browser hijacker, no anti-virus can detect

Hi all,

I have found virus on my computer but the anti virus software cannot
find. The virus is a browser hijacker, when I visit www.ebay.co.uk, the
first page of ebay will be modified to redirect to uk.ebayobjects.com.
Apart from this, I didnt find anything else it does and it didnt modify
ebay.com or other websites. It will also open new browser windows to
show advertisement. I am not sure whether they are one or two virus,
but it is really annoying. Norton Antivirus and Xoftspy cannot detect
the virus. Can anybody help me? Thank you very much.

Chenxi

If you have 2000 or XP then try Ewido's online scan. If it detects nothing
and does not fix the issue then download and run hijackthis, save a copy of
the log file and post here to this group so that it can be analyzed.

http://www.ewido.net/en/onlinescan/

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com



"Chenxi" <itschenxi@gmail.com> wrote in message
news:1143241842.112461.66120@t31g2000cwb.googlegroups.com...
> Hi all,
>
> I have found virus on my computer but the anti virus software cannot
> find. The virus is a browser hijacker, when I visit www.ebay.co.uk, the
> first page of ebay will be modified to redirect to uk.ebayobjects.com.
> Apart from this, I didnt find anything else it does and it didnt modify
> ebay.com or other websites. It will also open new browser windows to
> show advertisement. I am not sure whether they are one or two virus,
> but it is really annoying. Norton Antivirus and Xoftspy cannot detect
> the virus. Can anybody help me? Thank you very much.
>
> Chenxi
>

Chenxi wrote:
> Hi all,
>
> I have found virus on my computer but the anti virus software cannot
> find. The virus is a browser hijacker, when I visit www.ebay.co.uk, the
> first page of ebay will be modified to redirect to uk.ebayobjects.com.
> Apart from this, I didnt find anything else it does and it didnt modify
> ebay.com or other websites. It will also open new browser windows to
> show advertisement. I am not sure whether they are one or two virus,
> but it is really annoying. Norton Antivirus and Xoftspy cannot detect
> the virus. Can anybody help me? Thank you very much.
>
> Chenxi
=================
First of all please DO NOT post any HJT logs to this group, there are
many other places that specialize in analyzing the logs properly.

There is a site to do an on-line scan of your HJT log:
http://www.hijackthis.de/

Here is a cut and paste from one of Dave Lipman's posts. Feel free to
post your log to any one of them for more expert help, and please post
back results as it may help someone else in the future.
=================
Create a HJT log file and post it in one of the below locations...

Forums where you can get expert advice for HiJack This! (HJT) logs.
NOTE: Registration is REQUIRED before posting a log
NOTE: Web sites NOT listed in any particular order

http://aumha.net/viewforum.php?f=30
http://www.bleepingcomputer.com/forums/forum22.html
http://www.dslreports.com/forum/security
http://castlecops.com/forum67.html
http://www.wilderssecurity.com/forumdisplay.php?f=24
http://www.cybertechhelp.com/forums...isplay.php?f=25
http://www.geekstogo.com/forum/Malw...his_Logs_Go_Her...
http://gladiator-antivirus.com/foru...p?showforum=170
http://forum.iamnotageek.com/f-130.html
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://boards.cexx.org/viewforum.php?f=1
http://www.malwarebytes.biz/forums/...php?showforum=5

{ borrowed from the alt.privacy.spyware News Group }

--

Chenxi wrote:
> Hi all,
>
> I have found virus on my computer but the anti virus software cannot
> find. The virus is a browser hijacker, when I visit www.ebay.co.uk, the
> first page of ebay will be modified to redirect to uk.ebayobjects.com.
> Apart from this, I didnt find anything else it does and it didnt modify
> ebay.com or other websites. It will also open new browser windows to
> show advertisement. I am not sure whether they are one or two virus,
> but it is really annoying. Norton Antivirus and Xoftspy cannot detect
> the virus. Can anybody help me? Thank you very much.
>
> Chenxi

Hello,

I am the author of SUPERAntiSpyware. SUPERAntiSpyware Free Edition is a
100% free anti-spyware scanner. It should detect and remove this
problem for you:
http://www.superantispyware.com

Please let me know if you have any questions or suggestions. You may
wish to look at the reputation of posters before you download software
they recommend.

Nick Skrepetos
SUPERAntiSpyware.com - Removes ALL the Spyware, NOT just the easy ones!
http://www.superantispyware.com

pcbutts1 wrote:
> If you have 2000 or XP then try Ewido's online scan. If it detects nothing
> and does not fix the issue then download and run hijackthis, save a copy of
> the log file and post here to this group so that it can be analyzed.
>
> http://www.ewido.net/en/onlinescan/
>

I've never seen any statistics or data on how well Ewido works. I see
you think highly of it. Is there any data available that would show just
how efficient it is?

In article <bf6dndF0UpCvCLnZRVn-jg@comcast.com>, optik-
mechanik@invalid.net says...
> pcbutts1 wrote:
> > If you have 2000 or XP then try Ewido's online scan. If it detects nothing
> > and does not fix the issue then download and run hijackthis, save a copy of
> > the log file and post here to this group so that it can be analyzed.
> >
> > http://www.ewido.net/en/onlinescan/
> >
>
> I've never seen any statistics or data on how well Ewido works. I see
> you think highly of it. Is there any data available that would show just
> how efficient it is?

You would be better served to get the data from some source other than
PCBUTT1 - he appears to have no ethics, no morals, and pilfers others
works/products without their permission.

There are many scanners available to you, a simple search/reading of
this group will take you to links from the vendors actual sites.


--

spam999free@rrohio.com
remove 999 in order to email me

I've analyzed the log through hijackthis.de
although most of them are safe, below are two suspicious entries. I
dont quite understand how they would affect my machine and how to
remove them. anybody help?

=============
O17 -
HKLM\System\CCS\Services\Tcpip\..\{081588F8-8F5D-42C8-8D47-7555E1AE7124}:
NameServer = 202.102.152.3 202.102.128.68
Possibly nasty If this Domain does not belong to your ISP, or your
firms network, these entries should be fixed. 'SearchList' entries
should be fixed too.
Do you know the IP or Domain '202.102.152.3 202.102.128.68'? If not,
fix this entry.
O17 -
HKLM\System\CS1\Services\Tcpip\..\{081588F8-8F5D-42C8-8D47-7555E1AE7124}:
NameServer = 202.102.152.3 202.102.128.68
Possibly nasty If this Domain does not belong to your ISP, or your
firms network, these entries should be fixed. 'SearchList' entries
should be fixed too.
Do you know the IP or Domain '202.102.152.3 202.102.128.68'? If not,
fix this entry.

OMG, I've tried and installed ewido (activex) already. Shall I delete
the programme? will it do harm to my computer?

No it will do no harm. Ewido is not installed it is an online scan that
needs the active X to run.

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com



"Chenxi" <itschenxi@gmail.com> wrote in message
news:1143250545.587706.61340@t31g2000cwb.googlegroups.com...
> OMG, I've tried and installed ewido (activex) already. Shall I delete
> the programme? will it do harm to my computer?
>

well, I've checked ipconfig /all and found that the dns server is my
isp.

but why is ebay.co.uk modified, for example, the link which should be
http://computers.ebay.co.uk/ on the home page, is now
http://uk.ebayobjects.com/2c;292372...ers.ebay.co.uk/

is it deliberate?