SunQuest
           Antivirus Protection
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Try It Free
Go Back   Dev Shed Forums > System Administration > Antivirus Protection
Reload this Page

Brwoser Hijack please help!!!!!!!!!

Discuss Brwoser Hijack please help!!!!!!!!! in the Antivirus Protection forum on Dev Shed.
Brwoser Hijack please help!!!!!!!!! Antivirus Protection forum discussing issues relating to antivirus programs, spyware, hijack protection, and personal firewalls for all operating systems. Keep your systems protected from hackers and other hazards.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
Stop making mediocre tutorials.The best tutorials are video! Camtasia Studio makes it easy to create engaging, buzz-building screen videos at any size, in any popular format. Download the free trial!
  #1  
Old June 17th, 2004, 10:53 AM
pmurthy pmurthy is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jun 2004
Posts: 3 pmurthy User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 0
Brwoser Hijack please help!!!!!!!!!
Hi,
It's been 3 days now since my IE browser has been hijacked with this f*** %$& dll file
This is driving me nuts.
I have tried every possible thing I could, read every forum searched google and waht not.

I tried
AdAware 6
Spybot Search & Destroy
AVG Virus Scan
Spyware Blaster
Pest Patrol
Registry Mechanic
HJT
Online Panda Virus scan
another online scan I can't remember the name

Online scans detected some Trojan viruses, removed them and the problem still persists.
Please help
Below is my latest HJT log

As you can see the dll file sitting on my home page. I have tried deleting it several times and there's something which makes a new dll file with a random name.

Logfile of HijackThis v1.97.7
Scan saved at 11:33:58 AM, on 6/17/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\crbb.exe
C:\WINDOWS\system32\msxm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\HJ\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nqeep.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://nqeep.dll/index.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://nqeep.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nqeep.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://nqeep.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\nqeep.dll/sp.html#96676
O2 - BHO: (no name) - {1BA6BE38-0B92-7349-0153-401D02C17347} - C:\WINDOWS\mfcrv32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [SpyStopper] C:\Program Files\SpyStopper\spystopper.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [msxm.exe] C:\WINDOWS\system32\msxm.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [AIM] C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe -cnetwait.odl
O4 - HKLM\..\RunOnce: [d3eg32.exe] C:\WINDOWS\system32\d3eg32.exe
O4 - HKLM\..\RunOnce: [crbb.exe] C:\WINDOWS\crbb.exe
O4 - HKLM\..\RunOnce: [sysxx32.exe] C:\WINDOWS\sysxx32.exe
O4 - HKLM\..\RunOnce: [ipcq.exe] C:\WINDOWS\ipcq.exe
O4 - HKLM\..\RunOnce: [winbs.exe] C:\WINDOWS\winbs.exe
O4 - HKLM\..\RunOnce: [apizf.exe] C:\WINDOWS\system32\apizf.exe
O4 - HKLM\..\RunOnce: [sysmk32.exe] C:\WINDOWS\system32\sysmk32.exe
O4 - HKLM\..\RunOnce: [appxd32.exe] C:\WINDOWS\appxd32.exe
O4 - HKLM\..\RunOnce: [mfcdv.exe] C:\WINDOWS\system32\mfcdv.exe
O4 - HKLM\..\RunOnce: [mfchi.exe] C:\WINDOWS\mfchi.exe
O4 - HKLM\..\RunOnce: [crgq32.exe] C:\WINDOWS\crgq32.exe
O4 - HKLM\..\RunOnce: [iema.exe] C:\WINDOWS\system32\iema.exe
O4 - HKLM\..\RunOnce: [apiyo.exe] C:\WINDOWS\apiyo.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - URL
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - URL
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - URL
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - URL
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - URL
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - URL
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - URL
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - URL
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - URL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - URL
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - URL
Reply With Quote
  #2  
Old June 17th, 2004, 11:55 AM
Mr.Obvious Mr.Obvious is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Dec 2003
Posts: 14 Mr.Obvious User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 0
re: Browser Hi-jack
I hate those things too. Not trying to direct u to another site, (cuz this is definitely the best site of all) but www.spywareinfo.com is a place that specializes in Hi-jacked browsers. thats all they do. i gave that to ya cuz i seen another post that had no replies either. good luck
Reply With Quote
  #3  
Old June 17th, 2004, 12:05 PM
spc_123 spc_123 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jun 2004
Posts: 4 spc_123 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 0
Same here
I feel your pain, I really do. I've been at it for 3 days as well. Ran the following against it already:
spybot s&d, system mechanic, pest patrol, trojan hunter, trojan remover, bazooka, Spyware Blaster, Spyware guard, spyware doctor, AVG, spysweeper, running online checks now. I had to download Firefox (mozilla) just to get a browser to GET to the antivirus sites.

Typical behavior: deletes the 'hosts' file from 'winnt/system32/drivers/etc,' changes the home page to 'res://(changing dll)/index.html#96676'
when I do a search for the dll mentioned in the url, it doesn't exist on my system. It has already taken the names of ylagn.dll,ryax.dll, ryjax.dll, among others.

it was loaded along from a supposed site of URL, which reports an ip of 216.109.117.107.
It seems to have modified permissions on my web-apps as I can no longer get to them to either uninstall/reinstall. Symantec online scan found 2 infected files so far, but isn't finished yet.

I've also booted from the server cd, chose repair, then applied sp4, reinstalled IE6sp1 and applied a patch to that. I thought the system was fine as I could browse without being taken over. I reset some permissions on some folders, and now it's back.
Reply With Quote
  #4  
Old June 17th, 2004, 12:11 PM
spc_123 spc_123 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jun 2004
Posts: 4 spc_123 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 0
it found mstasks2.exe and mstasks3.exe in the c:\winnt dir....
Reply With Quote
  #5  
Old June 17th, 2004, 04:36 PM
pmurthy pmurthy is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jun 2004
Posts: 3 pmurthy User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 0
damn! i still can't figure out how to fix this homepage + search page hijack.
I wonder how some bastard wrote such a robust code to beat all these "anti spyware" programs!
one thing that i have still not been able to do is use online Trend PC Cillin virus scan, because everytime I try to do that it gives me an error "Internet explorer has encountered a problem and needs to close" and I have send and don't send options. I have tried it atleast 6-7 times.

Anyway, if someone can help with this, I would really appreciate it.
Here's my latest HJ This log

Logfile of HijackThis v1.97.7
Scan saved at 5:35:38 PM, on 6/17/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\crbb.exe
C:\WINDOWS\system32\msxm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\Program Files\SAP\FrontEnd\SAPgui\saplogon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\tyagi\Desktop\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nqeep.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://nqeep.dll/index.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://nqeep.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nqeep.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://nqeep.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\nqeep.dll/sp.html#96676
O2 - BHO: (no name) - {1BA6BE38-0B92-7349-0153-401D02C17347} - C:\WINDOWS\mfcrv32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [SpyStopper] C:\Program Files\SpyStopper\spystopper.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [msxm.exe] C:\WINDOWS\system32\msxm.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [AIM] C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe -cnetwait.odl
O4 - HKLM\..\RunOnce: [d3eg32.exe] C:\WINDOWS\system32\d3eg32.exe
O4 - HKLM\..\RunOnce: [crbb.exe] C:\WINDOWS\crbb.exe
O4 - HKLM\..\RunOnce: [sysxx32.exe] C:\WINDOWS\sysxx32.exe
O4 - HKLM\..\RunOnce: [ipcq.exe] C:\WINDOWS\ipcq.exe
O4 - HKLM\..\RunOnce: [winbs.exe] C:\WINDOWS\winbs.exe
O4 - HKLM\..\RunOnce: [apizf.exe] C:\WINDOWS\system32\apizf.exe
O4 - HKLM\..\RunOnce: [sysmk32.exe] C:\WINDOWS\system32\sysmk32.exe
O4 - HKLM\..\RunOnce: [appxd32.exe] C:\WINDOWS\appxd32.exe
O4 - HKLM\..\RunOnce: [mfcdv.exe] C:\WINDOWS\system32\mfcdv.exe
O4 - HKLM\..\RunOnce: [mfchi.exe] C:\WINDOWS\mfchi.exe
O4 - HKLM\..\RunOnce: [crgq32.exe] C:\WINDOWS\crgq32.exe
O4 - HKLM\..\RunOnce: [iema.exe] C:\WINDOWS\system32\iema.exe
O4 - HKLM\..\RunOnce: [apiyo.exe] C:\WINDOWS\apiyo.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - URL
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - URL
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - URL
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - URL
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - URL
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - URL
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - URL
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - URL
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - URL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - URL
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - URL
Reply With Quote
Reply

Viewing: Dev Shed Forums > System Administration > Antivirus Protection > Brwoser Hijack please help!!!!!!!!!

« Previous Thread | Next Thread »

Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump


Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 





© 2003-2008 by Developer Shed. All rights reserved. DS Cluster 6 hosted by Hostway.