Removing Gigasearch.biz Homepage

Printable View

October 17th, 2004, 07:34 AM
zahidhafeez

Removing Gigasearch.biz Homepage

Hi !

I am having a strange problem which I am unable to resolve. Whenever I open my Internet Explorer, it takes me to "http://www.gigasearch.biz/?134". To change my homepage I have made several attempts i.e. editing / removing the entry in the registry (which reappears automatically in two to three seconds) and changing the homepage in Internet Explorer's properties but was unable to do so.

I have Norton Internet Security 2005 and Ad-Aware SE installed on my machine but this item is not traceble by either of the software. Operating System Windows XP Pro with SP-2 and all the latest updates are also installed. I started facing this problem after reinstalling windows. Please help me in removing this.

Secondly, I want to run Zone Alarm Pro, but the problem with that is it does not allow MS Outlook 2003 to download emails, please also advise in this regard.

Regards,
October 17th, 2004, 07:48 AM
Soda_Popinsky

You've got some malware, specifically a browser hijack.

Run through this:
http://www.antionline.com/attachment...achmentid=4913

If the problem still exists, post again.

Make sure you follow each step properly, make sure everything you scan with is updated.

Quote:

I started facing this problem after reinstalling windows. Please help me in removing this.

You do realize that a format of Windows would remove all patches and service packs? Did you update after the install? You probably didn't actually update after the format, or you visited a malicious site between the format and the updates.

Regarding Zone Alarm:
Zone Alarm and SP2 don't get along very well. Consider the Windows firewall, or finding an upgrade of ZA?
October 17th, 2004, 08:45 AM
zahidhafeez

As per guidelines in that document, I scanned the entire system but was not able to remove that gigasearch.biz

Moreover, once I installed the windows, I did update all the updates including service packs for windows and virus definitation.
October 17th, 2004, 08:57 AM
zahidhafeez

As per document, I am attaching the txt files for your review and advice.

Regards,

Zahid Hafeez
October 17th, 2004, 03:43 PM
Soda_Popinsky

Open up Hijack This in safe mode, check and remove these entries.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gigasearch.biz/?134
R3 - URLSearchHook: GStartBHO Class - {EADD3112-0CF8-444b-AC0F-EBA38E004554} - C:\WINDOWS\Downloaded Program Files\giga32.dll
O2 - BHO: GStartBHO Class - {EADD3112-0CF8-444b-AC0F-EBA38E004554} - C:\WINDOWS\Downloaded Program Files\giga32.dll
O3 - Toolbar: GIGA Search - {D941BEA3-81E9-4033-8822-A733E2A91698} - C:\WINDOWS\Downloaded Program Files\giga32.dll

Then reboot normally and tell us the results. If it's fixed, you're done, if it's not, then attach the hijack this log again.
October 17th, 2004, 04:31 PM
slarty

If you're going to reinstall windows, it's vital that you use some kind of hardware or external firewall device, while you're installing updates.

This is because, the time taken for an unprotected windows XP system to be come infected with worms is vastly less than the time taken to fully update it.

So you MUST use an external dedicated or hardware firewall while you update your system. If you can't do so, borrow one from someone else (or take your machine around their house / office) while you do it.

Connecting an unpatched Windows box to the internet is a definite way to have it thoroughly riddled almost immediate.

Slarty
October 17th, 2004, 07:30 PM
zahidhafeez

Thanks Soda for your help and time, but even following the steps you mentioned, I am still not able to remove that. What else you advise?

Regards,
October 17th, 2004, 07:44 PM
zahidhafeez

Sorry I forgot to attach the log file.
October 18th, 2004, 04:59 AM
Soda_Popinsky

Did you restart?

Here are some questionable entries, tell me if you recognize the names, if you use them, or anything you know about them. Don't delete them from HJT yet...

Is this the proxy server you use?
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=192.115.106.236:8080;http=192.115.106.236:8080;https=192.115.106.236:8080

Are you familiar with flipalbum?
O2 - BHO: FlpLauncher Class - {4401FDC3-7996-4774-8D2B-C1AE9CD6CC25} - D:\FlipAlbum 5 Pro\FpLaunch.dll

This has some adware related pages in Google...
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack

Familiar with this?
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun

Do you use something called DesktopX?
O4 - HKCU\..\Run: [DesktopX] "C:\Program Files\Stardock\Object Desktop\DesktopX\DesktopX.exe"

I can't pick out anything specifically, let us know what you know about those entries. You may be hijacked outside the reach of HJT, because there is a lack of information regarding gigasearch online.

groovicus....meeeeee.... where are you? ;)
October 18th, 2004, 05:09 AM
anjali

I think even I faced a similiar problem... My Norton Antivirus was simply unable to reapir the file... Adware was not detecting any foul....

But then somebody from the forum suggested me to download CWShredder

http://www.spywareinfo.com/~merijn/index.html

Incase your infected PC does not allow to reach to the url try the following link

http://209.133.47.12/~merijn/index.html

http://www.softpedia.com/public/cat/...0-17-150.shtml

I recmmend try running this software before formatting ur PC....

Take Care

Kalp
October 22nd, 2004, 09:44 AM
Morvai

Re: Removing Gigasearch.biz Homepage

Quote:

Secondly, I want to run Zone Alarm Pro, but the problem with that is it does not allow MS Outlook 2003 to download emails, please also advise in this regard.

As a firewall I would recommend Kerio Personal Firewall.

I've downloaded it after reading about it in other posts on this forum and it's working great for me so far! I'm also using it in combination with Win XP - SP 2, and it seems to be running without any problems.

You can download it from here:
http://www.kerio.com/us/kpf_download.html
October 22nd, 2004, 03:13 PM
groovicus

You have something I haven't seen before, which means nothing.

Could you post a startup log from HijackThis please? In Hijackthis press the Config Button
Click Misc Tools
Check both boxes under the Generate StartupList log and then click the generate startuplist log button.

Paste the contents into your next reply here, please, and then mark the post as hidden. It is easier to research your post if I can open it in my browser.
October 22nd, 2004, 04:04 PM
MilitantEidolon

Have you tried booting into safe-mode and then try and run the scanner. You should be able to easily locate and delete the files assocc. with it.

- MilitantEidolon
October 23rd, 2004, 03:17 AM
Palemoon

Try a real simple thing goto http://www.mozilla.org then install "Firefox" do not import the bookmarks and say goodbye to IE exploits for now see a few sites testing Firefox, but worst is it crashes but it's the beta send the reports to them.