Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Computer Information > Hijacked computer problems

Reply
Thread Tools

Hijacked computer problems

 
 
Whodat
Guest
Posts: n/a
 
      05-22-2004
Hello to all -

I'm trying to help a friend out (without much luck, sadly). He
got his computer hijacked & can't figure out how to get rid of the
problem. Hie start page now goes to Gets sent to
SIChttp://your-searcher.com/index.htmSIC (sic added to kill the link).
I've done a search & found what seems to be similar complaints
that have to do with a bunch of .exe & htm files, not all of which we
found on his computer. We deleted the ones we could find, but I think
there is something in the registery we need to get rid of & I can't
find it. The advice I found is as follows:
(run MSCONFIG and uncheck these entries all but the
'upgrade service is there - you must use Registry Editor to delete it)
Registry entries added:
HKLM\Software\Microsoft\Windows\Current Version\RUN:
Dial32 c:\windows\dl.exe
Dial33 c:\windows\dlm.exe
Reg32 c:\windows\reg33.exe
Upgrade Service c:\windows\sxchost.exe

The problem is I can't find HKLM anywhere. HKEY yes, HKLM no.
We drilled down to the same folder in HKEY with no luck & I'm not sure
what we would search for to find the offending files.
Tried HijackThis, Ad-aware, CWShredder, etc. Nothing gets to
the problem.
Can anyone shed some light on this? Many thanks from both of
us!
 
Reply With Quote
 
 
 
 
Brad Griffis
Guest
Posts: n/a
 
      05-22-2004
HKLM stands for HKEY_LOCAL_MACHINE. When you use Ad Aware, etc. be sure to
download the latest updates. After you've updated Ad Aware, anti virus,
etc. you should reboot your system to Safe Mode. You can get into Safe Mode
by hitting F8 repeatedly at startup (right after the BIOS screen). Once
you're booted to safe mode you should scan the system with all those
programs to clean out all the junk.

Another good thing to do is to just use the "Add/Remove Programs" feature in
Windows to get rid of as much crap as possible.

Brad


"Whodat" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Hello to all -
>
> I'm trying to help a friend out (without much luck, sadly). He
> got his computer hijacked & can't figure out how to get rid of the
> problem. Hie start page now goes to Gets sent to
> SIChttp://your-searcher.com/index.htmSIC (sic added to kill the link).
> I've done a search & found what seems to be similar complaints
> that have to do with a bunch of .exe & htm files, not all of which we
> found on his computer. We deleted the ones we could find, but I think
> there is something in the registery we need to get rid of & I can't
> find it. The advice I found is as follows:
> (run MSCONFIG and uncheck these entries all but the
> 'upgrade service is there - you must use Registry Editor to delete it)
> Registry entries added:
> HKLM\Software\Microsoft\Windows\Current Version\RUN:
> Dial32 c:\windows\dl.exe
> Dial33 c:\windows\dlm.exe
> Reg32 c:\windows\reg33.exe
> Upgrade Service c:\windows\sxchost.exe
>
> The problem is I can't find HKLM anywhere. HKEY yes, HKLM no.
> We drilled down to the same folder in HKEY with no luck & I'm not sure
> what we would search for to find the offending files.
> Tried HijackThis, Ad-aware, CWShredder, etc. Nothing gets to
> the problem.
> Can anyone shed some light on this? Many thanks from both of
> us!



 
Reply With Quote
 
 
 
 
mark mandel
Guest
Posts: n/a
 
      05-22-2004

"Whodat" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Hello to all -
>
> I'm trying to help a friend out (without much luck, sadly). He
> got his computer hijacked & can't figure out how to get rid of the
> problem. Hie start page now goes to Gets sent to
> SIChttp://your-searcher.com/index.htmSIC (sic added to kill the link).
> I've done a search & found what seems to be similar complaints
> that have to do with a bunch of .exe & htm files, not all of which we
> found on his computer. We deleted the ones we could find, but I think
> there is something in the registery we need to get rid of & I can't
> find it. The advice I found is as follows:
> (run MSCONFIG and uncheck these entries all but the
> 'upgrade service is there - you must use Registry Editor to delete it)
> Registry entries added:
> HKLM\Software\Microsoft\Windows\Current Version\RUN:
> Dial32 c:\windows\dl.exe
> Dial33 c:\windows\dlm.exe
> Reg32 c:\windows\reg33.exe
> Upgrade Service c:\windows\sxchost.exe
>
> The problem is I can't find HKLM anywhere. HKEY yes, HKLM no.
> We drilled down to the same folder in HKEY with no luck & I'm not sure
> what we would search for to find the offending files.
> Tried HijackThis, Ad-aware, CWShredder, etc. Nothing gets to
> the problem.
> Can anyone shed some light on this? Many thanks from both of
> us!


Unless you have a really thorough grasp of HijackThis, you should submit it
to an "expert's" evaluation. There's a site, www.pcguide.com where a few of
the tech geeks could do that for you.

Mark Mandell


 
Reply With Quote
 
Lloyd Jones
Guest
Posts: n/a
 
      05-22-2004
Download CWShredder I guarantee if it will fix it.

LJ


 
Reply With Quote
 
Wizard
Guest
Posts: n/a
 
      05-22-2004
Have you tried "add remove software"?

Whodat wrote:
>
> Hello to all -
>
> I'm trying to help a friend out (without much luck, sadly). He
> got his computer hijacked & can't figure out how to get rid of the
> problem. Hie start page now goes to Gets sent to
> SIChttp://your-searcher.com/index.htmSIC (sic added to kill the link).
> I've done a search & found what seems to be similar complaints
> that have to do with a bunch of .exe & htm files, not all of which we
> found on his computer. We deleted the ones we could find, but I think
> there is something in the registery we need to get rid of & I can't
> find it. The advice I found is as follows:
> (run MSCONFIG and uncheck these entries all but the
> 'upgrade service is there - you must use Registry Editor to delete it)
> Registry entries added:
> HKLM\Software\Microsoft\Windows\Current Version\RUN:
> Dial32 c:\windows\dl.exe
> Dial33 c:\windows\dlm.exe
> Reg32 c:\windows\reg33.exe
> Upgrade Service c:\windows\sxchost.exe
>
> The problem is I can't find HKLM anywhere. HKEY yes, HKLM no.
> We drilled down to the same folder in HKEY with no luck & I'm not sure
> what we would search for to find the offending files.
> Tried HijackThis, Ad-aware, CWShredder, etc. Nothing gets to
> the problem.
> Can anyone shed some light on this? Many thanks from both of
> us!

 
Reply With Quote
 
Trent©
Guest
Posts: n/a
 
      05-23-2004
On Sat, 22 May 2004 12:51:09 +0100, "Lloyd Jones" <@yahoo.com> wrote:

>Download CWShredder I guarantee if it will fix it.
>
>LJ
>


He already tried it.

What kind of guarantee were you offering? LOL

CWS is a good program...but it won't get rid of many trojans and
virii.


Have a nice week...

Trent©

Follow Joan Rivers' example --- get pre-embalmed!
 
Reply With Quote
 
Lloyd Jones
Guest
Posts: n/a
 
      05-23-2004
I guarantee if he has spyware maleware etc. it will get rid of it. Anyway
what makes you think he defiantly has a viri Trojan? MacAfee or Norton AV
is the best out there so if you haven't any spy I suggest you buy one of the
Anti Virus software I listed above. I know there is a lot of people that
don't like any Norton's products in here but NAV 2004 is very good, im sure
some one will post some thing negative about it so carry on.

LJ


 
Reply With Quote
 
ProfGene
Guest
Posts: n/a
 
      05-23-2004
I had that happen and got fed up with trying to fix it so I installed Opera
which did not get hijacked. I finally had another problem which required
doing a recovery which did get rid of it.
"Whodat" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Hello to all -
>
> I'm trying to help a friend out (without much luck, sadly). He
> got his computer hijacked & can't figure out how to get rid of the
> problem. Hie start page now goes to Gets sent to
> SIChttp://your-searcher.com/index.htmSIC (sic added to kill the link).
> I've done a search & found what seems to be similar complaints
> that have to do with a bunch of .exe & htm files, not all of which we
> found on his computer. We deleted the ones we could find, but I think
> there is something in the registery we need to get rid of & I can't
> find it. The advice I found is as follows:
> (run MSCONFIG and uncheck these entries all but the
> 'upgrade service is there - you must use Registry Editor to delete it)
> Registry entries added:
> HKLM\Software\Microsoft\Windows\Current Version\RUN:
> Dial32 c:\windows\dl.exe
> Dial33 c:\windows\dlm.exe
> Reg32 c:\windows\reg33.exe
> Upgrade Service c:\windows\sxchost.exe
>
> The problem is I can't find HKLM anywhere. HKEY yes, HKLM no.
> We drilled down to the same folder in HKEY with no luck & I'm not sure
> what we would search for to find the offending files.
> Tried HijackThis, Ad-aware, CWShredder, etc. Nothing gets to
> the problem.
> Can anyone shed some light on this? Many thanks from both of
> us!



 
Reply With Quote
 
Whodat
Guest
Posts: n/a
 
      05-23-2004
On Sat, 22 May 2004 04:10:43 GMT, "Brad Griffis"
<(E-Mail Removed)> summoned the strength to type:

>HKLM stands for HKEY_LOCAL_MACHINE.


(sheepishly) Right. I knew that. D'oh! Well, then we did that
& none of the files exist.

When you use Ad Aware, etc. be sure to
>download the latest updates. After you've updated Ad Aware, anti virus,
>etc. you should reboot your system to Safe Mode. You can get into Safe Mode
>by hitting F8 repeatedly at startup (right after the BIOS screen). Once
>you're booted to safe mode you should scan the system with all those
>programs to clean out all the junk.


So we should run Ad Aware in safe mode?
>




>Another good thing to do is to just use the "Add/Remove Programs" feature in
>Windows to get rid of as much crap as possible.
>
>Brad
>
>
>"Whodat" <(E-Mail Removed)> wrote in message
>news:(E-Mail Removed).. .
>> Hello to all -
>>
>> I'm trying to help a friend out (without much luck, sadly). He
>> got his computer hijacked & can't figure out how to get rid of the
>> problem. Hie start page now goes to Gets sent to
>> SIChttp://your-searcher.com/index.htmSIC (sic added to kill the link).
>> I've done a search & found what seems to be similar complaints
>> that have to do with a bunch of .exe & htm files, not all of which we
>> found on his computer. We deleted the ones we could find, but I think
>> there is something in the registery we need to get rid of & I can't
>> find it. The advice I found is as follows:
>> (run MSCONFIG and uncheck these entries all but the
>> 'upgrade service is there - you must use Registry Editor to delete it)
>> Registry entries added:
>> HKLM\Software\Microsoft\Windows\Current Version\RUN:
>> Dial32 c:\windows\dl.exe
>> Dial33 c:\windows\dlm.exe
>> Reg32 c:\windows\reg33.exe
>> Upgrade Service c:\windows\sxchost.exe
>>
>> The problem is I can't find HKLM anywhere. HKEY yes, HKLM no.
>> We drilled down to the same folder in HKEY with no luck & I'm not sure
>> what we would search for to find the offending files.
>> Tried HijackThis, Ad-aware, CWShredder, etc. Nothing gets to
>> the problem.
>> Can anyone shed some light on this? Many thanks from both of
>> us!

>


 
Reply With Quote
 
Whodat
Guest
Posts: n/a
 
      05-23-2004
On Sat, 22 May 2004 05:44:37 GMT, "mark mandel" <(E-Mail Removed)>
summoned the strength to type:


>
>Unless you have a really thorough grasp of HijackThis, you should submit it
>to an "expert's" evaluation. There's a site, www.pcguide.com where a few of
>the tech geeks could do that for you.
>
>Mark Mandell
>


Thanks Mark. I'll check it out.

 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Hijacked after update!?!?!? dimestore Firefox 7 02-20-2006 12:58 AM
Atolotl hijacked my Yahoo homepage? Motorhead Lawyer Firefox 8 01-13-2005 02:07 PM
hijacked! sligo Firefox 2 11-08-2004 02:34 PM
Weatherunderground site hijacked in FF 0.8 Dan Firefox 9 10-18-2004 04:48 PM
Outlook Express and Internet Explorer hijacked by a file somewhere on my computer. Arawak Computer Support 5 03-07-2004 04:18 PM



Advertisments