i can't controle my homepage anymore

[Newbie's Journey]

Last night i download a video which is supposed to be a realplayer file, and I tried to run it and realplayer come out but the video doesn't start even after i click on "play". There's a document file and another file that looks like registery file or something, both come with the video, the document file is in a language that i can't read and i thought i must click on registry file in order to run the video, so i click on it, but the video still doesn't run, then i go to Internet Explorer, and the homepage become the following link: http://www.00263.cn/, I don't know what is on there, but it doesn't look like porn. However I try to change back to the my default homepage in internet option, but whenever i restart IE, it just go back to the same page, please tell me what to do ??? Should I clean up my harddrive or something ?? Any prof, plz help.

 

[Phisionary]

sounds like your browser has been hijacked.

reccomendations: Stop using IE. IE is insecure. Use... Firefox maybe. Or opera. or mozilla. or.. hell, even netscape.

failing that... raise your security setings. That ca sometimes help. Hijacks usually happen through 'ActiveX controls'. Some websites don't work without them though.

Search for a program called 'HijackThis' Extract it somewhere, run it. Select stuff that doesn't look right. I don't think you can screw stuff up too much, with this proggy.

Also might want to download AdAware, and some of the other similar software out there. I only use them occasionally, so I dunno what they all are now.

Oh, and stop llokin at teh pr0n... until your computer is secured,...

 

[[Matt]]

Download the hijack this spyware removal tool from here http://www.spychecker.com/program/hijackthis.html and then post the log here.

 

[Newbie's Journey]

Thanks for helping me, I tried the program hijackthis, it scan my system and found the IE's homepage set to http://www.00263.cn/, so i check it and click on fix then i delete it in the backup. But when i restart IE, the homepage is still the same thing, when i rescan my system with hijackthis, it found that homepage again, I tried to fix and delete it couple time, and it's still there, Plz help !

 

[Phisionary]

There is a section in the hijackThis log file that shows browser plugins and extensions, as well as one that shows programs that run on bootup. There will be some exe's installed that automatically change your homepage when the setting is altered.

Post the logfile if you want us to tell you what to get rid of.

 

[Newbie's Journey]

There is a section in the hijackThis log file that shows browser plugins and extensions, as well as one that shows programs that run on bootup. There will be some exe's installed that automatically change your homepage when the setting is altered.

Post the logfile if you want us to tell you what to get rid of.

thx

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.00263.cn
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.00263.cn

"http://www.00263.cn", this is the link that is set to my homepage. I tried to fix it and delete it in hijackthis, but the link stay there and when i rescan with hijackthis, it appears again.

 

[Phisionary]

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
this looks suspicious. If you haven't purposefully installed some custom IE bar... I dunno, I'll leave that up to you. Most likely not causing you problem though.

O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)
should be able to get rid of this, doesn't look like it's tied to anything...

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
I dunno what this is...

O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
Yahoo voice chat or something... I'll presume that you installed this or at least know what it is...

O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
I suppose this is there on purpose. Doesn't seem to be hostile at least. Like, a flash player extension or somehting??? Meh.

O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
I don't know what this is exactly, but it doesn't sound too good. If you don't know, get rid of it, IMO.

Huh... really doesn't seem to be anything that would cause your problem. I presume you've run it before though? If you got rid of anything else, try rebooting and see if it still does it.

Well, I try. sorry if it doesn't work still. GL.

 

[nbk]

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.00263.cn

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.00263.cn

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL

O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL

Take a look at those. Also, anyone with common sense would see why people don't help you... *ahem* :rolling:

Why do you end everything with "plz help omg help", and start new threads? Talk in a more formal manner, you'll get more respect

(I can almost guarantee the MySearch bar has to do with something - especially coolwebsearch and hijackings)

Make sure you get Ad-aware(www.download.com)