What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Homepage Hijack: Easy Search By Google

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Tourbus forum could not solve my homepage hijack issue despite an heroic effort.

http://forums.tourbus.com/viewtopic.php?p=332#332

The page hijack puts a link in the address bar which includes "Local Settings" from the C: drive. It has sex and drug links and has an image which reads: "Easy search by Google."

Below is my HJT log. Thanks for any help. Someone on the other forum recommended I post here.

Gene Brooks

Logfile of HijackThis v1.98.2
Scan saved at 11:35:45 AM, on 12/3/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\GEARSEC.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\ifconfig.exe
C:\Program Files\Creative\ShareDLL\Mediadet.exe
C:\WINDOWS\System32\ifconfig.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan LTX\update.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Reuters\Desktopticker\ticker.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Office\OSA.EXE
C:\Program Files\Desktop Alert\desktopalert_1732951.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\OPScan.exe
C:\Documents and Settings\Gene Brooks\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allafrica.com/liberia/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://allafrica.com/liberia
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5483427F-93B8-1470-5A89-E6B56484CDB2} - C:\DOCUME~1\GENEBR~1\LOCALS~1\Temp\bowxqqikdeg.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ifconfig.exe] C:\WINDOWS\System32\ifconfig.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Update 2100C] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan LTX\update.exe 2100C+
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SpyStopper] C:\Program Files\SpyStopper\spystopper.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Reuters Desktop Ticker] C:\Program Files\Reuters\Desktopticker\ticker.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Desktop Alert.lnk = C:\Program Files\Desktop Alert\desktopalert_1732951.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Office Startup.lnk = C:\Office\OSA.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4B55FE21-325E-48D5-9B39-9B430D639EE8} (ScanFile.FileScan) - http://www.contentpurity.com/ScanFile.CAB
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {84B7AC1D-9AD1-474F-B6B0-FE1641DBFDFA} (ScanFile.FileScan) - http://www.contentpurity.com/xp/ScanFilexp.CAB
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://www.contentwatch.com/audit/includes…uditControl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O16 - DPF: {D42ED9FF-DF46-4AD9-A3FE-46BAF896466E} (CountSpies.SpyCounter) - http://www.sunbelt-software.com/dell/CounterSpy.CAB
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac…/ActiveData.cab
Post #2 last edited
Create a new folder called C:\HijackThis, move the HijackThis.exe file into the new folder and run it from there. This is necessary to ensure you have backups should anything go wrong.

Click here, for instructions on how to enable hidden files and folders to be visible. After enabling, find, zip and send this file:

C:\WINDOWS\System32\ifconfig.exe

to this e-mail address including a link to this thread in the body of the email.

Press Control-Alt-Del to enter the Task Manager. Click on the Processes tab and end the following process:

ifconfig.exe

Exit the Task Manager when finished

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O2 - BHO: (no name) - {5483427F-93B8-1470-5A89-E6B56484CDB2} - C:\DOCUME~1\GENEBR~1\LOCALS~1\Temp\bowxqqikdeg.dll
O4 - HKLM\..\Run: [ifconfig.exe] C:\WINDOWS\System32\ifconfig.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

Reboot when done, rescan with HJT and post a new log here for a final check over.
Post #3
SOLVED. Thanks for taking time to help me. TheCharmingOne on tourbus.com forum gave the answer to this one. Gene Brooks TheCharmingOne Joined: 12 Dec 2004 Posts: 2 Posted: Sun Dec 12, 2004 4:25 am Post subject: ——————————————————————————– Didn't know if you got this fixed but its actually a quite easy one to get rid of. First lemme explain how it works. The annoying dll that is in your temp directory which often has a variety of random letters for a name (dvjisjanv.dll, eeifuahdnv.dll, aiuehhvnd.dll) etc.. i have seen quite a few, thats where it all starts. Sadly the windows operating system is a malious coders playground, although alot of the features added by microsoft are benificial, programs like this take advantage of them. One of those features is used commonly in programming to allow quick changes in programming code to optimize a program via a DLL. In otherwords you can change the code in a program you write without ever re compiling your actual program. all you do is make a program (exe, ifconfig.exe in this case) and a dll file (dvjisjanv.dll) with the code you want to change. Well what happens is in programs like video games, where offsets are often changed for security, a DLL can be loaded directly into the program at runtime without the program ever knowing! So how does this exploit work? What happens is you visit a website that downloads this DLL and ifconfig.exe program to your computer, in a temp directory (which has almost 0 permissions so any program can write to it). Then the ifconfig program runs in teh background and waits for you to start up an internet explorer program (iexplorer.exe) and once it is found running in the background the ifconfig program registers the DLL with the system (which is why you get the access denied while trying to delete it) and puts the malious code (which is what loads that annoying google sex homepage) into the main message loop of iexplorer.exe. What is happening is the code in the DLL is most likley replacing the message in the main loop that requests the registry key for the home page, and instead it tells it to load the google page. I am not positive on exactly what it does, but this is somthing a code injection would do. So how do we remove this! Well even with all its flaws microsoft provides us with a way to keep any DLLs from registering at startup. its called safe mode! So restart your computer and press f8 just before our loading windows screen appears, and you will see a menu that says Boot Normally, Safe Mode, Safe mode with networking and several other things depending on what version of window syou have. You want just normal safe mode. If you ahve windows XP Home or Pro you will see a bunch of text scroll by, this is fiine, its just the system booting up. On older versions i forget what you see its been a while. Once you are in safe mode, if you have Windows XP log in as administrator, if you have never seen this before you probably don't have an administrator password, but if it asks for one hopefully you have it. Alot of people will tell you logging in as admin is dangrous, and its true it is, you shouldln't ever log in under admin unless you are trying to fix a problem on your computer, which we are. The other reason we are logging in as admin is we probably got this nasty program under our normal user account, so by loggin in under a different account we don't give it any chance to try to work in the background. although it shouldn't be able to anyway becuase safe mode doesn't start up anything but the very basic drivers. The Final reason we log in as admin is becuase admin has access to all files on the computer, this will allow us to navigate to the temp directory where the dll is without any permissions problems. As well as the fact we can clear the entire Temp directory for your normal user account (see below) Goto Start -> My Computer double click your C: drive double click Documents and Settings double click your user name that the problem was on. In my case it would be TheCharmingOne. The next step is only for those of you who don't have hidden files showing. What you need to do is at the top of the window you will see a menu that says tools. Click that then goto folder options, once that loads click the tab that says view, and in the box that appears find the option tag that says Show all hidden files and folders, and make sure the dot next to it is filled in, then click ok. You should now see a bunch of half faded folders and files in the previous area that didn't have them before. In this folder find a half faded one called Local Settings. Once in there you will see 4 or 5 folders. One of which says Temp. This my friends is the folder where the evil file is located! From here you have one of two options. You can 1. Just delete the Temp Folder completely, however if you do this you may lose some data from your previous windows session, those of you who are scared about this, you won't lose anything to terribly important, most of the files will be re installed the next time you run windows normally, this was the other reason we logged in as admin, had we done in our normal user mode, we would not be able to clear the entire temp directory. I highly suggest you clear the entire temp directory, you might like in my case get rid of several other malious programs. However the decision is yours. The second option is to open the temp directory Locate the file with the funny name (dvjisivani.dll or whatever) and delete it. WAIT we aren't done yet. Make sure you have your Hijackthis ready as well. Do what you need to navigate to the location where hijackthis is saved. if its in yoru documents it will be in C:\Documents And Settings\\My Docuements. or on your desktop is the same as above execpt its Desktop instead of my documents. Run Hijack this and look for two lines. O2 - BHO: (no name) - {5483427F-93B8-1470-5A89-E6B56484CDB2} - C:\DOCUME~1\THECHAR~1\LOCALS~1\Temp\ygjvptmddpi.dll (file missing) – Or somthing similar to this, the important part is the file missing flag, this means we found our file! and O4 - HKLM\..\Run: [ifconfig.exe] C:\WINDOWS\System32\ifconfig.exe These are our two culprits! Check the boxes next to these two and click fix selected. it will tell you to close all internet explorer and windows explorer windows, be sure to do this, close all the folders you have open, then click ok it will remove the two entires and you are free of the easysearch google page!! Now restart your computer in normal mode (just let it start don't push any buttons) log in as your normal user and open internet explorer. if we were successful your normal webpage will load! Horray, if you still get the easysearch i am guessing its becuase you didn't delete the entire Temp directory. Just follow the steps again and this time delete the entire Temp directory under your user\local settings folder. and run hijackthis to remove the two entires again. I hope this helps those of you out there who had this annoying hijack. If this still doesn't work for you please post and i will try to help you again. Goodluck ~TheCharmingOne
Post #4
Glad your problem is resolved.


To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?



As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI