• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

IE Taken HOSTAGE...

N

neoterixx

Guest
#1
when I right click my menu I have this porn site menu that I WANT it OUT. Here is a pic, can anyone tell me how to get rid of it ?

 

Perris Calderon

Moderator
Staff member
Political User
#2
ya

do a search for "highjack this".

it's a program I posted as an attachment on a thread by jewelzz

follow my instructions on that thread
 
B

bloodfyr

Guest
#10
It's not always a porn site that does it. Cookies, ActiveX, etc etc...the list goes on and on. You could be at a perfectly harmless looking site, and it's downloading stuff behind your "back".

I also suggest SpywareBlaster.
 

Mubbers

Shoot!
Political User
#12
Success!!! My problem in the thread IE6 denying access... is now solved.

I'd been hijacked :( in reading through this thread I D/L hijack this and ran it...

Info popped up regarding restrictions placed on my PC and that it could be hijackers etc... anyway I deleted the two offending keys and problem solved!

Mubbers
 

Maveric169

The Voices Talk to Me
#13
I ran that program, and I found a few that I could ID but there is this one that I don't know. It is C:\Windows\System32\yudkgnah.exe. Anyone else have this file?
 
N

neoterixx

Guest
#14
I dont download porn, its my girlfriends computer and she gets into the habit of clicking yes when any popup pops up.... Grrrrr... its a full time job cleaning out her system ! :(
 

Maveric169

The Voices Talk to Me
#16
Originally posted by Enyo
Listed as a BHO? Whats the CLSID (post your hijack this log if you dont know what im on about)

Does not look right to me, suggest you disable it and move the EXE to a safe location.

Point your browser to http://www.spywareinfo.com/xscan.php

Also as always scan it with GAV (see security forum) :)
Here is the log information:

Logfile of HijackThis v1.94.0
Scan saved at 5:35:18 P, on 6/2/03
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride=localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\System32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
O1 - Hosts: 216.40.230.4 desktop.kazaa.com
O1 - Hosts: 216.40.230.4 alpha.kazaa.com
O1 - Hosts: 216.40.230.4 shop.kazaa.com
O2 - BHO: (no name) - {00000273-8230-4DD4-BE4F-6889D1E74167} - C:\WINDOWS\host.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [yudkgnah] C:\WINDOWS\System32\yudkgnah.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [seticlient] C:\Program Files\SETI@home\SETI@home.exe -min
O4 - HKCU\..\Run: [StatBar] C:\Program Files\Globe Software\StatBar\StatBar.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .swf: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin7.dll
O12 - Plugin for .tiff: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MT...www.thermaltake.com/3d/xaserIII/xaserIII.html
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://bin.mcafee.com/molbin/Shared/ComCtl32/6,0,80,22/ComCtl32.cab
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - http://www.wildtangent.com/install/jvm/msjavx86_3805.exe
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {1000026A-8230-4DD4-BE4F-6889D1E74167} - http://cr.stop-popup-ads-now.com/download/cabs/BANN8004/stoppop.cab
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://download.macromedia.com/pub/shockwave/cabs/authorware/awswax.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...ple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,55/mcinsctl.cab
O16 - DPF: {637BB540-6ABA-11D4-901D-00D0090CB3BC} (FMClass Class) - http://www.flashants.com/codebase/fmplayer.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2003012801/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs7b.instantservice.com/jars/customerxsigned34.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://www.pandasoftware.com/activescan/as/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37678.8578935185
O16 - DPF: {A7798D6C-C6B5-4F26-9363-F7CDBBFFA607} (download Class) - http://www.gigex.com/ActiveX/vxpspeeddelivery.dll
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {E2F2B9D0-96B9-4B25-B90C-636ECB207D18} - http://www.clock-sync.com/WUInstSYNC.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,4,0,4250/mcfscan.cab
 

Perris Calderon

Moderator
Staff member
Political User
#17
yoyo...I know you write some code.

highjack this is a great little program, but tthe author doesn't know how to create a restore log.

perhaps you could help him get that in here.

man, this would become a much better program with that in there.

any hope?
 

Maveric169

The Voices Talk to Me
#18
Originally posted by Enyo
dealer, go suggest it at spywareinfo where the author hangs out.

Maveric169, a few problems that i can spot:

O4 - HKLM\..\Run: [yudkgnah] C:\WINDOWS\System32\yudkgnah.exe

Kill that. Remove it from the registry run and isolate the application. Until you ID what it is stop it, it has no meaningful name and is in the system dir. Possible Trojan server with a lazy author.

[TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

Kill that to stop the RealOne message centre.

See:

http://www.ntfs.org/forum/showthread.php?s=&threadid=29764&highlight=real

http://www.ntfs.org/forum/showthread.php?s=&threadid=34377&highlight=real

Not looking good:

O2 - BHO: (no name) - {00000273-8230-4DD4-BE4F-6889D1E74167} - C:\WINDOWS\host.dll

Need to ID that. I cant say for sure what it is. Ill look up the CLSID later.

Remove:

O1 - Hosts: 216.40.230.4 desktop.kazaa.com
O1 - Hosts: 216.40.230.4 alpha.kazaa.com
O1 - Hosts: 216.40.230.4 shop.kazaa.com

from your hosts file. Your hosts file has been hijacked and this re-directs to a porn site.

If your running kazza remove it and use kazza lite.

Remove O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - http://www.wildtangent.com/install/...javx86_3805.exe

Its most likely not JVM, indeed wildtangent.com is a flagged malware site.


Please visit:

http://www.spywareinfo.com/forums/index.php?s=&act=SF&f=11

For more specific help these guys are good with removal help. It seems you have a few problems that need looking at.
Thanks for the info, doing it now. :D
 

Maveric169

The Voices Talk to Me
#19
Thnks for the info. I had to go through the registry also, amazing what you find in there. Cleaned that up a bit too.Just proves that uninstalls don't undo what has been done in the registry.
 

Members online

No members online now.

Latest posts

Latest profile posts

Hello, is there anybody in there? Just nod if you can hear me ...
Xie
What a long strange trip it's been. =)

Forum statistics

Threads
61,960
Messages
673,237
Members
89,011
Latest member
grovo_test