Hijacked by ISPWest, Can't Fix

I downloaded a trial offer ISP DUN connection from ISPWest; it worked fine. But it hijacked my browser and ISPWest has not responded to emails nor provided a fix when I called this morning. Windows Me Add/Remove was the only uninstall option available; it would not list in Norton CleanSweep. ISPWest 'seemed' to uninstall OK, but still kept my browser {the Inet Tools>Options>Homepage is grayed out and nonfunctional}. I used the Microsoft suggested fix and was BSOD'd by Windows Protection errors. 3 safe-mode restarts later I got Windows and IE5.5 working again, But my homepage is still hijacked/nonfunctional.
HiJack This! found the regedits, which i safely deleted, no joy.
Spybot & Adaware don't find anything to clean.
Norton AV scan comes back clean.
Registry First Aid & Registry Pruner don't find anything.
I am not real comfy with regedit, but have all my backups made and will give it a try if someone has a fix.

Athlon Tbird 1.4{noc'd}, 512mb Crucial pc133 sdram
Mobo MS6340M VIA vt8365a, FSB 133mhzx2
Award BIOS v6.00pg
IDE uata100 WD400BB & SV4084H PromiseRAID1
Sparkle 400w PSU on UPS, Sony DVD, CD-RW
GF2 mx400/64, Zoom .92/.44 hardmodem
MBM5 idle: cpu-30c, mobo-26c, case-23c
Mid-ATX 2casefans+HSF, TweakedMe{98III-}, IE5.5 SP2

 

At work now.

If not fixed by tonight I will post on a repair for you then, when I get home.

Mike

 

RexB Hi

spyware Blaster can disable that option or if you check it apply then uncheck and apply , you'l get it back
http://www.javacoolsoftware.com/spywareblaster.html
OR with regedit
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"Homepage "=dword:00000001
change the dword value to 0

I assume you have gotten rid of any branding ?in the title bar and if they modified the little gloag in the upper right hand corner ?
If you want since you're not comfortable with regedit copy and paste this into regegit ,save , exit and rename with a reg extention then r/click and choose merge,,, backup the registry first
and make a restore point if possible
=============================================
REGEDIT4

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"Homepage "=dword:00000000

==============================================

PS be carefull with highjackthis
Regards
Lonny

 

Thanx, I'll give the SpyBlaster a go, and if no joy, then paste the edit in. No, I haven't gotten rid of the branding or the new geysering isp logo, guess this gets involved, wun'nerful.
Regards

& that tab>function is grayed out, not selectable
& Rgr the HijackThis warning; that could get me into 'force-learning' regedit real quik

 

I would like to see the HiJackThis report.

In HiJackThis go to config-misc tools-generate startup list.

Copy and paste back in a message to us.

Mike

 

Here's the Startup list log that HijackThis gathered, if it's not what's needed I'll get more. . . :

StartupList report, 6/23/2003, 8:04:48 PM
StartupList version: 1.52
Started from : C:\WINDOWS\TEMP\HIJACKTHIS.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v5.51 SP2 (5.51.4807.2300)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\ACCSTAT.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZAPRO.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\SYSDOC32.EXE
C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINSM32.EXE
Norton System Doctor.lnk = C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE

Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LexmarkPrinTray = PrinTray.exe
TaskMonitor = C:\WINDOWS\taskmon.exe
PCHealth = C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
AtiPTA = Atiptaxx.exe
ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
LoadQM = loadqm.exe
NAV Agent = C:\PROGRA~1\NORTON~1\NORTON~1\NAVAPW32.EXE
QD FastAndSafe = C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /startup

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
Devldr16 = C:\WINDOWS\SYSTEM\devldr16.exe
ATIPOLAB = ati2evxx.exe
TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
SchedulingAgent = mstask.exe
CSINJECT.EXE = C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE
SymTray - Norton SystemWorks = C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks "
Upgrade System Companion = C:\windows\warrenew.exe
SSDPSRV = C:\WINDOWS\SYSTEM\ssdpsrv.exe

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 22/6/2003, 8:12:0)

[rename]
NUL=C:\WINDOWS\TEMP\UPOUYOFV.EXE

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP
SET CLASSPATH= "C:\WINDOWS\SYSTEM\QTJava.zip "
SET QTJAVA= "C:\WINDOWS\SYSTEM\QTJava.zip "

--------------------------------------------------

C:\WINDOWS\WINSTART.BAT listing:

C:\WINDOWS\tmpcpyis.bat

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\DRAGON SYSTEMS\NATURALLYSPEAKING\PROGRAM\WEB_IE.DLL - {2843DAC1-05EF-11D2-95BA-0060083493D6}
P3P Client - C:\PROGRAM FILES\PRIVACY BIRD\P3PCLIENT.DLL - {00000178-CD4A-447a-BCF9-6FD0096B5527}
NAV Helper - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
(no name) - (no file) - {EF99BD32-C1FB-11D2-892F-0090271D4F88}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRA~1\SPYBOT~1.1\SDHELPER.DLL - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - c:\windows\googletoolbar.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
Disk Defragmenter.job
Symantec NetDetect.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job
PCHealth Scheduler for Data Collection.job
Printer Software Update.job
Norton SystemWorks One Button Checkup.job
Norton AntiVirus - Scan my computer.job

--------------------------------------------------

Enumerating Download Program Files:

[pcdr Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PCDRCOM.DLL
CODEBASE = http://www.pcpitstop.com/techexpress/pcdrCom.CAB

[{6CB5E471-C305-11D3-99A8-000086395495}]
CODEBASE = http://services.google.com/navclient/data/deleon/1.1.45-deleon/GoogleNav.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Symantec RuFSI Registry Information Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RUFSI.DLL
CODEBASE = http://security2.norton.com/us/sa/common/common/bin/cabsa.cab

[iCC Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PCPCONNCHECK.DLL
CODEBASE = http://www.pcpitstop.com/internet/pcpConnCheck.cab

[PopupMenu Object]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\IEMENU.OCX
CODEBASE = http://activex.microsoft.com/activex/controls/iexplorer/x86/iemenu.cab

[MSN Money Charting]
InProcServer32 = C:\WINDOWS\DOWNLO~1\INV10.OCX
CODEBASE = http://fdl.msn.com/public/investor/v10/investor.cab

[InstallFromTheWeb ActiveX Control]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\IFTW.DLL
CODEBASE = http://www.installfromtheweb.com/install/iftwclix.cab

[{51045741-8C4E-4EAC-8F03-08E43A6FBB29}]
CODEBASE = http://aft.ancestry.com/aftfiles/files/install/AncestryFamilyTree.cab

[ExteriorSurround Object]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\OUTSIDE.OCX
CODEBASE = http://carpoint.msn.com/Components/Ocx/Exterior/Outside.cab

[mhLabel Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MHLBL.DLL
CODEBASE = http://www.pcpitstop.com/mhLbl.cab

[CWDL_DownLoadControl Class]
CODEBASE = http://www.callwave.com/include/cab/CWDL_DownLoad.cab

[{41F17733-B041-4099-A042-B518BB6A408C}]
CODEBASE = http://a1540.g.akamai.net/7/1540/52...apple.com/qt505/us/win/QuickTimeInstaller.exe

[YBIOCtrl Class]
CODEBASE = http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/my/yiebio4029.cab

[MailConfigure Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MAILCFG.DLL
CODEBASE = http://supportservices.msn.com/us/smtptool/MailCfg.cab

[RdxIE Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RDXIE.DLL
CODEBASE = http://207.188.7.150/154924628a1301a2cf18/netzip/RdxIE6.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37604.2882407407

[ActiveDataObj Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\ACTIVEDATA.DLL
CODEBASE = https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab

[PCPitstop Utility]
InProcServer32 = C:\WINDOWS\DOWNLO~1\PCPITS~1.DLL
CODEBASE = http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
UPnPMonitor: C:\WINDOWS\SYSTEM\UPNPUI.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL

--------------------------------------------------
End of report, 9,222 bytes
Report generated in 0.162 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

Solution & Fixed, {fingers crossed}
Thanks Lonny & mflynn, the regedit worked, got my home page back and debranded and all- it wasn't pretty for a while, amazing how a reg change can affect seemingly unrelated functions. Whew!
I'm taking a crash tutorial on regediting, just to see if i can get really dangerous!
It's Miller Time {& sleep}

ps: anything in that HijackThis log report I should be concerned about?

 

Great

Lonny gets all credit here! Good job as usual, Lonny!

And good job to you for following the instructions.

I saw nothing specific to this problem in the list but for performance the following could be removed:

LexmarkPrinTray = PrinTray.exe (not nessesary)

ATIPOLAB = ati2evxx.exe (not nessesary)

(no name) - (no file) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} (not identified so assume it is bad)

LoadQM = loadqm.exe (not nessesary)

The above are the obvious there are several others below that you should investigate, and if you keep them you should know exatly what they do and why and if nessesary

MS Money, updating?

Upgrade System Companion = C:\windows\warrenew.exe

C:\WINDOWS\TEMP\UPOUYOFV.EXE

P3P Client - C:\PROGRAM FILES\PRIVACY BIRD\P3PCLIENT.DLL - {00000178-CD4A-447a-BCF9-6FD0096B5527}

All I am going to say about this as I don't want to get started, is oneday when you need the speed and stabiliy you can CAN the SystemCrasher.


Mike

 

Now how come sometimes the email notifacation doenst work ?
Nevr mind there just slow today
Im best not to even try to help with a highjackthis log, glad Mike chipped in, and others are lurking..

RexB I assume you have the basic version google toolbar ?
If so I see no reason to have a plugin for it , I delete them !
IE tools internet options settings view objects r/click and remove
the more active X plugings we have the more likely it is to confuse
windows and IE. see what Others say before deleting i though.

I think it was Mike in aother thred that said please concider not
renewing anything Norton the next time it is due,
and here to ?

I seen so many problems with them I will never consider even if they were free.

DEVLDR16.EXE do a google search, this is something with realone player? and TkBellExe loading every time windows starts , even if you disable it in MSconfig the next time you use the player it incerts another mention of same .. go to pacs portal for the trick to disable it.
PRIVACY BIRD: I was checking it out cant remember where I found bad reports( sorry) that and it was so old I decided against
even trying it.

http://www.pacs-portal.co.uk/startup_pages/startup_full.htm

Pitstop is ok but dont believe everthing -- if tried them same setup same fresh boot differant reports , beside that I dont care for the fact they put stuff on our pc and dont offer to clean up afterwards.
you might want to try ( free and safe) BrowserTune
By fred langa( if you havent already)
http://www.browsertune.com/bt2kfast/

Have a good day
Lonny

 

ok to all that, and will get my startup cleaned out; by 'system crasher' do you mean the norton system works that's saved my bacon a couple of times? I don't have enough knowhow yet to do NSW's job so though it has a few rough spots it helps. Did you have a thread on 'system crasher' when you 'got started' on it? hehe

I've the basic Googlebar, and those durn plugins keep reappearing occassionally when i use google (often). They didn't answer when i asked what they were good for. And yeh, am still stumbling across junk that RealOne player left in my box - went back to RP8.

btw, SpyBlocker installed now, another wall, ShieldsUp!

thanx again

 

Hello I dont know what the google plugin is for as mine works fine without, strange when I first got one it didnt have a plugin later had to reinstall, had to use the IE repair , which removed it,
then they started with that darn plugin ,
if it keeps reapering maybe check tools internet options > content > publishers and remove google if there, while you are there remove most everthing , except microsoft mmm norton especialy look for unknown's

only thing in there on our machine is ms and some for online av scans.

Keep an eye out here you'l see plenty about noton
'system crasher' HE hE
especialy the whats it ? live update , bad piece of work if you ask me--- just manualy update ,, I dont even trust microsoft auto updates or sometimes called criticall update notifacation
turn it off ( just my opinion)
Lonny

 

hmph, my inet content>publishers just has MS as trusted (is that an oxymoron) too. I'll just keep uninstling google plugins as they come along; cleaning the box is sorta like mowing the yard.
i must be lucky with NSW . . . and MS auto update has been off for awhile here, it always wants to put stuff in i don't want yet {IE6, assorted packets}.
I'll stay tuned for Norton slams, big target, and may gripe about ZAP occassionally resetting itself for no reason, or tech explanation.
I'm heading to Browser Tune, it's been awhile . . .

Rex

 

CSINJECT.EXE = C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE
SymTray - Norton SystemWorks = C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks "

This is coming from a LONO, LONG time Norton Supporter.

DUMP the whole darn Norton and get separte AV & Firewall programs that do just as well ( if not better ) with FAR LESS system loading and intervention.

AVG and Kerio work very well.

CleanSweep may sweep something that IT THINKS is not needed but really is. On occasion all programs of that type will do that.

Norton 2002 was not too bad. But 2003 was a waste of my $$$$.

You must be. And I also have ALL auto updating turned OFF. Nothing goes out of this machine with out my giving it the OK to.

BillyBob

 

Yes, they do play very well together. I already had AVG installed, with ZA. Got rid of ZA [2.6] and all it's files and registry entries, and put on Kerio. I noticed the difference right off the bat.
Then I did my own thorough investigation, then slapped myself for not switching sooner.

 

Norton & ZAP like me, what can i say i'm a nice guy. But I don't like the 9+% SR that ZAP takes or 6+% NSW takes. Have those 2 gotten so big and try-to-do-everything (as majority of public demands) they trip over themselves. . .
I'll look at AVG & Kerio, you say a noticeable (measurable?) difference?; and free version of Outpost as a comparison.
Ya' know, after the isp uninstall and regedit my machine is sluggish, whetstone/dhrystone PCMark show a drop. After this T-bird sleeps on it overnite, maybe it'll feel better in the morning.