New Exploit

[Perris Calderon]

according to the link you provided enyo, , the .exe is in fact changing the location of the hosts file as I first posted...

from the link;

A file named HOSTS is created in the %WinDir%\Help directory redirecting popular search URLs (such as google.com, altavista.com, etc) to the IP address 207.44.220.30 [note: this is not the default path to the HOSTS file,

the following registry key is created to change the HOSTS path
]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
Tcpip\Parameters "DataBasePath" = %SystemRoot%\help

 

[Enyo]

Originally posted by dealer
enyo, you told us about this vulnerability some time ago here

Yup I was aware of the hole. Did not expect it to be used in this way however.

You were right on the hosts file being moved, I was not the one that doubted you

Quick Countermeasures:

1) Change permissions on registry keys so Administrators only can write to them.

2) Remove MMIE for HTA

3) Use something like Script Sentry http://www.jasons-toolbox.com/scriptsentry.asp

4) Block 207.44.194.56 and 69.57.146.14 and 69.57.146.175

5) Block access to fortune city.com where the script resides.

See http://tinyurl.com/pgtj for more and a app to disable HTA.

I said in the thread about this hole:

Website based vulnerabilitys generally are not too popular so hopefully people wont get affected by it.

Well. Hope seems not to be enough

 

[Soulchild]

Originally posted by dealer
according to the link you provided enyo, , the .exe is in fact changing the location of the hosts file as I first posted...

from the link;

A file named HOSTS is created in the %WinDir%\Help directory redirecting popular search URLs (such as google.com, altavista.com, etc) to the IP address 207.44.220.30 [note: this is not the default path to the HOSTS file,

the following registry key is created to change the HOSTS path
]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
Tcpip\Parameters "DataBasePath" = %SystemRoot%\help

well, if we change the HOSTS path back to %SystemRoot%\system32\drivers\etc, isn't it supposed to work again?

i tried, but i still can't access to google.com. i even tried to delete all the URLs in the %SystemRoot%\help\hosts file, it still doesn't work...

 

[j79zlr]

uhhh, did you delete the host file in %SystemRoot%\system32\drivers\etc

 

[Invision]

this has been working for me

In registry you will need to delete the values of the following keys.

Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
Look in all keys within Interfaces and look for the entry Name Server, anywhere you see anything for Name Server other than 10.240.4.8,10.241.4.8, edit the entry and delete the value.

Go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VXD\MSTCP
Delete the values of these keys…
EnableDNS
NameServer
HostName
Domain

Go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\Search
If you see the value http://www.google.com in the SearchAssistant key then delete that value.

Go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
EDIT the DataBasePath=%SystemRoot%\help
so that it reads:
%SystemRoot%\System32\drivers\etc

The following files will need to be deleted from the C: drive

C:\BDTMP This is Hidden
C:\BDTMP\TMP This is Hidden
C:\Windows\Help\hosts
C:\Windows\winlog

 

[Perris Calderon]

Invision...welcome to our board...I can see you are going to be quite an asset here

looking forward to reading more of your posts

 

[Invision]

thank you

 

[j79zlr]

Re: this has been working for me

Originally posted by Invision


Go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VXD\MSTCP
Delete the values of these keys…
EnableDNS
NameServer
HostName
Domain

These values are for 9x, and shouldn't be deleted if you have manually set your DNS servers. These keys shouldn't be affected by this exploit.

Go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\Search
If you see the value http://www.google.com in the SearchAssistant key then delete that value.

This has nothing to do with the hijack, this just uses google for searching the web in IE instead of MSN.

I'm just pointing this out.

 

[muzikool]

I found the following useful to resolve this issue earlier today...

1. Deleting all entries in the hosts file (%SystemRoot%\system32\drivers\etc) that showed a repeated (unknown) IP followed by a URL. In this case they were all search engine URLs.

2. Saving the edited hosts file.

3. Deleting the backup hosts file in the same directory. It had backed up the "hijacked" hosts file and used that after I edited the original.

Note: I didn't have to mess with the registry to resolve this guy's issue.

 

[Perris Calderon]

nice muzikool

 

[Invision]

Trojan.Qhost

Symantec came out with a removal tool

download here

More Info