Browser Hijacked

[Matias2577]

Logfile of HijackThis v1.99.1
Scan saved at 5:22:52 PM, on 6/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Matias Mercado\Local Settings\Temporary Internet Files\Content.IE5\9B17XANL\tmas-web-scan[1].exe
C:\Documents and Settings\Matias Mercado\Desktop\Unused Desktop Shortcuts\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.uoydjymfwt.uk/ccJRTwp_ljScdd5mu...IByrSaWafh.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us3.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us3.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.diggbbmxwwh.com/ccJRTwp_ljQGHNf...94bocuF/xM.html
O17 - HKLM\System\CCS\Services\Tcpip\..\{80AAF69C-E051-48FE-85CD-6BB6E02D4C56}: NameServer = 196.28.61.36 196.28.61.66
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe

[flrman1]

Stick with your original thread here please:

http://www.cyberanswers.org/forum/index.ph...5778&#entry5778

This thread is closed.