IE Taken HOSTAGE...

[neoterixx]

when I right click my menu I have this porn site menu that I WANT it OUT. Here is a pic, can anyone tell me how to get rid of it ?

 

[Perris Calderon]

ya

do a search for "highjack this".

it's a program I posted as an attachment on a thread by jewelzz

follow my instructions on that thread

 

[Perris Calderon]

also, I believe enyo or yoyo posted the manual method for geting rid of these bwoser highjacks

 

[neoterixx]

I dont see the ZIP that is attatched... Can I have another link ?

 

[yoyo]

http://www.tomcoyote.org/hjt/

 

[neoterixx]

thanks you the man! Got it off ! Basterds!!!!!

 

[bloodfyr]

Lavasoft's AdAware may be able to get rid of that, as well.

 

[Petros]

Also, I implore you to consider not downloading any more pr0n. That helps a lot, and not just your computer.

 

[Perris Calderon]

I download hours of porn every day...nothing wrong with it

 

[bloodfyr]

It's not always a porn site that does it. Cookies, ActiveX, etc etc...the list goes on and on. You could be at a perfectly harmless looking site, and it's downloading stuff behind your "back".

I also suggest SpywareBlaster.

 

[Petros]

Maybe I'm just a bit of a prude

 

[Mubbers]

Success!!! My problem in the thread IE6 denying access... is now solved.

I'd been hijacked in reading through this thread I D/L hijack this and ran it...

Info popped up regarding restrictions placed on my PC and that it could be hijackers etc... anyway I deleted the two offending keys and problem solved!

Mubbers

 

[Maveric169]

I ran that program, and I found a few that I could ID but there is this one that I don't know. It is C:\Windows\System32\yudkgnah.exe. Anyone else have this file?

 

[neoterixx]

I dont download porn, its my girlfriends computer and she gets into the habit of clicking yes when any popup pops up.... Grrrrr... its a full time job cleaning out her system !

 

[neoterixx]

got a link ?

 

[Maveric169]

Originally posted by Enyo
Listed as a BHO? Whats the CLSID (post your hijack this log if you dont know what im on about)

Does not look right to me, suggest you disable it and move the EXE to a safe location.

Point your browser to http://www.spywareinfo.com/xscan.php

Also as always scan it with GAV (see security forum)

Here is the log information:

Logfile of HijackThis v1.94.0
Scan saved at 5:35:18 P, on 6/2/03
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride=localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\System32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
O1 - Hosts: 216.40.230.4 desktop.kazaa.com
O1 - Hosts: 216.40.230.4 alpha.kazaa.com
O1 - Hosts: 216.40.230.4 shop.kazaa.com
O2 - BHO: (no name) - {00000273-8230-4DD4-BE4F-6889D1E74167} - C:\WINDOWS\host.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [yudkgnah] C:\WINDOWS\System32\yudkgnah.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [seticlient] C:\Program Files\SETI@home\SETI@home.exe -min
O4 - HKCU\..\Run: [StatBar] C:\Program Files\Globe Software\StatBar\StatBar.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .swf: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin7.dll
O12 - Plugin for .tiff: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MT...www.thermaltake.com/3d/xaserIII/xaserIII.html
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://bin.mcafee.com/molbin/Shared/ComCtl32/6,0,80,22/ComCtl32.cab
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - http://www.wildtangent.com/install/jvm/msjavx86_3805.exe
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {1000026A-8230-4DD4-BE4F-6889D1E74167} - http://cr.stop-popup-ads-now.com/download/cabs/BANN8004/stoppop.cab
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://download.macromedia.com/pub/shockwave/cabs/authorware/awswax.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...ple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,55/mcinsctl.cab
O16 - DPF: {637BB540-6ABA-11D4-901D-00D0090CB3BC} (FMClass Class) - http://www.flashants.com/codebase/fmplayer.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2003012801/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs7b.instantservice.com/jars/customerxsigned34.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://www.pandasoftware.com/activescan/as/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37678.8578935185
O16 - DPF: {A7798D6C-C6B5-4F26-9363-F7CDBBFFA607} (download Class) - http://www.gigex.com/ActiveX/vxpspeeddelivery.dll
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {E2F2B9D0-96B9-4B25-B90C-636ECB207D18} - http://www.clock-sync.com/WUInstSYNC.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,4,0,4250/mcfscan.cab

 

[Perris Calderon]

yoyo...I know you write some code.

highjack this is a great little program, but tthe author doesn't know how to create a restore log.

perhaps you could help him get that in here.

man, this would become a much better program with that in there.

any hope?

 

[Maveric169]

Originally posted by Enyo
dealer, go suggest it at spywareinfo where the author hangs out.

Maveric169, a few problems that i can spot:

O4 - HKLM\..\Run: [yudkgnah] C:\WINDOWS\System32\yudkgnah.exe

Kill that. Remove it from the registry run and isolate the application. Until you ID what it is stop it, it has no meaningful name and is in the system dir. Possible Trojan server with a lazy author.

[TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

Kill that to stop the RealOne message centre.

See:

http://www.ntfs.org/forum/showthread.php?s=&threadid=29764&highlight=real

http://www.ntfs.org/forum/showthread.php?s=&threadid=34377&highlight=real

Not looking good:

O2 - BHO: (no name) - {00000273-8230-4DD4-BE4F-6889D1E74167} - C:\WINDOWS\host.dll

Need to ID that. I cant say for sure what it is. Ill look up the CLSID later.

Remove:

O1 - Hosts: 216.40.230.4 desktop.kazaa.com
O1 - Hosts: 216.40.230.4 alpha.kazaa.com
O1 - Hosts: 216.40.230.4 shop.kazaa.com

from your hosts file. Your hosts file has been hijacked and this re-directs to a porn site.

If your running kazza remove it and use kazza lite.

Remove O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - http://www.wildtangent.com/install/...javx86_3805.exe

Its most likely not JVM, indeed wildtangent.com is a flagged malware site.


Please visit:

http://www.spywareinfo.com/forums/index.php?s=&act=SF&f=11

For more specific help these guys are good with removal help. It seems you have a few problems that need looking at.

Thanks for the info, doing it now.

 

[Maveric169]

Thnks for the info. I had to go through the registry also, amazing what you find in there. Cleaned that up a bit too.Just proves that uninstalls don't undo what has been done in the registry.