the instructions there , and post back with the Ewido and Hijackthis logs then im sure we can help you get rid of that problem.

MandyG

Joe,
Thanks for the advice I have followed you're instructions and here are the logs.
In EWIDO I removed the ones that I was sure about,but in HJT I did not know what to remove.
Thanks
Scan report_20060507.txt.txt

hijackthis log 7may.txt

joe5

You can let Ewido run again and have it fix all that it finds this time. Then after that in safemode again fix these with hjt:

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
O4 - HKLM\..\Run: [dmdns.exe] C:\WINDOWS\system32\dmdns.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D72678C-0868-40EF-871F-3DCFDE5C74B9}: NameServer = 85.255.114.75,85.255.112.71
O17 - HKLM\System\CCS\Services\Tcpip\..\{4890FCD5-6150-468D-9217-DFC86A90F56A}: NameServer = 85.255.114.75,85.255.112.71
O17 - HKLM\System\CS1\Services\Tcpip\..\{1D72678C-0868-40EF-871F-3DCFDE5C74B9}: NameServer = 85.255.114.75,85.255.112.71

Fix this one only if you dont want to keep using that as startpage:
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk

And then manually delete the file in bold.

I would also recommend to disable the windows messenger service:

Please download Shoot The Messenger

Download and run the small (22 kbyte) "ShootTheMessenger.exe" utility. It will display the current status of your system's Messenger Service. The button near the bottom of its window will allow you to set the service to whichever state ? running or disabled ? that you desire.

If, for any reason, you should ever choose to re-enable the Windows Messenger Service, simply re-run ShootTheMessenger to do so.

And i dont see a firewall running. To be better protected i would advice to install one , have a look in our download section for free firewalls.

When done , post a new hjt log please.