Newbie to board.... got a windows 98 problem ....

[SPL2Alan]

So i jump on my computer one day, and i find a new homepage. My natural response is to run spybot, and get rid of any spyware etc etc.... I immediately change the page back to my normal page, and then restart the computer. The page immediately comes back every time i restart. Second problem is that my url drop down bar takes forever to open up when i click on it. The speed of my computer is also greatly diminished since the last couple times i've used it. Right now i only have like 6 programs running, and my system resources are only 53% free. I can't even run winamp without it skipping.
I decided perhaps this could be some sort of virus, so i did a scan and found a trojan in my system. I removed it, and thought perhaps this is what was causing the webpage change...... No luck. Trojan is gone, but my webpage keeps changing.
If you want specs on my system, here they are :
1.6Gig processor, 512MB ram, 128MB video card and im running windows 98 SE on this thing. This computer should easily be able to handle this load, any ideas on what my problem is?

[brad]

First, you can try this simple tweak: To fix the Homepage issue go to: (Backup Registry first) Start/Run/Regedit and navigate to this key:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel.
If a HomePage dword value exists in this key, select it.
On the Edit menu, click Delete, and then click Yes to confirm the deletion.
If that doesn't get it, there are some hompage hijackers that are very devious and you have to dig a little deeper.
This explains them well and gives you some "first steps".
You can download and that will probably get the culpret. If it doesn't, copy and paste the Hijack This log file into a thread at the and they will scrutinize it for you.
I'm just guessing but your second problem is probably related to your hijack issue.
Let us know how it goes. brad

[SPL2Alan]

[brad]

Ok... Did some checking and found that the "Internet Explorer" and "Control Panel" Keys sometimes don't exist and you must create them.
Before you do that, try this:
Look under: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main. In the right pane scroll down to Start Page. Double click and under Value data, see what URL is listed. Then edit it to what you want your Home Page to be. Use the complete URL.
See if that helps the Hijack issue for now.
Did you try the other suggestions? If not, give it a try. Even if this fixes the issue it my come right back.
brad

[SPL2Alan]

well, this is what the hijackthis log looks like, i don't know if you're going to be able to help me, but if not, i'll go for that other forum. I really have no clue what any of this stuff is


Logfile of HijackThis v1.97.3
Scan saved at 7:22:39 PM, on 11/8/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\MSREXE.EXE
C:\WINDOWS\SVCHOST.EXE
C:\MY DOCUMENTS\AIM95\AIM.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\MY DOCUMENTS\WINRAR\WINRAR.EXE
C:\WINDOWS\TEMP\RAR$EX03.277\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchdot.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchdot.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchdot.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\MY DOCUMENTS\ADOBE\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Msoffice] C:\WINDOWS\FONTS\msoffice.hta
O4 - HKLM\..\Run: [System Service] C:\WINDOWS\SYSTEM\MSREXE.EXE
O4 - HKLM\..\Run: [Online Service] C:\WINDOWS\svchost.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [AIM] C:\MY DOCUMENTS\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Trei] C:\WINDOWS\Application Data\ttns.exe
O4 - HKCU\..\Run: [Msoffice] C:\WINDOWS\FONTS\msoffice.hta
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200 ... taller.exe
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/c ... potc_x.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc ... tor/sw.cab
O16 - DPF: Yahoo! Pinochle - http://download.games.yahoo.com/games/c ... /ut2_x.cab
O16 - DPF: {28F00B0F-DC4E-11D3-ABEC-005004A44EEB} (Register Class) - http://content.hiwirenetworks.net/inbro ... Hiwire.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C ... 930.908125
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/d052 ... scan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... Client.cab


edit: The search.net page is the one that keeps coming up, but i don't want to delete a bunch of stuff if i shouldn't be deleting it. ;)

[Ranger Bob]

See if this link helps:

http://www.computing.net/security/wwwbo ... /7127.html

[Gecko]

Hi SPL2Alan,
All of the below can be deleted, just run HijackThis again check box each item listed below and click the fix checked button.
That should resolve most of your problems.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchdot.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchdot.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchdot.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - Default URLSearchHook is missing

[SPL2Alan]

it still comes back after i restart

[brad]

Did you try my suggestion above? What about Ranger Bob's?
brad

[Ranger Bob]

These are quotes from my link above:

"Problem solved!
I found this finally from another person who had this problem. I removed from Regedit and deleted the file msoffice.hta.
Finally searchdot.net is gone."

"This bug was just a lame attempt by a web designer to force people to use his search engine. The msoffice.hta is a hidden file that, unless you search specifically for it with the "Find Files and Folders" in the start menu. You will never see it. It's not in your registry. If I remember right though, it should be in your windows folder. Anyway, hope this helps you out."

If that does not work then maybe this will:

"There are many differnt versions of this type of trojan. Trojan.Ghost.(A & B) Trojan.bootconf, and the one we are dealing with is VBS.Bootconf. Symantec knows nothing about this file, although most of you above have found the answers.
Turn off your system restore.
Click Start.
Right-click My Computer, and then click Properties.
Click the System Restore tab.
Select "Turn off System Restore" or "Turn off System Restore on all drives" check box
Click Apply.
As noted in the message, this will delete all existing restore points. Click Yes to do this.
Click OK.
Proceed with my instructions below.

The easier way to rid of this annoying virus is locate the msoffice.hta file. You can do a search or an easy way to find this is go to Start > Run > and type MSCONFIG. A box pops up, but do not change anything in this box that pops up, it is your System Configuration, and if you change somethign you shouldnt, your computer might not boot up. Click on the start up tab. Scroll down untill you find a start up item labeled msoffice. To ensure this is the correct file look at the Command line. The command line should inclued the following C:\Windows\.....\msoffice.hta. In my case it was hidding in the Fonts(C:\Windows\Fonts\msoffice.hta. Now that you are aware that this is the correct file, Uncheck it. Click ok, then Click Exit without Restart. What this does is stops that file from being loaded when windows is booted up. When this file loads, it restores the virus to its original state, and eliminates any changes to made to the registry, and internet explorer options.

Now that you made changes in your MSCONFIG, you can navigate to where the msoffice.hta is located. This file might be hidden, so in your explorer click tools > folder options > View > Show hidden files and folders > click ok. Once you have done this you will be able to see the msoffice.hta file. Delete it.

Now you need to edit your registry.
Click Start, and then click Run. (The Run dialog box appears.)
Type regedit

Then click OK. (The Registry Editor opens.)


Navigate to the key:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer


In the right pane, delete the values:

"Search" = <encoded URL> (i just replaced these values with www.msn.com)
"SearchURL" = <encoded URL>


Navigate to the key:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search


In the right pane, delete the values:

"SearchAssistant" = <encoded URL>
"CustomizeSearch" = <encoded URL>


Exit the Registry Editor.

Now this should rid you of this annoying virus. reboot your computer.

Once you have rebooted a message will pop up from the configuration we made in your MSCONFIG. check the available check box and click ok.

now you should be good to go, you might need to change your internet settings in internet explorer. Connect to the Internet and go to the page that you want to set as your home page.
Click Tools, and then click Internet Options.
In the Home page section of the General tab, click Use Current, and then click OK.

now you need to turn your system restore back on.

Turn on your system restore.
Click Start.
Right-click My Computer, and then click Properties.
Click the System Restore tab.
Clear the "Turn off System Restore" or "Turn off System Restore on all drives" check box.
Click Apply, and then click OK"

[SPL2Alan]

thanks guys, i really appreciate it. That damn thing is finally gone from my computer, and for future reference, if it comes back i know how to get rid of it!
Computer is also acting a lot faster now
73% free now instead of 47%

[Ranger Bob]