Gladiator Security Forum > Repeated Browser Hijack Attempts!!

Full Version: Repeated Browser Hijack Attempts!!

Gladiator Security Forum > Malware Help Forum > HELP! Think you are Infected?

English_brit

May 25 2004, 07:51 PM

For a few weeks now I've been bugged by a repeated hijack attempt that tries changing my IE homepage to www.msn.com.

I often scan for spyware using Adaware and keep on finding the same spyware that's been causing the problem. My problem is figuring out how it's getting back on my system all the time, which is where I need some help.

I play a game on msn's network called "The Zone" @ www.zone.msn.com. When this spyware is present it makes me lag like crazy when I go in to one of the game rooms, which never happened until I started finding the spyware reference repeatedly popping up in my adaware scans. I also have problems on Gamespy when I try playing on there aswell if the same spyware is present.

Before I go on I'll state I have carried out a full virus scan using an uptodate Mcafee scanner and found no viruses\trojans present.

I also use MSN messenger whenever I go online. Don't ask me why but I've got a hunch it might have something to do with messenger although I'm not certain. I've been using Messenger for years and never encountered this problem before. Anyway I'm kind of going off at a tangent. I'll detail the exact problem and show my hijackthis log.

Here's my Adaware scan results.

QUOTE

Vendor

Possible Browser Hijack Attempt

Object HKEY_USERS:Default\Sotware\Microsoft\Internet Explorer\Main"Start Page" ("about blank")

Vendor

Possible Browser Hijack Attempt

Object HKEY_CURRENT_USER:Software\Microsoft\Internet Explorer\Main"Start Page" ("about blank")

Vendor

Tracking Company

c:\windows\cookies\peter@promo.match[2].txt

Once these results come up I send them firstly to quarantine, prior to deletion.

As soon as I quarantine them I get a warning message from Spyware Blaster telling me that spyware has changed my home page to www.msn.com and giving me the option of restoring my original home page address (about: blank) or keeping the new one. I always restore the original home page.

Anyway, this happens every time I send the spyware to quarantine.

Then after that's happened I go to quarantine and delete the spyware permanently off my system.

I then went back online and signed in to MSN Messenger. Then ran the Adaware scan again only to find the same spyware was already back on my system.

I'm not a newbie when it comes to removing spyware and I know what I'm doing and have never had any problems scanning or removing spyware before. Just in case anyone's wondering. Somehow it's getting back on my system but I'm not sure how.

I don't know if this is a related issue or not but I've also got SpywareGuard installed and this keeps on crashing, often when I sign in or out of MSN Messenger resulting in the following error.

"Run-time error "429"

Active X component can't create object

then goes on to say,

Sgmain has caused an error in unknown.

I recently changed my ActiveX controls due to the advice in one of you're articles, maybe it's related to that although I'm not sure.

Anyway here's my current HIJackThis log:

QUOTE

Logfile of HijackThis v1.97.7
Scan saved at 20:50:45, on 25/05/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\CSAFE\AUTOCHK.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSFTSN.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\78c8m9zb.slt\prefs.js)
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ConfigSafe] C:\CSAFE\AUTOCHK.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [RegShave] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKCU\..\Run: [-- not allowed here --] "C:\PROGRAM FILES\-- not allowed here -- P2P CLIENT\-- not allowed here --.EXE" -h
O4 - Startup: E-Color.lnk = C:\Program Files\E-Color\Registration\SonnReg.exe
O4 - Startup: 3Deep.lnk = C:\Program Files\E-Color\3Deep\3Deepctl.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

Thanks for any help!!

Hunter

May 25 2004, 08:16 PM

Hey Brit,

This statement you made.."I often scan for spyware using Adaware and keep on finding the same spyware that's been causing the problem. My problem is figuring out how it's getting back on my system all the time, which is where I need some help."

Has some recent adaware history...you see adaware is the one changing your home page to msn....and the about:blank is not really a problem for you..

English_brit

May 25 2004, 08:32 PM

Hey. :)

Are you sure it's Adaware doing it? I've had adaware for ages and it's never happened before. Any idea how I can stop it doing it?

Thanks.

Hunter

May 25 2004, 08:41 PM

To explain to you what is happening.. please read these two links :thumb:

hijackthis. adaware false positive?Should I ignore

http://www.dslreports.com/forum/remark,10211003~mode=flat

Adaware 6 - Help please ?

http://www.dslreports.com/forum/remark,103...?hilite=adaware

Does all that seem familiar ?

Hunter

May 25 2004, 08:46 PM

Lavasoft Knowledge Base Article 04051801

about:blank Presented By Ad-aware

--------------------------------------------------------------------------------

SYMPTOM

During an Ad-aware scan, about:blank is presented in the results list, and is shown in the logfile. An example entry from the logfile is shown:

Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainStart Pageabout:blank

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "about:blank"
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "about:blank"

Selecting the about:blank listings in the results list causes the homepage and search pages to change from about:blank to the default settings of the Microsoft Internet Explorer web browser, which are currently to The Microsoft Network (MSN) main page.

CAUSE

Several variants of CoolWebSearch are using about:blank to hijack web broswers to their sites. Therefore, about:blank is now presented in the results list for review. Its listing is "Possible browser hijack attempt" in reflection that the listing of this item in the results list may be or may not be entries made by a browser hijacker.

RESOLUTION

Users that knowingly have about:blank set as their homepage, and have no issues with a homepage hijack, can prevent this item from being presented on future scans by checking the box next to listings indicating about:blank, then right-clicking one of the checked items, and then choosing "Add selection to ignorelist."

Users that have a CoolWebSearch variant present on their system that wish to remove it completely can select the CoolWebSearch items, along with the about:blank listings, to fully remove the variant, and its changes, from their systems.

http://www.lavahelp.com/articles/v6/04/05/1801.html

English_brit

May 25 2004, 09:07 PM

Thanks. Read through them all. Was a bit like "Deja Vu". lol

I appreciate the help. Great site. Although this is the first time I've posted I've used the forums before. Really helpful forum. Keep up the good work. :)

Hunter

May 25 2004, 09:29 PM

Well do not be a stranger :) if you have anymore questions..I will keep this thread open.

Hunter

May 25 2004, 09:58 PM

BTW..I see this in your log..

O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P Client\warez.exe" -h

but i do not see the usual other entry of...

C:\Program Files\Warez P2P Client\warez.exe" -h

Do you have a need for it ??

English_brit

May 27 2004, 06:36 AM

I use that program. Yes.

Hunter

May 27 2004, 07:18 AM

QUOTE (English_brit @ May 27 2004, 01:36 AM)

I use that program. Yes.

OK Wave.gif

Warez P2P

After I installed and ran the Warez P2P client, my machine got soaked with viruses. I used the uninstall, but the program left all its directories, registry entries, and startup icons. Avoid at all costs! Use Kazaa or something better instead

http://download.com.com/3302-2196_4-10259337.html

English_brit

May 27 2004, 08:41 AM

I've got a trojan which I've posted about in this forum aswell. Thinking about it I might well have got the trojan not long after I installed the -- not allowed here --P2P. Thanks for the post, I think I'll try uninstalling the program.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.