robby

Help - my homepage has been hijacked, i can't get onto the internet (other computer) as i keep getting the sys32 page as my homepage has been taken over.
I also seem to be sending hundreds of emails out to addresses i don't know (norton tells me this)

How can i stop this and get back to normal (i can't dowload any virus scans as i can't connect the comp to the internet)

Scooby-Doo

Can you expand on homepage and how can you send email if you can't connect to the internet ?

robby

i can't connect to any of my websites, also if i try to connect to my homepage (ntlworld.com) it won't let me

the emails are just sending themselves - even though outlook express isn't open?

FlightMan

1. Sys32 is a sysmpton of any number of virus'. Run AV and any anti spyware you have, and pray your definitions are upto date.
2. If you can't get on the net, how do you know your "homepage" has been hijacked?
3. If you can't get on the net, how can you send emails?

I think your confused.

Scooby-Doo

How do you connect to the net. If you think you are on do start run then type cmd to bring up the dos command. Try a simple ping to www.yahoo.com

If it pings your online and you may find ie has the problem, if it is IE it is more than likely the firewall is blocking data on IE.

robby

Well i think more by luck than anything i seem to have an improvement, my homepage is now ntlworld again and doesn't keep getting reset and my OE6 seems to be ok.
I still have a problem when i switch the computer on - i get a box with the message saying C:\windows\inet20010\winlogon.exe cannot be found?
i close this box, it opens again, i close it then i get another message saying soething like (can't remember the exact message now) 001934 application cannot be started? i close this box and XP loads up fine?

Alan C

Have you tried a system restore to an earlier time prior to the Hikack..? Cannot find Winlogon is possibly (amongst other things) a Trojan... As suggested, try running an up to date Spyware & AV scan. If nothing's found try a restore.

start>accessories>system tools>system restore

robby

It wont let me do a restore

scoobie-shieldy

nope it wont allow u, as part of the trojan resides in their

u gonna have too d/l a decent virus/trojan scanner from another pc put it on disc

then run your infected comp in safe mode. b sure too turn of the restore option on all drives when u do this

but if all else fails last resort is too reformat and reinstal from a fresh slate

doobiedoo

It sounds as though your AV software (do you have any?!) or something on the pc has attempted to clean up the virus. The message you are getting about "C:\windows\inet20010\winlogon.exe" was almost certainly the virus (or part of the virus) itself.

Winlogon.exe is a valid windows component but it should not be in the "inet20010" folder. This file is probably some kind of backdoor or trojan which has been named "winlogon.exe" in an attempt to hide it. The reason for your pop up message complaining about it is due to a registry value calling this exe at start up. You could rip this out of the registry manually but an anti spyware program should do it for you if it recognises the problem.

Try Adaware or Microsoft Anti Spyware Beta Edition is very good too.....

If these don't work, let me know and we'll try the manual removal.....

Edited to say.....

http://virusinfo.prevx.com/pxparall....C=965e12272540 This looks like the puppy thats got you!

http://info.prevx.com/downloadremove.asp ...and this says its a removal tool - I'd give the removal tool a go then see how you get on.

robby

Well it had to be done - i did a full format and re-install yesterday and now it's back to normal

Thanks for the help

Norton now installed