browser hijacking [Archive] - Safer-Networking Forums

nbarton18

2007-06-26, 05:37

I'm having numerous problems with iexplorer being hijacked and i'm getting some popups. Here is my hjt log with online scan log to follow. Any help you can provide would be appreciated.

Logfile of HijackThis v1.99.1
Scan saved at 9:15:33 PM, on 6/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Array Networks\Common\4,2,2,1001\arr_isrv4,2,2,1001.exe
C:\Program Files\Connected\AgentSrv.EXE
C:\Program Files\Array Networks\Array SSL VPN\3,2,2,1001\arr_srvs3,2,2,1001.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Credant\Gatekeeper\Gatekeeper.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Amdocs\SIMS\SIMS.exe
C:\Program Files\Symantec\SPA\smc.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\TEMP\VF51F8.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\SPA\SmcGui.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\system32\TpShocks.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Microsoft Office Communicator\Communicator.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Connected\CBSysTray.exe
C:\Program Files\Credant\Gatekeeper\GKProbe.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://amdocsportalna/default.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://amdocsportalna/default.aspx
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://Amdocsportal
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: 75.126.25.138 www.lookmaze.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [TPKBDLED] C:\WINDOWS\system32\TpScrLk.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [xydzyh] C:\WINDOWS\system32\xydzyh.exe
O4 - HKCU\..\Run: [SafeHouseSystemTray] C:\PROGRA~1\SAFEHO~1\SDWTRAY.EXE
O4 - HKCU\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe"
O4 - HKCU\..\Run: [TivoTransfer] "C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" /service /registry /auto:TivoTransfer
O4 - HKCU\..\Run: [TivoNotify] "C:\Program Files\TiVo\Desktop\TiVoNotify.exe" /service /registry /auto:TivoNotify
O4 - HKCU\..\Run: [TivoServer] "C:\Program Files\TiVo\Desktop\TiVoServer.exe" /service /registry /auto:TivoServer
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe
O4 - Global Startup: GKProbe.lnk = C:\Program Files\Credant\Gatekeeper\GKProbe.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SafeHouse.lnk = C:\Program Files\SafeHouse\SdwTray.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://amdocsportalna/default.aspx
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.0.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - https://www.ueclassroom.sprint.com/SiteRoots/main/Install/CentraDownloader.cab
O16 - DPF: {B6648EB8-2460-484F-9255-9654454C4C70} (ArrVPNAX Control) - https://stlvpn.amdocs.com/prx/000/http/localhost/arr_x.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.2.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.amdocs.com
O17 - HKLM\Software\..\Telephony: DomainName = corp.amdocs.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F5D9C0D-0D2F-4C06-B04B-CC9CC15AD835}: NameServer = 10.8.0.36,10.8.0.7
O17 - HKLM\System\CCS\Services\Tcpip\..\{6C00ECC0-7EA6-455D-907B-7787CF95F186}: Domain = corp.amdocs.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{A4389DB6-B557-4C9E-AB2C-E5B639737306}: Domain = corp.amdocs.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = corp.amdocs.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = amdocs.com,corp.amdocs.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F5D9C0D-0D2F-4C06-B04B-CC9CC15AD835}: NameServer = 10.8.0.36,10.8.0.7
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = corp.amdocs.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = amdocs.com,corp.amdocs.com
O17 - HKLM\System\CS2\Services\Tcpip\..\{0F5D9C0D-0D2F-4C06-B04B-CC9CC15AD835}: NameServer = 10.8.0.36,10.8.0.7
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = amdocs.com,corp.amdocs.com
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Active HelpAssistants - Unknown owner - C:\WINDOWS\IIS\iissets (file missing)
O23 - Service: Connected Agent Service (AgentSrv) - Connected Corporation - C:\Program Files\Connected\AgentSrv.EXE
O23 - Service: Array SSL VPN Service 3,2,2,1001 (ArraySSL_VPN_Service3,2,2,1001) - Unknown owner - C:\Program Files\Array Networks\Array SSL VPN\3,2,2,1001\arr_srvs3,2,2,1001.exe
O23 - Service: Array Utility Service 4,2,2,1001 (Array_Utility_Service4,2,2,1001) - Unknown owner - C:\Program Files\Array Networks\Common\4,2,2,1001\arr_isrv4,2,2,1001.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: CREDANT Mobile Guardian Gatekeeper (guardian) - CREDANT Technologies - C:\Program Files\Credant\Gatekeeper\Gatekeeper.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: Indexing Helps (Indexingbox) - Unknown owner - %WINDIR%\system\svchest.exe (file missing)
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OESH (Office Source Engine Help) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SIMS - - C:\Program Files\Amdocs\SIMS\SIMS.exe
O23 - Service: Symantec Protection Agent 5.1 (SmcService) - Symantec Corporation. - C:\Program Files\Symantec\SPA\smc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE

Online scan results (apologies for the formatting):

49195638.exe Win32/Meyfew!generic cannot cure C:\
cnte-dhncgts.jar-45835a83-626cc679.zip>BnnnnBaa.class Java/ByteVerify!exploit cannot cure C:\Documents and Settings\nickba\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\
cnte-dhncgts.jar-45835a83-626cc679.zip>VaannnaaBaa.class Java/ByteVerify!exploit cannot cure C:\Documents and Settings\nickba\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\
checkin[1].htm VBS/MS06-014!exploit cannot cure C:\Documents and Settings\nickba\Local Settings\Temporary Internet Files\Content.IE5\2DGNELU5\
smax4pnp.exe Win32/Athsap.G cannot cure C:\Program Files\Analog Devices\Core\
Smax4.exe Win32/Athsap.G cannot cure C:\Program Files\Analog Devices\SoundMAX\
UnInstall.exe Win32/Matcash cannot cure C:\Program Files\Common Files\{3C82C1C0-0724-1033-0829-060923200001}\
jusched.exe Win32/Athsap.G cannot cure C:\Program Files\Java\jre1.5.0_10\bin\
TPHKMGR.exe Win32/Athsap.G cannot cure C:\Program Files\Lenovo\PkgMgr\HOTKEY\
SDWTRAY.EXE Win32/Athsap.G cannot cure C:\Program Files\SafeHouse\
SynTPEnh.exe Win32/Athsap.G cannot cure C:\Program Files\Synaptics\SynTP\
SynTPLpr.exe Win32/Athsap.G cannot cure C:\Program Files\Synaptics\SynTP\
EzEjMnAp.Exe Win32/Athsap.G cannot cure C:\Program Files\ThinkPad\Utilities\
sgtray.exe Win32/Athsap.G cannot cure C:\Program Files\VERITAS Software\Update Manager\
svchest.reg REG/Doshye cannot cure C:\WINDOWS\system\
hkcmd.exe Win32/Athsap.G cannot cure C:\WINDOWS\system32\
igfxpers.exe Win32/Athsap.G cannot cure C:\WINDOWS\system32\
igfxtray.exe Win32/Athsap.G cannot cure C:\WINDOWS\system32\
TpScrLk.exe Win32/Athsap.G cannot cure C:\WINDOWS\system32\

pskelley

2007-06-27, 16:55

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

I am sorry I do not have the bast of news for you.

O23 - Service: Indexing Helps (Indexingbox) - Unknown owner - %WINDIR%\system\svchest.exe (file missing)
Indexing Helps (Indexingbox) X svchest.exe Added by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K) More] here
http://www.superadblocker.com/S/SVCHEST.EXE-1591.html
http://www.sophos.com/security/analyses/trojfearlessk.html
Side effects
Steals information
Records keystrokes
Installs itself in the Registry
Dropped by malware

O23 - Service: OESH (Office Source Engine Help) - Unknown owner - C:\Program.exe (file missing)
OESH (Office Source Engine Help) X Program.exe Added by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C: folder.

O23 - Service: Active HelpAssistants - Unknown owner - C:\WINDOWS\IIS\iissets (file missing)
http://www.spywaredata.com/spyware/malware/iissets.php
This one I can not identify.

I am also 99% sure you have a Vundo infection: http://www.symantec.com/security_response/writeup.jsp?docid=2004-112111-3912-99
Which is responsible for the popups, but the real danger is hidden.

I know at least two of these trojans are Sdbots and at least one steals information and records keystrokes so I would prefer to err on the side of caution where your security is concerned.
I can not say, it may be that 100% of this information does not apply, I would suggest caution in all areas of security if I were you.

A Backdoor is a software program that gives an attacker unauthorized access to a machine and the means for remotely controlling the machine without the user's knowledge. A Backdoor compromises system integrity by making changes to the system that allow it to by used by the attacker for malicious purposes unknown to the user.

One or more of the identified infections is a backdoor trojan.
This allows hackers to remotely control your computer, steal critical system information and Download and Execute files
I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063

Please let us know what you have decided to do in your next post.

Thanks