Need Urgent Help

[callum92]

hi my following problems are

homepage-http://www.hotoffers.info (cant be changed)
14 porn icons are showing up on desktop (i remove and they come back-they are web shortcuts)
popups of porn are appearing when im not even on the net
i keep getting error messages saying "download this program...."
whenever i am on a site after a few mins it will change to porn

i dont know how it started but my pc has been hi jacked and i use adaware pro,xoftspy,avg and norton and it still hasnt cured the pc


thanks in advance

[mclaren101]

Dude u got hacked badly or got a big ass virus.

[animesh]

dis cud b anythin but few things u can try r...

delete ur temporay internet files, manually, not thru internet explorer. that way u might find sum files tht cant u deleted n u'll hav ur culprit.

go2 windows task manager (Crtl+Alt+Delete) and end any processes which u dnt need or suspect 2 b spyware/adware.

run a scan with trend micro pc-cillin. i found their internet security 2005 package to very good, gives u the exact location of the file messing with ur comp.

run a trojan scan.

delete all files from ur temp folder.
hope it helps.

Cheers

[callum92]

Originally Posted by animesh

dis cud b anythin but few things u can try r...

delete ur temporay internet files, manually, not thru internet explorer. that way u might find sum files tht cant u deleted n u'll hav ur culprit.

go2 windows task manager (Crtl+Alt+Delete) and end any processes which u dnt need or suspect 2 b spyware/adware.

run a scan with trend micro pc-cillin. i found their internet security 2005 package to very good, gives u the exact location of the file messing with ur comp.

run a trojan scan.

delete all files from ur temp folder.
hope it helps.

Cheers

didnt seem to work
this virus or whatever it is is really intelligent

[bookworm]

callum92 read the sticky XP solutions at begining of Windows XP also turn off System Restore start in safe mode and run all your security checks again ( make sure their all updated ) Hope this helps.

[callum92]

ive done everything and i still have the hot offers hi jack

here is my process:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Smart Protector Pro\SmartProtector-Pro.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\callum\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/066/
O1 - Hosts: 127.0.0.3 www.greg-tut.com
O1 - Hosts: 127.0.0.3 nylonsexy.com
O1 - Hosts: 127.0.0.3 www.nylonsexy.com
O1 - Hosts: 127.0.0.3 vparivalka.com
O1 - Hosts: 127.0.0.3 www.vparivalka.comtoescrowpay.com
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 iframe.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 newiframe.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 pizdato.biz
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O1 - Hosts: 127.0.0.3 www.awmcash.biz
O1 - Hosts: 127.0.0.3 awmcash.biz
O1 - Hosts: 127.0.0.3 buldog-stats.com
O1 - Hosts: 127.0.0.3 www.buldog-stats.com
O1 - Hosts: 127.0.0.3 fregat.drocherway.com
O1 - Hosts: 127.0.0.3 slutmania.biz
O1 - Hosts: 127.0.0.3 www.slutmania.biz
O1 - Hosts: 127.0.0.3 toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.megapornix.com
O1 - Hosts: 127.0.0.3 megapornix.com
O1 - Hosts: 127.0.0.3 www.sp2fucked.biz
O1 - Hosts: 127.0.0.3 sp2fucked.biz
O1 - Hosts: 127.0.0.3 greg-tut.com
O1 - Hosts: http://213.159.117.133/dkprogs/hosts.txt
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [SPSTEALT] "C:\Program Files\Smart Protector Pro\SmartProtector-Pro.exe" /stealt
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

i have deleted the ones that are like :sex and porn: but nothing has changed

[Cinsam]

Originally Posted by callum92

hi my following problems are

homepage-http://www.hotoffers.info (cant be changed)
14 porn icons are showing up on desktop (i remove and they come back-they are web shortcuts)
popups of porn are appearing when im not even on the net
i keep getting error messages saying "download this program...."
whenever i am on a site after a few mins it will change to porn

i dont know how it started but my pc has been hi jacked and i use adaware pro,xoftspy,avg and norton and it still hasnt cured the pc


thanks in advance

Cinsam
your computor has been highjact with programs and active x controlers
1 Download microsft AntiSpyware Beta1 Which is free from the microsoft download centre
2 download from pcworld.com Spyware doctor trialware which is very good
3 Get Norton Internet security 2005 and keep it updated
4 Downloan microsoft basline security analyzer 1.2.1 this will test your security and its free
5 scan your PC dayley
6 KEEP WINDOWS UPDATED
The web is good and full of information but dangerouse
I wish you all the best Cinsam

[Flaxen]

I found a fix to remove this here:

How to remove www.jimbutt.com and www.hotoffers.info / hotoffers infection

Hope this helps some of you as i had the same problem and found it after ivsitng here earlier.