Browser direct to wrong page

• coldzero

  25 Dec 07, 22:06

  My browers often direct me to this website and I have to go back and click the link several times again to bring me to the correct page.Why? TIA!
  
  
• lpx88

  25 Dec 07, 22:08

  Internet Explorer?
• coldzero

  25 Dec 07, 22:10

  Firefox..
• sLeEpWaLkErInG

  25 Dec 07, 22:12

  i think megaupload toolbar stuff, i saw a similar thread like this b4...
• lpx88

  25 Dec 07, 22:15

  Scan for spyware.
• coldzero

  25 Dec 07, 22:17

  Originally posted by sLeEpWaLkErInG:

  i think megaupload toolbar stuff, i saw a similar thread like this b4...

  Yea.. I've download Megaupload toolbar before but I've deleted it. It doesnt seem to go off.
• lpx88

  25 Dec 07, 22:23

  I think u need to post a hijack this log for mayi's inspection
  
  

  Originally posted by ndmmxiaomayi:
  

  [*]Please download the latest copy of HijackThis from [b]Trend Micro and save it to your desktop.
  [*]Double click on HJTInstall.exe to install it. Click on Install. By default, it will install to C:\Program Files\Trend Micro\HijackThis.
  [*]Read through the License Agreement presented to you on the next screen and click on I Accept.
  [*]Once installed, HijackThis will start automatically. If it doesn't, please go to your desktop and double click on the HijackThis shortcut created there.
  [*]Select Do a system scan and save a logfile.
  [*]Close HijackThis.

  Note: Do not click on the AnalyzeThis button.
  
  Do not fix any lines you see in HijackThis as most entries are harmless and needed for the normal functioning of Windows.
  
  Don't close HijackThis yet.
  
  

  [*]Click on the Config... button at the bottom right hand corner.
  [*]At the top, click on the Misc Tools button.
  [*]Look under System tools.
  [*]Click on the Open Uninstall Manager... button.
  [*]Click on the Save list... button.
  [*]It will prompt you to save. Save this log in a convenient location. By default it's named uninstall_list.txt.
  [*]Notepad will open. Please post this log in your next reply.

  
  
  Post back both logs.[/b]

• coldzero

  25 Dec 07, 22:32

  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 10:30:29 PM, on 25/12/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\BitComet\BitComet.exe
  C:\PROGRA~1\DVDIDL~1\DVDIdlePro.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elearn.litespeed.com.sg/Elearning_Platform/xfiles/login.modcgi?Error_Code=4&User=
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.singnet.com.sg/
  O2 - BHO: QQCycloneHelper - {00000000-12C9-4305-82F9-43058F20E8D2} - C:\Documents and Settings\HomeUser\My Documents\QQDownload\QQIEHelper01.dll (file missing)
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [z-WrDialer] C:\Program Files\WinPoET Broadband Connection\WrDialer.exe
  O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
  O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
  O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [QQDownload] "C:\Documents and Settings\HomeUser\My Documents\QQDownload\QQDownload.exe" autostart
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
  O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
  O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
  O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
  O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
  O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  
  --
  End of file - 7530 bytes
  
  
• coldzero

  25 Dec 07, 22:34

  7-Zip 4.55 beta
  Action Ball
  Adobe Flash Player ActiveX
  Adobe Flash Player Plugin
  Adobe Reader 7.0.9
  Adobe Shockwave Player
  Athlon 64 Processor Driver
  AVG 7.5
  Beachhead 2000
  BitComet 0.90
  Canon MP Navigator 3.1
  Canon MP140 series
  Canon Utilities Easy-LayoutPrint
  Canon Utilities Easy-PhotoPrint
  Chinese Star 2006
  Direct Show Ogg Vorbis Filter (remove only)
  DivX
  DivX Player
  Download Accelerator Plus (DAP)
  DVD X Player 4.0 Professional
  DVDIdle Pro 5.9.3.0
  Enable S3 for USB Device
  ES C41 Problem Solver
  Gigabyte Raid Configurer
  Hamachi 1.0.2.2
  Heavy Weapon Deluxe(TM)
  HijackThis 2.0.2
  ijji Auto Installer
  Intel(R) Graphics Media Accelerator Driver
  iTunes
  J2SE Runtime Environment 5.0 Update 6
  Kyodai Mahjongg
  Luminary - Rise of Goonzu
  Luxor
  Marvell Miniport Driver
  Microsoft .NET Framework 2.0
  Microsoft Compression Client Pack 1.0 for Windows XP
  Microsoft Office Professional Edition 2003
  Microsoft User-Mode Driver Framework Feature Pack 1.0
  MiraScan V4.03
  Mozilla Firefox (1.5.0.12)
  MSN Toolbar
  Nero 6 Ultra Edition
  Nero Digital
  Norton PartitionMagic 8.0
  NVIDIA Drivers
  Pool 'm Up
  Power MP3 Recorder Cutter, (ver 5.0)
  PSP Video 9 2.25
  QuickTime
  QuickTime Alternative 1.61
  Real Alternative 1.43
  Realtek AC'97 Audio
  REALTEK GbE & FE Ethernet PCI-E NIC Driver
  Realtek High Definition Audio Driver
  ScanSoft OmniPage SE 4
  Security Update for Windows XP (KB913433)
  Sony Ericsson PC Suite
  Spybot - Search & Destroy
  VideoLAN VLC media player 0.8.2
  Win AVI HelixSDK
  WinAVIVideoConverter
  Windows Live Messenger
  Windows Media Format 11 runtime
  Windows Media Format 11 runtime
  Windows Media Player 11
  Windows Media Player 11
  WinRAR archiver
  WinZip
• lpx88

  25 Dec 07, 22:39

  Alright. Mayi should be able to help u check yr logs later on. Anyway u only affected when u go to friendster?
• coldzero

  25 Dec 07, 22:43

  Nope, but it occur often when I visit friendster particularly. THANKS SO MUCH!
• lpx88

  25 Dec 07, 22:44

  Originally posted by coldzero:

  Nope, but it occur often when I visit friendster particularly. THANKS SO MUCH!

  friendster ah..i rmb when i used 2 frequent there..ran into some probs as well..that was 2 years ago though...now i hardly go friendster
• ndmmxiaomayi

  25 Dec 07, 23:08

  Nothing much there.
  
  Since Spybot is installed, I suspect that Spybot might have blocked changes from taking effect.
  
  When Spybot prompted, did you allow it?
• coldzero

  25 Dec 07, 23:15

  Originally posted by ndmmxiaomayi:

  Nothing much there.
  
  Since Spybot is installed, I suspect that Spybot might have blocked changes from taking effect.
  
  When Spybot prompted, did you allow it?

  It did not prompt. :S
• ndmmxiaomayi

  25 Dec 07, 23:43

  Originally posted by coldzero:

  It did not prompt. :S

  If it didn't prompt... then most likely you won't know what is blocked.
  
  Disable Spybot Teatimer first
  
  

  [*]Right click the Spybot Icon in the system tray near the clock (looks like a blue/white calendar with a padlock symbol).
  [*]Click once on Resident Protection, then right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
  [*]Go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
  [*]Click on Mode > Advanced Mode. When it prompts you, click Yes.
  [*]On the left hand side, click on Tools.
  [*]Check (tick) this box if it is not yet ticked: Resident.
  [*]You will notice that Resident is now added under Tools. Click on Resident.
  [*]Uncheck (untick) this box: Resident "TeaTimer" (Protection of over-all system settings) active.
  [*]Exit Spybot Search & Destroy.
  [*]Restart your computer for the changes to take effect.

  
  
  Reinstall Megaupload toolbar, then uninstall it.
  
  After that, you can choose to either re-activate Spybot Teatimer or not.
• coldzero

  26 Dec 07, 12:24

  I did the above steps, including reinstalling the toolbar and uninstalling it. After uninstalling, it brings me to a site saying the toolbar is uninstalled, but after restarting my comp, the toolbar is still there and it still redirect me to the Megaclick thingy when i visit friendster.
• abao

  26 Dec 07, 13:29

  Go your plugins folder see whether the megaupload dll helper is still in your comp after uninstalling it. If so, remove the dll helper, then restart and see how.
• coldzero

  26 Dec 07, 13:37

  Originally posted by abao:

  Go your plugins folder see whether the megaupload dll helper is still in your comp after uninstalling it. If so, remove the dll helper, then restart and see how.

  SOLVED! Thanks!