analyze
- Thread starter chuckles
- Start date
- Status
These look suspicious:
C:\PROGRAM FILES\PARTYPOKER\PARTYPOKER.EXE
C:\WINDOWS\STARTER.EXE
C:\VEXPLITE\MONLITE.EXE
And I think this has hijacked your IE:
C:\PROGRAM FILES\BLUELIGHT INTERNET\EXEC.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mybluelight.com/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mybluelight.com/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mybluelight.com/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mybluelight.com/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mybluelight.com/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.mybluelight.com/s/search?r=minisearch
C:\PROGRAM FILES\PARTYPOKER\PARTYPOKER.EXE
C:\WINDOWS\STARTER.EXE
C:\VEXPLITE\MONLITE.EXE
And I think this has hijacked your IE:
C:\PROGRAM FILES\BLUELIGHT INTERNET\EXEC.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mybluelight.com/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mybluelight.com/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mybluelight.com/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mybluelight.com/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mybluelight.com/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.mybluelight.com/s/search?r=minisearch
Blue light is my ISP and start page so isnt that possible it will show up some where in there like it does?
Party poker is where I go to play poker.
This happened just recently when I sighned into yahoo messenger....I checked my archives as what appeared to be an offline msg and this is what I received......This ID Hacked by : Magic-PS v1.5 SE++ ===> USER=.....with my name and password here........up til this time.....I had no problems at all......I followed instructions from another of your threads to the letter....but each time I log into messenger I get this message.....anything else you can suggest.....or anything else I can try and install to remove wherever it has attached itself to?
Party poker is where I go to play poker.
This happened just recently when I sighned into yahoo messenger....I checked my archives as what appeared to be an offline msg and this is what I received......This ID Hacked by : Magic-PS v1.5 SE++ ===> USER=.....with my name and password here........up til this time.....I had no problems at all......I followed instructions from another of your threads to the letter....but each time I log into messenger I get this message.....anything else you can suggest.....or anything else I can try and install to remove wherever it has attached itself to?
- Status
Similar threads
