Newbie dot Org HomePage
Visit one of our web buddies
Mozilla opens on weird site??
Chepakishui

08/20/04
Hi I was wondering if mozilla opening on 'http://www.zhvxgpwordcbeefvnhizvvhye.org/QAeo4TSSwFSGEunO/pgAkQ4Z/hx1g8ReKOauPApZy2Y.htm' was a problem of which you guys might be aware... What do you think is causing this?

Here is my HJT Log just in case you need it... again

Logfile of HijackThis v1.98.2
Scan saved at 17:55:34, on 2004-08-20
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\System32\ctfmon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Downloads\Hijack This!\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jtkafiplvxtncetu.us/QAeo4TSSwFSGEunO/pgAkTqpFNjhdrFMKOauPApZy2Y.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.abtdihtxuwfrrqghsashbpwm.com/QAeo4TSSwFQhxNWrgqNqnFgOIFQwWQHajxu454G8BPevF_7Yf4gblZB0ZdRPeaFS.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {25555947-F7C3-840A-6B78-F85C3A4CCFA7} - C:\PROGRA~1\CDROMG~1\open platform.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [LOADPLUS] C:\PROGRA~1\knob bind road\love trust.exe
O4 - HKLM\..\Run: [bleh test pure sixth] C:\Documents and Settings\All Users\Application Data\THUNKOPTIONBLEHTEST\byte trust.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

Chepakishui

08/22/04
Most of you are probably watching the olympics... if you have time... do you have any idea what I should do?
Chepakishui

08/25/04
has anyone heard of this problem before? I changed it but it returned three days later...
Togg

08/25/04
Can you get to any Mozilla Forums to check if this is a known problem? This looks like a plain old browser hijack which is common in IE, (see the R0 items in your HJT log) but I don't understand how/why IE hijacks are affecting Mozilla?

There is a HijackThis tutorial which discusses these R0 items which you have that point to the gobbledygook site you mention. I'll post the URL but I don't think they come over too well here, (or I'm doing something wrong);http://www.bleepingcomputer.com/forums/index.php?showtutorial=42

Assuming you get to the tutorial, note the dire warnings about putting HJT into a folder of its own so that any backups are safe and NOT to 'fix' anything you do not know everything about.

Hopefully, someone who knows about this will be along soon.

Anti-SpyWare: Adaware, Spybot, SpywareBlaster
Anti-Virus: NAV 2004
Browser: Opera, Mozilla, IE
Firewall: ZA 5.1
OS: Win 98


© Copyright 1998-2004 Newbie dot Org -- All rights reserved --



This site maintained by Galaxy Website Design


--|--