What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijacked Browser By Isearch

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Yes, your log is slightly bigger. TrojanHunter has added a startup entry (Trojan Hunter Guard) and Trendmicro added a DPF (X Scan).

I think it is quite possible that items are being detected in the signature files of one of you anti-malware scanners (they have files to help identify malware).
First go here and download the latest updates for Norton. Install them according to the instructions there.
After the updates are installed, do a full system scan. If there are problems found that cannot be fixed, Norton should give you a report that you can post if necessary.

Another good site to get an online scan is Panda ActiveScan.

Run HijackThis! and tick the following lines, close all browser windows and shut down all other programs with a placeholder in the taskbar. Click "fix checked"
O4 - HKCU\..\Run: [clean] C:\Program Files\TheCleaner\TheCleaner.exe 1
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE

Reboot<
We need to check these files: TheCleaner.exe, SIFXINST.EXE . I bolded the paths where they can be found above.
Right click the file and choose properties. Let us know what you find in the
properties dialog box (you can copy/paste from it), of particular interest are
the creation date, description and company name.
Post #17
multiple viruses found by norton after updating per your instruction. no log generated but i was able to copy the virus names and locations: Plugin[1].jar Beyond.class - Trojan Byte Verifier.class - Trojan Byte Blackbox.class - Trojan Byte a[1].jar Verifier.class - Trojan Byte Dummy.class - Trojan Byte a.class - Trojan Byte All were located in: C:|Docs and settings\owner\local settings\Temporary Int I was wrong here is the log: Date,Filename,Virus Name,Virus Type,Action Taken,Computer,User,Original Location,Status,Current Location,Primary Action,Secondary Action,Scan Type,Action Description 6/7/2004 2:30:21 PM,plugin[1].jar,??????,Compressed file,Quarantined,GATEWAY_SYSTEM,Owner,C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KXIB0D67\,Still contains 3 infected items,Quarantine,Clean virus from file,Quarantine infected file,Manual scan,The file was quarantined successfully. 6/7/2004 2:30:16 PM,Beyond.class,Trojan.ByteVerify,File; Compressed file,Quarantined,GATEWAY_SYSTEM,Owner,C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KXIB0D67\plugin[1].jar,Infected,Quarantine,Clean virus from file,Quarantine infected file,Manual scan,The file was quarantined successfully. 6/7/2004 2:30:11 PM,VerifierBug.class,Trojan.ByteVerify,File; Compressed file,Quarantined,GATEWAY_SYSTEM,Owner,C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KXIB0D67\plugin[1].jar,Infected,Quarantine,Clean virus from file,Quarantine infected file,Manual scan,The file was quarantined successfully. 6/7/2004 2:30:05 PM,BlackBox.class,Trojan.ByteVerify,File; Compressed file,Quarantined,GATEWAY_SYSTEM,Owner,C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KXIB0D67\plugin[1].jar,Infected,Quarantine,Clean virus from file,Quarantine infected file,Manual scan,The file was quarantined successfully. 6/7/2004 2:27:08 PM,a[1].jar,??????,Compressed file,Quarantined,GATEWAY_SYSTEM,Owner,C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KHYN8LYF\,Still contains 3 infected items,Quarantine,Clean virus from file,Quarantine infected file,Manual scan,The file was quarantined successfully. 6/7/2004 2:27:03 PM,VerifierBug.class,Trojan.ByteVerify,File; Compressed file,Quarantined,GATEWAY_SYSTEM,Owner,C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KHYN8LYF\a[1].jar,Infected,Quarantine,Clean virus from file,Quarantine infected file,Manual scan,The file was quarantined successfully. 6/7/2004 2:26:58 PM,Dummy.class,Trojan.ByteVerify,File; Compressed file,Quarantined,GATEWAY_SYSTEM,Owner,C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KHYN8LYF\a[1].jar,Infected,Quarantine,Clean virus from file,Quarantine infected file,Manual scan,The file was quarantined successfully. 6/7/2004 2:26:52 PM,a.class,Trojan.ByteVerify,File; Compressed file,Quarantined,GATEWAY_SYSTEM,Owner,C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KHYN8LYF\a[1].jar,Infected,Quarantine,Clean virus from file,Quarantine infected file,Manual scan,The file was quarantined successfully. What should I do with these files?
Post #18
It looks like Norton sucessfully quarantined them. I was thinking last night that I should have had you run disk cleanup. Lets do that now.

Go to Start>All Programs>Accessories>System Tools>Disk Cleanup
You want to clean the C drive if it asks
In the files to delete pane select all options except for "compress old files" and "catalog files for the content indexer"
This will empty your recycle bin, if you want to avoid that for any reason then do not check that option.
Click ok and allow it to finish.

If disk cleanup hangs on the initial scan (takes more than two or three minutes) stop it with the "cancel" button and try this reg file to see if it helps. Copy the contents of the quote box to a notepad document, call it fixcleaner.reg and save as type "all files"

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Compress old files]

Double click fixcleaner.reg and say yes to add it to the registry.
How does disk cleanup work now?


Once that is done, rescan with norton and see if you get a clean bill of health.

We need to check these files: TheCleaner.exe, SIFXINST.EXE . I bolded the paths where they can be found above.
Right click the file and choose properties. Let us know what you find in the
properties dialog box (you can copy/paste from it), of particular interest are
the creation date, description and company name.

What did you find out about those files.
Post #19 last edited
done. rescanning now.


here's what i was able to find out about SIFX: created: Saturday, January 18, 2003, 11:00:15 PM

comes up on Google as LANovation sfx

LANovation
1313 5th Street SE
Minneapolis, MN 55414
USA View All Documents
by LANovation
TEL: [removed]
FAX: [removed]
Email: [removed]
URL: http://www.lanovation.com

——————————————————————————–
Description
Founded in 1985, LANovation has grown from a firm that develops custom software for companies such as IBM and Network Systems to a corporation that supplies large and small companies world-wide with leading edge, off-the-shelf software tools. LANovation's smart desktop and embedded software products and services make it easy for companies to continually integrate new technology into their desktop PCs or smart devices without taking time away from their core missions.


How Enterprises Can Combat the Costs of Managing the Windows Desktop

Published: July 20, 2001 Type: White Paper
As companies move from Windows 3.x to Windows 98, 95 and NT, the largest portion of the Total Cost of Ownership (TCO) comes from the day to day care and repair of the 32-bit desktop environment.
Topics: Ghost Imaging Software | Windows

——————————————————————————–

Troubleshooting White Paper

Published: July 20, 2001 Type: White Paper
Enterprises don't need to spend millions of dollars each year fixing day-to-day troubles users have with their PCs with LANovation's PictureTaker.
Topics: Ghost Imaging Software

——————————————————————————–
I did have an american express smart card reader so it could be that. but that is defunct so….

Here's what I found on The Cleaner: created Jan2, 2004 or Friday, January 24, 2003, 11:01:11 PM

I believe I found out about it from CNET - http://download.com.com/The%20Cleaner/3000…tml?tag=lst-0-2

Company from the UK. http://www.the-cleaner.co.uk/index.htm
Trial version

INFO:

The Cleaner is a privacy and clean-up utility that eliminates all these tracks from your computer! Cleaning up the history of your activities requires tedious hours of manually removing each history file or entry. If privacy and disk space are to be maintained, this process must be performed every time you use your computer. The Cleaner makes protecting your privacy - and improving system performance a breeze! The Cleaner automatically cleans your browser's cache, cookies, history, recent document list, and much more! It can run in the background to clean up your tracks when you are done browsing the Internet or any other time you choose. Everyone from computer beginners to expert users agree: The Cleaner is an essential tool for protecting your privacy and improving your computer's performance.
Post #20
Thanks for the information mmbond. You should uninstall any programs you are not using, such as the one related to the defunct smart card readier.
Post #21
will do as soon as norton finishes running. will post if anything else is found. also checking my other pc and running the processes listed by you. system came up with JS.SEEKER. virus. currently running Trojan Hunter. Should I create a separate post if unable to solve? RAND1038 - THANKS FOR ALL OF YOUR HELP! YOU'VE GONE ABOVE AND BEYOND THE CALL OF DUTY!
Post #22
Glad to help mmbound. Yes, you should create a separate thread for the other computer. Put a link to it here and I would be happy to take a look at it. Post a fresh HijackThis! log here from the one we have been working on for a final look through.
Post #24 last edited
Current HJT LOG - THANKS AGAIN RAND 1038!!!! :D

Logfile of HijackThis v1.97.7
Scan saved at 6:09:47 PM, on 6/7/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\WINDOWS\System32\rmctrl.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\dpps2.exe
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Documents and Settings\Owner\My Documents\Downloads\FreeRAM XP Pro 1.40.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\FRU\Remind32.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\Program Files\TrojanHunter 3.9\TrojanHunter.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\hpoipm07.exe
C:\Documents and Settings\Owner\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\System32\rmctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRA~1\PANICW~1\POP-UP~2\dpps2.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 3.9\THGuard.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Documents and Settings\Owner\My Documents\Downloads\FreeRAM XP Pro 1.40.exe" -win
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [clean] C:\Program Files\TheCleaner\TheCleaner.exe 1
O4 - Startup: Hewlett-Packard Recorder.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\FRU\Remind32.exe
O4 - Global Startup: HPAiODevice(hp officejet d series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: Customize this Menu - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComCustomIEMenu.html
O8 - Extra context menu item: Fill Forms - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComFillForms.html
O8 - Extra context menu item: Save Forms - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComSavePass.html
O9 - Extra button: Fill Forms (HKLM)
O9 - Extra 'Tools' menuitem: Fill Forms (HKLM)
O9 - Extra button: Save (HKLM)
O9 - Extra 'Tools' menuitem: Save Forms (HKLM)
O9 - Extra button: RF Toolbar (HKLM)
O9 - Extra 'Tools' menuitem: Robo Toolbar (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {02BF25D5-8C17-4B23-BC23-BC8000000000} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {5B2745C4-8488-432C-A985-77C3E2EFA64F} (PpayWallet) - https://www26.americanexpress.com/privatepa…nts/ppayspw.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/148119a…all/xscan53.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4019/ftp…23/cpbrkpie.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…B?37640.5815625
O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} (EGP2ECOM Class) - http://akamai.downloadv3.com/binaries/P2EC…UTH_pack_XP.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://livesc03.rightnowtech.com/realtytra…l/java/RntX.cab
O16 - DPF: {EEECA057-AD0F-44A7-8BE5-8634CEDBDBD1} - http://akamai.downloadv3.com/binaries/IA/netpe32_EN_XP.cab
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin.cab
Post #25
Fix these with HijackThis (don't forget to shut down all other programs and browsers).
R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4019/ftp…23/cpbrkpie.cab
O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} (EGP2ECOM Class) - http://akamai.downloadv3.com/binaries/P2EC…UTH_pack_XP.cab
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin.cab

Read How did I get infected in the first place and follow Tony's advice. He will tell you about some ways to make your computer more secure and link to some excellent free tools to help with that.

Good job mmbond ! Get the tools Tony recommends in the link I posted above, they will help alot!
Post #26

Fix these with HijackThis (don't forget to shut down all other programs and browsers).
R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4019/ftp…23/cpbrkpie.cab
O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} (EGP2ECOM Class) - http://akamai.downloadv3.com/binaries/P2EC…UTH_pack_XP.cab
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin.cab

Read How did I get infected in the first place and follow Tony's advice. He will tell you about some ways to make your computer more secure and link to some excellent free tools to help with that.

Good job mmbond ! Get the tools Tony recommends in the link I posted above, they will help alot!

Done. Done and Done! Thanks Again Rand 1038!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI