My Browser Has Been Hijacked

**100%** · 06-24-2004, 02:28 PM

Did you look at these two tricks?

i repeat
You should also take a look at these two tweaks
http://www.tweakxp.com/display.aspx?id=2076

http://www.tweakxp.com/display.aspx?id=123864

?
edit: the second one even has a registry package ready for u but try the first one um 1st

**TheKiler** · 06-24-2004, 02:35 PM

The best solution ever:

Get your XP cd. Boot from it. Delete your partition. Create a new partition. Sit back, relax, and follow the instructions on the screen.

**FuNkY CaPrIcOrN** · 06-24-2004, 02:37 PM

Originally posted by Zedaxax@24 June 2004 - 09:36
Did you look at these two tricks?

i repeat
You should also take a look at these two tweaks
http://www.tweakxp.com/display.aspx?id=2076

http://www.tweakxp.com/display.aspx?id=123864

?
edit: the second one even has a registry package ready for u but try the first one um 1st

I am checking them out now Zedaxax.Thanks.

*I am going to need sleep soon.lol*

**Jg427** · 06-24-2004, 03:05 PM

HiJackthis will make a backup copy of any file you fix with it. The backup copy will appear in your hjt folder, just in case.

Close all browser windows, run hjt and checkmark to fix:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\FUNKYC~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\FUNKYC~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\FUNKYC~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\FUNKYC~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\FUNKYC~1\LOCALS~1\Temp\sp.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\FUNKYC~1\LOCALS~1\Temp\sp.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O2 - BHO: (no name) - {C8ECC921-A38F-4497-86F8-A1484D0C0B8C} - C:\WINDOWS\System32\dhbknjp.dll

Reboot into safemode and delete in bold
C:\WINDOWS\System32\dhbknjp.dll
C:\Documents and Settings\username\Local Settings\Temp\sp.html

reboot in normal mode and post a new hjt log

**MagicNakor** · 06-24-2004, 04:30 PM

Were you hijacked by CoolWebSearch? If so, download CWShredder. It's never failed me for that particular hijack.

**100%** · 06-25-2004, 01:40 PM

So did you fix it???????????

**lynx** · 06-25-2004, 07:15 PM

After all that, check your IE security settings.

One of the things nearly all of these hacks do is set your security settings to LOW. So you clean up the mess left by this attack, but your pc is wide open to the next one that comes along.

Or get a decent borwser, fire fox sake.