http://searchcentral.cc/index.php?v=4&aff=2715

fatrat523 · Cadet Joined: Dec 22, 2003 Posts: 8 Location: Canada

what is wrong with my ie
hijack this can get rid of me going to the site
http://searchcentral.cc/index.php?v=4&aff=2715
but when i restart, its there again
can anyone help me fix this?

helpless · Posted: Fri Apr 23, 2004 6:58 am Post subject:

Download : HiJack This! from http://computercops.biz/downloads-cat-14.html

Create and Unzip to a folder, not your Desktop or the Temp folder, doubleclick HijackThis.exe, and hit "Scan".
When the scan is finished, use "Save Log" button, save the log in a text file,
and post it here http://computercops.biz/forum67.html

DO NOT FIX ANYTHING YOURSELF NOW, JUST WAIT FOR AN EXPERT TO HAVE A LOOK AT YOUR LOG

you will probably have to delete some files and folders where the little bastederd nestet himself

some-extra

In Hijack This, press "Config" > "Miscellaneous Tools".
Under the "Generate Startuplist log" button, check the "List also minor sections" box.

Now press "Generate Startuplist Log"
This will generate a text file that will list all applications that are loaded from practically every known startup location.

trigger77 · Cadet Joined: May 30, 2004 Posts: 1 Location: Canada

run regedit.exe and go to:HKEY_CURRENT_USER/Software/Microsoft/Internet Explorer/Main, and change any fields related to "search central" ( i had this problem too.)

Ilah · Cadet Joined: Jun 10, 2004 Posts: 2 Location: England

These are all the files I have found to do with searchcentral.cc. Kill em all. This will stop them from intruding on you start page, randomly rerouting your search results in google etc and sending details of your network connections, comp details etc (Oh yeah their doing that to)

MSHTA.EXE-07121ECA.pf
TKSRV98.EXE-07A080D0.pf
WSCRIPT.EXE-0C5C5251.pf
U070104.EXE-2B501C08.pf
tmksrvu98.exe
tmksrvu.exe (hidden)
u070104.exe
update12.js
c:/windows/nsdb/hosts delete folder and file (hidden)
xplugin.dll (hidden)

In reg change hkcu/software/microsoft/internet explorer/main search page, start page, setHP, search bar to what you want including the hex number 49.....blahblah
Delete hkcu(hklm)/software/TMKsoft

in the restricted sites zone put (don't click on just copy and paste)

http://81.211.105.69
http://81.211.105.68
http://81.211.105.49
http://69.31.86.21
http://63.219.181.7
http://searchcentral.cc
http://buysearch.cc
http://homesearch.cc
http://www.coolwwwsearch.com
http://allhyperlinks.com
and some others

Happy (without searchcentral) Net surfing

Ilah xx

verden · Cadet Joined: Jun 15, 2004 Posts: 2 Location: Netherlands

There is another thing you should do next to the things listed above.

After finishing the stept above en reboot, you may notice that you're startpage is still our beloved searchcentral. To remove this you'll have to finish these last to steps:
1.) open regedit en go to: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
there you delete de underlaying entry : tlc = C:\WINDOWS\update12.js
This is a javascript that will keep changing you home and searchpage to searchcentral.
2.) Next step is to delete this file ( update12.js) from c:\windows\

there should extually also be a third step and that is : install a good firewall Exclamation

have fun

grtz
Verden

verden · Cadet Joined: Jun 15, 2004 Posts: 2 Location: Netherlands

Well I see now that I didn't read the posting of Ilah good enough, because Ilah already mentioned the javascript file.

ah well, atleast now we also got rid of the reg entry Very Happy

grtz
Verden


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 722 pages served in previous 5 minutes. Page Rendered: 0.443 seconds.