Homepage Hijacking

Click here to download FindnFix.exe (2K/XP only!) by freeatlast. Double-click on the FINDnFIX.exe and it will install a folder called FINDnFIX on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.

Hi Thankyou so much for your time, greatlt appreciated. Below is the log from FINDnFIX. Sun 22 Aug 04 13:50:55 »»»»»»»»»»»»»»»»»»***LOG!***(*updated *8/22*)»»»»»»»»»»»»»»»» *System: Microsoft Windows XP Professional 5.1 (Build 2600) *IE version: 6.0.2600.0000 The type of the file system is NTFS. __________________________________ !!*Creating backups…!! The operation completed successfully __________________________________ *Local time: Sunday, 22 August 2004 (22/08/2004) 1:50 PM, AUS Eastern Standard Time *Uptime: 13:50:57 up 0 days, 1:50:04 *Path: C:\FINDnFIX —————————————————- »»Member of…: ("ADMIN" logon + group match required!) User is a member of group STEPHEN\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Group BUILTIN\Administrators matches list. Group BUILTIN\Users matches list. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User: [STEPHEN\Stephen Anderson], is a member of: BUILTIN\Administrators \Everyone Running in WORKSTATION MODE. SystemDrive is C: SystemRoot is C:\WINNT Logon Domain is STEPHEN Administrator's Name is Stephen Anderson Computer Name is STEPHEN LOGON SERVER is \\STEPHEN »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»» The list will produce a small database of files that will match certain criteria. Ex: read only files, s/h files, last modified date. size, etc. The filters provided and registry scan should match the corresponding file(s) listed. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Unless the file match the entire criteria, it should not be pointed to remove without attempting to confirm it's nature! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» At times there could be several (legit) files flagged, and/or duplicate culprit file(s)! If in doubt, always search the file(s) and properties according to criteria! The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder ______________________________________________________________________________ ***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!*** ______________________________________________________________________________ ……Scanning for file(s)… *Note! The list(s) may include legitimate files! »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Read access error(s)… »»»»» (*2*) »»»»»…….. »»»»» (*3*) »»»»»…….. No matches found. unknown/hidden files… No matches found. »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»»»(*5*)»»»»» »»»»»(*6*)»»»»» »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size… *List of files and specs according to 'size' : *Note: Not all files listed here are infected, but *may include* the name and spces of the offending file… ___________________________________________________________________________ Path: C:\WINNT\SYSTEM32 Including: *.DLL ____________________________________________________________________________ *By size and date… No matches found. No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» BHO search… **File C:\WINNT\SYSTEM32\NOI.DLL 000020D8: 25 25 25 30 32 78 00 00 . 00 00 00 00 C0 82 05 B3 %%%02x.. ….À‚.³ No matches found. »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450 »»Checking for AppInit_DLLs (empty) value… ________________________________ !"AppInit_DLLs"=""! Value Matches ________________________________ »»Comparing *saved* key with *original*… REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com) Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows). No differences found. »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (NI) ALLOW Read BUILTIN\Users (IO) ALLOW Read BUILTIN\Users (NI) ALLOW Read BUILTIN\Power Users (IO) ALLOW Read BUILTIN\Power Users (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access BUILTIN\Administrators (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Read BUILTIN\Power Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Performing string scan…. 00001150: ? 00001190: vk AppInit_ 000011D0:DLLsc 0 vk \ DeviceNotSelectedTimeout 00001210: 1 5 ` 9 0 ` vk ' 00001250:GDIProcessHandleQuota vk Spooler y e 00001290:s , 8 h vk , swapdisk 000012D0: vk ( TransmissionRetryTimeout 8 00001310:h vk ' " USERProcessHandleQuota 00001350: 00001390: 000013D0: 00001410: 00001450: 00001490: 000014D0: 00001510: 00001550: 00001590: 000015D0: ———- WIN.TXT AppInit_DLLsc ————– ————– $011C8: AppInit_DLLsc $011F8: DeviceNotSelectedTimeout $01250: GDIProcessHandleQuota $012E8: TransmissionRetryTimeout $01338: USERProcessHandleQuota ————– ————– No strings found. ————– ————– REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 ………. *Debug… ————– ————– Ntdll.DLL at 77F50000 Kernel32.DLL at 77E60000 ………. A handle was successfully obtained for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key. This key has 0 subkeys. The AppInitDLLs value exists and reports as 2 bytes, including the 2 for string termination. [AppInitDLLs] Ansi string : "" 0000 00 00 | .. ———————– »»»»»»Backups list…»»»»»» 13:52:18 up 0 days, 1:51:25 ———————– Sun 22 Aug 04 13:52:18 C:\FINDNFIX\ keyback.hiv Sun 22 Aug 2004 13:50:56 A…. 8,192 8.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 8,192 bytes 8.00 K C:\FINDNFIX\KEYS1\ winkey.reg Sun 22 Aug 2004 13:50:56 A…. 287 0.28 K 1 item found: 1 file, 0 directories. Total of file sizes: 287 bytes 0.28 K *Temp backups… "C:\Documents and Settings\Stephen Anderson\Local Settings\Temp\Backs2\" keyback2.hi_ 22 Aug 2004 8192 "keyback2.hi_" winkey2.re_ 22 Aug 2004 287 "winkey2.re_" 2 items found: 2 files, 0 directories. Total of file sizes: 8,479 bytes 8.28 K -D—- JUNKXXX 00000000 13:50.56 22/08/2004 A—– STARTIT .BAT 0000005F 13:50.56 22/08/2004 ________________________________________________________________________________ ***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)' AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS! MINIMAL REQUIREMENTS INCLUDE: _________XP HOME/PRO; SP1; IE6/SP1 _________2K/SP4; IE6/SP1 ________________________________________________________________________________ »»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»» —–END—— Sun 22 Aug 04 13:52:20 

No hidden file. Could you click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1 Reboot when done.

Click here to download Ad-Aware and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Then click the gear wheel at the top and check these options:

General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."

Click "Proceed" to save your settings, then click "Start", make sure "Activate in-depth scan" is ticked green then scan your system. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done. Rescan with HJT and post a new log here for a final check over.

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: MxTargetObj Class - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINNT\mxTarget.dll
O3 - Toolbar: (no name) - {825CF5BD-8862-4430-B771-0C15C5CA880F} - (no file)
O4 - HKLM\..\Run: [kykqgj] C:\WINNT\System32\zydsrryb.exe
O4 - HKCU\..\Run: [Oazj] C:\WINNT\System32\itskbojm.exe
O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} (VacPro.internazionale_ver3) - http://www.advnt01.com/dialer/internazionale_ver3.CAB
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/au/games4.cab

Click here, for instructions on how to enable hidden files and folders to be visible. After enabling, reboot into safe mode by tapping F8 after the BIOS has loaded, find and delete the following:

C:\WINNT\System32\zydsrryb.exe
C:\WINNT\System32\itskbojm.exe

Reboot when done. Click here to make sure that you have the latest Critical Update patches for Windows. It's very important to keep your system up to date to avoid unnecessary security risks.

Rescan with HJT and post a new log here for a final check over.

I'm in the UK.

You appear to have picked up another baddie. Again with only HJT running, have it fix:

O2 - BHO: G1.GZ - {79C03BC5-6C55-4B5B-921F-C02B6F1ABD7B} - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pribi\Pribi.dll
O4 - HKCU\..\Run: [\Pribi.exe] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pribi\Pribi.exe

To help keep you clean have a look at these three applications, easy to use and easy on resources:

SpywareBlaster
SpywareGuard
IE-SPYAD

Post another HJT log.

Your hardware firewall should be adequate. The log is clean now - how is it running?

Hi Daemon System is running well and all appears to be normal. Thankyou again for your help it is greatly appreciated. Is there anywhere/anyway I can give a donation as a token of my appreciation. Regards Stephen

You're welcome - glad to help

To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?


Any donatations to keep us online are appreciated, see here: http://tomcoyote.org/donate.php


As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.