Browser Hijacking

[Guest]

I am not sure if this is the right forum, if not please direct me to the
right one.
Yesterday at our school we have had what appears to be a browser hijacking.
It started with several staff members saying that they could not access the
internet. Everytime they tried they were directed to a RX Med web site.
There are a very few sites that don't get redirected, at least yet. The
address line showed the correct address but they were connected to the RX Med
site. At that time, the computer that I was using was unaffected, however,
shortly after it slowly started to show up on my computer. More and more
sites that I would go to would be redirected. I am unfamiliar with this type
of hijacking. How is it spread. We have Symantec CE anti-virus with
definitions upto date and it doesn't find anything. I also have run ad-aware
and bhodemon, and they find nothing. I can access all the site from
computers off the school site. Sorry to ramble on, but I don't know how else
to explain it.
Any HELP would be greatly appreciated. I just don't know what to look for
anymore.

Thanks in advance
aj

 

[Thomas Hempen]

I am not sure if this is the right forum, if not please direct me to the
right one.
Yesterday at our school we have had what appears to be a browser hijacking.
It started with several staff members saying that they could not access the
internet. Everytime they tried they were directed to a RX Med web site.
There are a very few sites that don't get redirected, at least yet. The
address line showed the correct address but they were connected to the RX Med
site. At that time, the computer that I was using was unaffected, however,
shortly after it slowly started to show up on my computer. More and more
sites that I would go to would be redirected. I am unfamiliar with this type
of hijacking. How is it spread. We have Symantec CE anti-virus with
definitions upto date and it doesn't find anything. I also have run ad-aware
and bhodemon, and they find nothing. I can access all the site from
computers off the school site. Sorry to ramble on, but I don't know how else
to explain it.
Any HELP would be greatly appreciated. I just don't know what to look for
anymore.

Thanks in advance
aj

Hi aj,

I have never experienced that kind of hijacking as well. But did you
give this freeware a try?
http://www.tomcoyote.org/hjt/
It's called HijackThis! and focusses on browser hijacking and those
"toolbars".

I myself use it very often to get rid of those hijackers. But you should
know about basics of the registry, or else you could mess your whole
system up.

Greetings,
Thomas

 

[Chuck]

Hi aj,

I have never experienced that kind of hijacking as well. But did you
give this freeware a try?
http://www.tomcoyote.org/hjt/
It's called HijackThis! and focusses on browser hijacking and those
"toolbars".

I myself use it very often to get rid of those hijackers. But you should
know about basics of the registry, or else you could mess your whole
system up.

Greetings,
Thomas

Thomas,

HijackThis is a good component in analysing and removing this type of attack.
But just a component. And HJT, without expert advice, is dangerous and useless.
Examining a HJT log, without experience and training, is not a good idea.

AJ, please start by downloading each of the additional following free tools:
CWShredder <http://www.majorgeeks.com/download4086.html>
HijackThis <http://www.majorgeeks.com/download.php?det=3155>
LSP-Fix and WinsockXPFix <http://www.cexx.org/lspfix.htm>
Spybot S&D <http://www.safer-networking.org/index.php?page=download>
Stinger <http://us.mcafee.com/virusInfo/default.asp?id=stinger>

Create a separate folder for HijackThis, such as C:\HijackThis - copy the
downloaded file there. Spybot S&D has an install routine - run it. The other
downloaded programs can be copied into, and run from, any convenient folder.

First, run Stinger. Have it remove any problems found.

Next, close all Internet Explorer and Outlook windows, and run CWShredder. Have
it fix all problems found.

Next, run AdAware. First update it ("Check for updates now"), configure for
full scan (<http://forums.spywareinfo.com/index.php?showtopic=11150>), then
scan. When scanning finishes, remove all Critical Objects found.

Next, run Spybot S&D. First update it ("Search for updates"), then run a scan
("Check for problems"). Trust Spybot, and delete everything ("Fix Problems")
that is displayed in Red.

Then, run HijackThis ("Scan"). Do NOT make any changes immediately. Save the
HJT Log.
<http://forums.spywareinfo.com/index.php?showtopic=227>
<http://forums.spywareinfo.com/index.php?showtopic=11150>

Finally, have your HJT log interpreted by experts at one or more of the
following security forums (and please post a link to your forum posts, here):
Aumha: <http://forum.aumha.org/index.php>
Net-Integration: <http://forums.net-integration.net/>
Spyware Info: <http://forums.spywareinfo.com/>
Spyware Warrior: <http://spywarewarrior.com/index.php>
Tom Coyote: <http://forums.tomcoyote.org/>

If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.

Finally, improve your chances for the future.

Harden your browser. There are various websites which will check for
vulnerabilities, here are three which I use.
http://www.jasons-toolbox.com/BrowserSecurity/
http://bcheck.scanit.be/bcheck/
https://testzone.secunia.com/browser_checker/

Block Internet Explorer ActiveX scripting from hostile websites (Restricted
Zone).
<https://netfiles.uiuc.edu/ehowes/www/main.htm> (IE-SpyAd)

Block known dangerous scripts from installing.
<http://www.javacoolsoftware.com/spywareblaster.html>

Block known spyware from installing.
<http://www.javacoolsoftware.com/spywareguard.html>

Make sure that the spyware detection / protection products that you use are
reliable:
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Harden your operating system. Check at least monthly for security updates.
http://windowsupdate.microsoft.com/

Block possibly dangerous websites with a Hosts file. Three Hosts file sources I
use:
http://www.accs-net.com/hosts/get_hosts.html
http://www.mvps.org/winhelp2002/hosts.htm
(The third is included, and updated, with Spybot (see above)).

Maintain your Hosts file (merge / eliminate duplicate entries) with:
eDexter <http://www.accs-net.com/hosts/get_hosts.html>
Hostess <http://accs-net.com/hostess/>

Secure your operating system, and applications. Don't use, or leave activated,
any accounts with names or passwords with trivial (guessable) values. Don't use
an account with administrative authority, except when you're intentionally doing
administrative tasks.

Use common sense. Yours. Don't install software based upon advice from unknown
sources. Don't install free software, without researching it carefully. Don't
open email unless you know who it's from, and how and why it was sent.

Educate yourself. Know what the risks are. Stay informed. Read Usenet, and
various web pages that discuss security problems. Check the logs from the
security products that you use regularly, look for things that don't belong, and
take action when necessary.

How did I get infected in the first place?
http://forums.net-integration.net/index.php?showtopic=3051
Essential tips for infection prevention
http://forums.spywareinfo.com/index.php?showtopic=24339

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Guest]

AJ,

One thing that seems to have been missed amongst all of the feedback was to
tell you to run, for example Ad-Aware, in Safe mode. And to make sure that
any data has been backed-up. Depending upon the level of infection, the
removal process of the infections may render your system a paperweight.

You should be aware that since more system files are in use while operating
in normal mode, some files will not be able to be scanned. Thus missing the
opportunity to be fixed. It has been my experience that if you have the
infections that you describe, you will need to perform the scans in safe mode
to get them all.

I personnally use Ad-Aware from lavasoftusa.com and I will perform a Full
System Scan on first use or if there are many infections. Like Chuck advised
make sure you perform the check for updates after the installation, before
the scan and before booting to safe mode. Also check for updates from time to
time after the first use and also check for program updates by returning to
the lavasoftusa.com website to check for new builds.

Regarding scanning. Rerun the scans until you get no more "criticals". You
did not say who you ISP is. Its been my experience that some ISP's seem to
gnerate more infections even on dial-up. And yes, the websites being visited
also have an impact.
You might want to scan once a week in the beginning to try to get a feel for
things.

You also might want to consider a software firewall like Zone Alarm from
zonelabs.com. Based upon the fact that friends beget friends, some of the
infections you have may also be retrieving other friends to continue the
infection. Products like Zone Alarm will alert you to the fact that a
program/process is attempting to gain internet access. Access will not be
granted unless you say so. I'm running XP Pro with SP2 which has a built-in
firewall, but I still run Zone Alarm as well working behind a hardware
firewall.

My point is that you should not depend upon one product to provide your
protection. This is the same advise that MicroSoft presents. A multi-layered
protection is the Rx. My advise also is based upon 25 years of corporate
computing tech support and development experience.

Best of luck and use Spybot carefully!

Don

 

[rich lockney]

This just happened yesterday where I work. It turned out the culprit
was the primary DNS server, and not any particular workstation.... So
spybot/ad-aware on a user machine won't find anything related to this.
How the DNS server was affected, I'm not sure yet... Just a heads up
that you may be barking up the wrong tree.

 

[Erik Heath]

This just happened yesterday where I work. It turned out the culprit
was the primary DNS server, and not any particular workstation.... So
spybot/ad-aware on a user machine won't find anything related to this.
How the DNS server was affected, I'm not sure yet... Just a heads up
that you may be barking up the wrong tree.

sounds to me like a directed route-poisoning problem.

Make sure you have the admins for your site check the DNS tables. It
sounds like something has added some entries to the tables that are
preventing them from routing your traffic to the correct websites.

Best of luck
Erik

 

[nettech]

sounds to me like a directed route-poisoning problem.

Make sure you have the admins for your site check the DNS tables. It
sounds like something has added some entries to the tables that are
preventing them from routing your traffic to the correct websites.

Best of luck
Erik

This is a root DNS server issue. And you should not troubleshoot the
issue from your location. Happened again today.