Browser Hijacker Extreme

ross1420 · Apr 9, 2004

I have cable and I noticed a few days ago that my IE6.0 would pop-up junk ads for casinos and search engines and basically junk. Mind you, I had not opened IE myself - the computer did while I was using a different prog.

I got HJT and after scanning found Xke3.exe in my Startup list. I unchecked it, restarted, and found a new executable listed in Startup - BpaEG.exe. I went to the System32 folder and deleted it. Back to the Startup list, I found Srohe2nf.exe listed. Deleted that - Xej7.exe replaced it. Deleted that and IkxNu62.exe replaced it.

HJT did not solve this problem. Neither did CWShredder. On to Safe Mode in an attempt to get rid of whatever this thing is. After I entered Safe Mode, I deleted IkxNu62.exe from the System32 folder and went to the Startup List. I unchecked it and nothing replaced it.

Reboot produced no new problems. Does anyone know what the heck this thing is/was? Also is there anything listed below that I should get rid of? Thanks!

- ross1420

________________________________________________________________
HJT log is as follows:

Logfile of HijackThis v1.97.7
Scan saved at 10:23:54 AM, on 4/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\pc1\My Documents\PC PROTECT FILES\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Real Estate Investing Computer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37934.3977662037
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4321/mcfscan.cab

Flrman1 · Apr 9, 2004

Hi ross1420

Welcome to TSG!

Run Hijack This again and put a check by these. Close all windows except HijackThis and click "Fix checked"

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html

Restart your computer.

ross1420 · Apr 9, 2004

I did what you suggested but what did it accomplish for me? It deleted my Homepage (which is an HTML page on my PC that I created and use daily). I reset the homepage once again, therefore it's listed in the HJT log again. Here's the new log (below). Also, any word on what "nasty" my PC originally had?

- ross1420

_________________________________________________________________
HJT LOG

Logfile of HijackThis v1.97.7
Scan saved at 10:39:36 AM, on 4/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Documents and Settings\pc1\My Documents\PC PROTECT FILES\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/D_DRIVE_OLD/ROSS%20REI%20FILES%20PORTFOLIO%20SITE/index2.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Real Estate Investing Computer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37934.3977662037
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4321/mcfscan.cab

Flrman1 · Apr 9, 2004

Sorry about that. It is rare to see an HTML page like that willingly created by the user.

Your log is clean.

It's hard to say exactly what hijacker you had without seeing it in the log. From the random files you said you deleted, it looks like you had the peper trojan.

ross1420 · Apr 9, 2004

Thanks for your assistance! Hopefully, McAfee will catch it next time.

Flrman1 · Apr 9, 2004

My pleasure!

Browser Hijacker Extreme

ross1420

Flrman1

ross1420

Flrman1

ross1420

Flrman1

Top Contributors this Month