onemoresearch.com hijack

  • Thread starter Thread starter jeffreywong
  • Start date Start date
J

jeffreywong

This is one headache i cannot solve even trying Mcafee
Spyware, Microsoft Spyware and lavasoft. I clean the
affected file and registry but it will come back after
you open the 2nd browser. Anyone with a solution.
 
Try this:

Download HijackThis from www.majorgeeks.com and install.

Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close
any open browsers. Kill the following processes if they are running in the
task manager:

C:\WINDOWS\ipnx32.exe
C:\WINDOWS\d3tt32.exe

Run a scan in HijackThis. Check each of the following and hit 'Fix checked'
(after checking them) if they still exist (make sure not to miss any):

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {F0B66E90-EAA0-4E15-2336-CC0A96015175} -
C:\WINDOWS\system32\apikn.dll
O4 - HKLM\..\Run: [d3tt32.exe] C:\WINDOWS\d3tt32.exe
O4 - HKLM\..\Run: [tibs5] C:\WINDOWS\System32\tibs5.exe
O4 - HKLM\..\RunOnce: [ipnx32.exe] C:\WINDOWS\ipnx32.exe
O4 - Global Startup: Microsoft Windows.hta
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.static.topconverting.com
O23 - Service: Network Security Service - Unknown - C:\WINDOWS\apiid32.exe
(file missing)

Delete the following Files/Folders (delete folders if no filename is
specified) according to their directory (if none, just do a search for them)
and delete them if they exist:

C:\WINDOWS\ipnx32.exe
C:\WINDOWS\d3tt32.exe
C:\WINDOWS\system32\apikn.dll
C:\WINDOWS\System32\tibs5.exe
Microsoft Windows.hta
C:\WINDOWS\apiid32.exe

Be sure to clean out all temp files and temporary internet files. You may
need to turn off System Restore to clean that out too but wait until after
the next reboot to see if that is needed. Reboot to normal mode and see
what happens.


JohnF.
 
Back
Top