Spy Hijacked IE HOME ADDRESS

[Guest]

Hello my mothers computer recently got hit by a major virus. I think I have
fixed and quarantined all the viruses, however someone has hijacked her IE
"Home Address". I have tried Norton, Adaware, and AVG to no avail. The
hijacker advertises their antispyware "ie we can fix your problem" along with
4 other partner sites. What it does, is allows each of their sites to
alternate advertising, along with casino and porn sites as well. It gets past
"pop-up" protection also. I am pretty good with the registry, but they have
obviously hid there posting in the registry with numeric codes or something I
cannot ID. Does anyone know of any Malware out there that can find this
entry or can tell me where exactly in the registry to look. I have not tried
re-installing IE6 and somehow the viruses have destroyed going back to a
previous registry entry. Any suggestions would be greatly appreciated, thank
you.

 

[Ground Cover]

I got rid on one of those through Add/Remove programs. That's all it took.
But most insinuate themselves into the system are are more difficult to
remove. Here's just some of many links to removing malware:

[An approach to removing all Spyware, Adware and Malware from your computer]
http://www.michaelhorowitz.com/removespyware.html

Microsoft provides a discussion:

[Help: I Got Hacked. Now What Do I Do?]
http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx

This one includes a instructions for removing what you have .. "Malware
Parasites" .. they pretend to be legitimate malware removal software, but
are in fact the actual malware:

http://www.spywareremove.com/remove-Malware/index.html

There's a link ot a removal tool, but I wouldn't trust it yet. Regardless,
the webpage provides links to instructions on how to manually remove some of
these "malware parasites".

 

[David H. Lipman]

From: "mrbigbry" <[email protected]>

| Hello my mothers computer recently got hit by a major virus. I think I have
| fixed and quarantined all the viruses, however someone has hijacked her IE
| "Home Address". I have tried Norton, Adaware, and AVG to no avail. The
| hijacker advertises their antispyware "ie we can fix your problem" along with
| 4 other partner sites. What it does, is allows each of their sites to
| alternate advertising, along with casino and porn sites as well. It gets past
| "pop-up" protection also. I am pretty good with the registry, but they have
| obviously hid there posting in the registry with numeric codes or something I
| cannot ID. Does anyone know of any Malware out there that can find this
| entry or can tell me where exactly in the registry to look. I have not tried
| re-installing IE6 and somehow the viruses have destroyed going back to a
| previous registry entry. Any suggestions would be greatly appreciated, thank
| you.



If you are using any version of Sun Java that is prior to JRE Version 5.0 update 5,
then you are strongly urged to remove any/all versions that are prior to JRE/JSE
Version 5.0 update 5. There are vulnerabilities in them and they are actively being
exploited. It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE/JSE Version 5.0 Update 7
be installed ASAP.

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version...

C:\Program Files\Java\jre1.5.0_07


http://www.java.com/en/download/manual.jsp



For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/
http://www.lavasoft.de/ms/index.htm

* SpyBot Search and Destroy v1.4
http://security.kolla.de/
http://www.safer-networking.org/microsoft.en.html

* SuperAntiSpyware
http://www.superantispyware.com/superantispywarefreevspro.html

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *

 

[Guest]

Be aware that some malware will come with its own backup files that restore
it at logon. Unfortunately, the names of the backup files are periodically
changed so that anti-spyware programs won't be able to find them. If your
problem continues to occur, and you know the date the first occurance, search
for .exe files with that create/modify date. If you find 1 or 2 files with
gibberish names, wd8frk.exe, for example, these may be the backups. Goolge
the names to see if they are legitimate. If you don't find them on Google,
move them to a temp folder. If the problem goes away, the temp folder can be
deleted.

Paul Shafer, MCDST

From: "mrbigbry" <[email protected]>

| Hello my mothers computer recently got hit by a major virus. I think I have
| fixed and quarantined all the viruses, however someone has hijacked her IE
| "Home Address". I have tried Norton, Adaware, and AVG to no avail. The
| hijacker advertises their antispyware "ie we can fix your problem" along with
| 4 other partner sites. What it does, is allows each of their sites to
| alternate advertising, along with casino and porn sites as well. It gets past
| "pop-up" protection also. I am pretty good with the registry, but they have
| obviously hid there posting in the registry with numeric codes or something I
| cannot ID. Does anyone know of any Malware out there that can find this
| entry or can tell me where exactly in the registry to look. I have not tried
| re-installing IE6 and somehow the viruses have destroyed going back to a
| previous registry entry. Any suggestions would be greatly appreciated, thank
| you.



If you are using any version of Sun Java that is prior to JRE Version 5.0 update 5,
then you are strongly urged to remove any/all versions that are prior to JRE/JSE
Version 5.0 update 5. There are vulnerabilities in them and they are actively being
exploited. It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE/JSE Version 5.0 Update 7
be installed ASAP.

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version...

C:\Program Files\Java\jre1.5.0_07


http://www.java.com/en/download/manual.jsp



For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/
http://www.lavasoft.de/ms/index.htm

* SpyBot Search and Destroy v1.4
http://security.kolla.de/
http://www.safer-networking.org/microsoft.en.html

* SuperAntiSpyware
http://www.superantispyware.com/superantispywarefreevspro.html

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *