MyTechSupport.ca :: Your Computer Technical Resource Headquarters! MyTechSupport.ca :: Your Computer Technical Resource Headquarters!
HOME FORUMS RESOURCES & TOOLS ARTICLES ONLINE STORE ABOUT US
Computer Support Forums arrow Internet & Network Support arrow Security & Viruses arrow Topic: MYPOISKOVIK CURE WIN XP PRO
June 19, 2019, 01:47:09 AM
 

Home Forum Rules Help Search Mobile Version Login Register

Welcome, Guest. Please login or register.
Did you miss your activation email?
June 19, 2019, 01:47:09 AM

Login with username, password and session length
 
News
New  We now offer MyTechSupport.ca Merchandise! Every purchase goes towards maintaining our site.
Thank you for supporting MyTechSupport.ca!
  0 Members and 1 Guest are viewing this topic.
Pages: [1] Go Down Print
Author Topic: MYPOISKOVIK CURE WIN XP PRO  (Read 1204 times)
foxconsult
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 5


Bookmark and Share

View Profile
« on: May 27, 2004, 02:27:06 AM »

PLEASE SUPPLY RELEVANT INFORMATION:
Operating System Version: WIN XP PRO
Problem Application Name & Version: MY(F#@$#)POISKOVIK
Problem Hardware Make & Model: n/a
Error Messages: Home Page Hijacked To mypoiskovik.com and WINMIN TSR ****.



Had major problem with homepage being hijacked to mypoiskovik.com and some WINMIN.EXE staying resident and hanging on shutdown and FOUND SOLUTION.

After reinstalling WinXP and Reading every post I finally figured out what was going on through a very long and serendipitous chain of events I won't begin to recount.

BOTTOM LINE: WINLOGIN.EXE is the culprit!!!!!!!!!!!!!!!!!!

This file gets copied into the C:\DOCUMENTS AND SETTINGS folder for the user unfortunate enough to catch this bad boy.

It gets stuck in the PROGRAMS\START folder and is readonly and won't let you delete it unless you are in SAFE MODE.

I believe (IMHO) that winlogin.exe is constantly running and hijacking everyone's home page no matter how many times they run hijackthis or cool web shredder or spyware eliminator or ad-aware because winlogin.exe just keeps putting back the evil settings (favorites and homepage) that's driving everyone nuts.

The thing I think they are doing that the author thinks is cute is naming it winlogin.exe in the first place because there is a real file called WINLOGON.EXE that is necessary for windows to operate.

So I would do the following to fix this bull goose loony...

See if you have 1 or more copies of winlogin.exe in your c:\documents and settings folder hierarchy... just run a search and be sure it can search all subfolders.

If you find winlogin.exe you have the same problem I did.

Then fixing it is a snap.

Restart in safe mode.

Delete all copies of winlogin.exe your search finds.

Run your Cool Web Shredder and HiJackThis and Ad-Aware stuff and kill any references to mypoiskovik.

Go into IE and delete any unwanted favorites and make sure you set your homepage to something you want or blank.

Empty your recycle bin.

Reboot.

That should fix it.

If it doesn't then maybe you have another malware program (other than winlogin.exe) resetting your home page and favorites.

If this helps one person avoid the 5 days I spent on this problem I will be happy and THANKS TO ALL WHO HAVE POSTED!!!! I COULD NOT HAVE FIGURED THIS OUT WITHOUT THEIR HELP!!!!







Logged

The MYPOISKOVIK IS DRIVING ME MAD!
Pages: [1] Go Up Print 
 
Jump to:  

Powered by MySQL Powered by PHP

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines

Valid XHTML 1.0! Valid CSS!

Disclaimer
This site is NOT responsible for any damage that the information on this site may cause to your system. Everything you try, whether inspired by the response given from this site or not, is entirely at your own risk. All product names and company names used herein are for identification purpose only and may be trademarks or registered trademarks of their respective owners. We are in no way affiliated or representing any of the companies on this site unless specified.
Back to Top
Stop Spam Harvesters, Join Project Honey Pot Fight Back Against Spammers! Get Firefox! Get Thunderbird! View Sylvain Amyots profile on LinkedIn
Back to Top
Google visited last this page November 25, 2018, 05:19:01 AM