This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

IE hijacked by http://www.yifawatch.net/... how to get rid??

2 min read

This thread's last reply is from March 29, 2010, 11:09 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Hi,

It seems the windows internet explorer has been hijacked, the website goes to the home psge hxxp://www.yifawatch.net/ of which nothing comes up. On my desktop there is also an extra IE icon which when deleted pops back up again. I have backed up all my stuff and deleted virtually everything and still no joy so can you please help? Here is a post of hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:07:51 PM, on 3/25/2010
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Wireless LAN Utility\TIWLANCu.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\msncfgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Wireless LAN Utility\tiwlnsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yifawatch.net
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TI WLAN] C:\Program Files\Wireless LAN Utility\TIWLANCu.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MSNConfig] C:\WINDOWS\System32\msncfgs.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O23 - Service: TI Wlan Service (tiwlnsvc) - Unknown owner - C:\Program Files\Wireless LAN Utility\tiwlnsvc.exe

--
End of file - 1584 bytes



Thanks
Can you tell us why you are using Windows XP with no Service Packs installed?
I didnt know no service packs are installed, as i dont use the desktop myself but my parents do.
help?
I'm sorry, but no Service Packs installed means that the computer has been unable to receive security updates from Microsoft since October of 2006. Basically, that means that it has been a "sitting duck" for any and all malware. There is no point in attempting to clean up this computer. Without Service Packs installed, it can't be secured, and without it being secured, it will be reinfected as fast as it's cleaned up.

You will need to reformat the hard drive and reinstall the operating system, then make sure you immediately get the appropriate Service Packs installed as well as all additional security updates. You will also need to set the computer to receive automatic updates from Microsoft, which will include a later version of Internet Explorer. Internet Explorer 6 is not secure.

Prior to reformatting, you should make sure that you have an antivirus product ready to install. You can download a free one, such as avast!, AntiVir, or Microsoft Security Essentials. Just download it to a known clean computer and burn it to a CD so you have it available to install after you've reinstalled the operating system. You will also need your Windows XP installation disk, and the disk for installing the system's drivers. These disks should have come with the computer. Some computers, however, are sold with only a restore partition. If you cannot find the installation disks, and your computer does not have a restore partition, then you will need to contact the computer's manufacturer and purchase the needed disks from them. Usually, they can be obtained from the manufacturer for a reasonable price.
As the resolution of this issue requires a reformat, and there have been no questions posted regarding that process, this topic is now closed.