My computer has been attacked by klounada. It's hijacked my homepage as well as added four sites to my favorites. I can't get rid of the four sites and I can't get rid of klounada. I've tried hijack this and cwshredder. I'm not sure I'm doing it correctly. I downloaded both to my desktop. Once run and the backups appear on my screen, I move them to recycle and then delele the recycle bin.
I need help and am very frustrated.
Please help.
hijack this thread:
Logfile of HijackThis v1.97.7
Scan saved at 4:18:47 PM, on 8/8/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\ADDYI.EXE
C:\WINDOWS\SYSTEM32\WINEXPLOR.EXE
C:\WINDOWS\NETDK.EXE
C:\WINDOWS\NETDK.EXE
C:\WINDOWS\SYSTEM\CRDI.EXE
C:\WINDOWS\NETDK.EXE
C:\WINDOWS\FREECELL.EXE
C:\WINDOWS\SCVHOST.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\DLLTMP.EXE
C:\DLLTMP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\ADOBE\ACROBAT 4.0\READER\ACRORD32.EXE
C:\WINDOWS\DESKTOP\HijackTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://klounada.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://klounada.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://klounada.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://klounada.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://klounada.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://klounada.com/index.htm
O4 - HKLM\..\Run: [ADDYI.EXE] C:\WINDOWS\ADDYI.EXE
O4 - HKLM\..\Run: [mysoft] C:\WINDOWS\SYSTEM32\WINEXPLOR.EXE
O4 - HKLM\..\RunServices: [NETDK.EXE] C:\WINDOWS\NETDK.EXE
O4 - HKLM\..\RunServices: [CRDI.EXE] C:\WINDOWS\SYSTEM\CRDI.EXE
O4 - HKCU\..\Run: [cvchost] c:\windows\svchost.exe
O4 - HKCU\..\Run: [dllhelp] c:\windows\dllhlp.exe
O13 - DefaultPrefix: http://www.microsoit.com/direct.php?url=
O13 - WWW Prefix: http://www.microsoit.com/direct.php?url=
Please help. I've tried running hijack this along with cwshredder, but obviously I'm doing something wrong.
thx.
