Unable to get Microsoft, Mcafee or Google page

  Big Dave 20002 17:25 01 Mar 06

Hi folks,
Please help.

I had a serious crash and now have it all back and running EXCEPT I cannot get Google.co.uk to be my homepage. (Though it always worked before) I cannot access either Microsoft.com (for updates etc) or Mcafee.com (To renew my Virus scan) I seem to have lost my access to my Recent Money files and can only open archived copies.
My Comp. is a 1.3 Athlon: 1000M Ram.. Running Windows XP Home. Service pack 2.
I have run all my other spyware tools including SpyBot, Ad-Aware etc. I use an ethernet 10/100 connection and use both Internet Explorer and Mozilla. The problem occurs on both.

PLEASE help as I am pulling what little hair I have left out.

Thank you in anticipation,


  Gongoozler 17:26 01 Mar 06

What is set as your home page in IE?

  Diodorus Siculus 17:30 01 Mar 06

click here
Repair IE maybe

click here
scannow sfc - how to use SFC.EXE (system file checker)

  Big Dave 20002 17:38 01 Mar 06

Thank you guys.
Mozilla set to click here
IE set to click here

Google still will not open on IE.

Checking the link Diodorus. Thanks

  VoG II 17:44 01 Mar 06

Use HostsToggle click here to disable HOSTS.

  bruno 18:26 01 Mar 06

Whih ISP do you use.My mate had a similar problem on AOL and the only way we could cure it was a reinstall of windows xp.A bit drastic,I know,but we wasted days trying other methods.Tried getting advice here but nothing worked.

  Big Dave 20002 01:19 02 Mar 06

Hi Folks. You are all VERY helpful. I appreciate it.
Bruno. Yes I am on AOL. Hate them!!!! I hope it does not come to a complete reinstall.

Gang....& Diod.. I have reinstalled IE and Mozilla. No change.

I am currently trying to follow the instructions for scannow.

I'll let you all know what happens,

Thanks again


  Gongoozler 10:06 02 Mar 06

Hi Dave. What happens when you try to change your home page?

The HOSTS file is often used to prevent access to certain sites, sometimes this is done maliciously but it is also useful if you want to prevent some sites being accessed by your computer click here.
It is also possible that some malware has hijacked your browsers. Often this is detected by utilities such as AdAware click here or Spybot S&D click here. If these fail to find anything, then run HiJackThis click here. This will generate a text logfile. Post the log file on this forum (you may need to split it into more than one posting), and we will see if we can spot anything malicious. There are other forums that specialise in interpreting HJT log files, but we can do an initial scan.

  Big Dave 20002 11:51 02 Mar 06

Thank you for the suggestion.

Here are the results. 1 of 2 David
Logfile of HijackThis v1.99.1
Scan saved at 11:47:09, on 02/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\WhiteCanyon\SecureClean 4\scregmanager4.exe
C:\Program Files\WhiteCanyon\SecureClean 4\sctray4.exe
C:\Program Files\WhiteCanyon\SecureClean 4\scwatch4.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\Documents and Settings\marshall\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = click here
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;;<local>
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: PosHelp - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - C:\PROGRA~1\ADVANC~1\ADVANC~1.DLL
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] d:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SecureClean4RegManager] "C:\Program Files\WhiteCanyon\SecureClean 4\scregmanager4.exe"
O4 - HKLM\..\Run: [SecureClean4Tray] "C:\Program Files\WhiteCanyon\SecureClean 4\sctray4.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Cleanup.lnk = D:\onictask.exe

  Big Dave 20002 11:53 02 Mar 06

2 of 2

O4 - Startup: Cleanup.lnk = D:\onictask.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Search Using Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
O9 - Extra 'Tools' menuitem: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - click here
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - click here
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - click here
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - click here
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - click here
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - click here
O17 - HKLM\System\CCS\Services\Tcpip\..\{899DF435-9E4B-4772-BE7C-A66B255496DB}: NameServer =
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - d:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - d:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: SCWatch 4.0 - WhiteCanyon Inc. - C:\Program Files\WhiteCanyon\SecureClean 4\scwatch4.exe

  Gongoozler 15:23 02 Mar 06

Hi David. I've had a look at your HiJackThis log, and can't find anything that, with my limited experience of HJT, looks suspicious. I did observe that you are using AVG antivirus and McAfee firewall, presumably you are not using McAfee antivirus as well. There is no sign of it but I thought I had better mention it because you should never have more than one antivirus.

Your HJT log shows your IE home page is whatis.com. What happens when you try to change it in IE - Tools - Internet Options?

If you can't access certain sites, have a look in C:\WINDOWS\system32\drivers\etc for a file called hosts. Open that file in Notepad. See if the inaccessible site is in that file. For information on the hosts file, click here

This thread is now locked and can not be replied to.

The Legend of Zelda Breath of the Wild review: Five hours with Zelda on the Nintendo Switch

1995-2015: How technology has changed the world in 20 years

How the painting-like animated sequences in A Monster Calls were created by Glassworks Barcelona

The 22 best Safari extensions | Best Safari plugins: Improve Apple's Safari web browser with these…