Browser Hijack ? / Computer Science / Forums

Forums

4hv.org :: Forums :: Computer Science

« Previous topic | Next topic »

Browser Hijack ?

Move Thread

LAN_403

Dr. Slack

Sun Oct 26 2008, 08:35PM

Registered Member #72 Joined: Thu Feb 09 2006, 08:29AM
Location: UK St. Albans
Posts: 1659

Any help appreciated.

My duaghter's PC seemed to have a browesr hijack on it, clicking Google search links went to virus software pushing sites or Porntube, copying the links and pasting into the adddress seemed to work better. I tried to update my AV to finding spyware, but it said it couldn't find a web proxy, whatever settings I put in. IE and Firefox both still appear to connect to the net quite happily. I then tried installing Spybot S&D, and it couldn't get onto the net at 127.0.0.1, so wouldn't install. I checked my hosts file, and 127.0.0.1 localhost was the only entry. I then tried AdAware, which found a zillion infections (perhaps I should've recorded what they were, and now I can't find the log), removed them and rescanned, and it was decalred clear. The browesr redirect seems to have gone, however I still can't install Spybot? To my untutored eye, nothing jumps out at me from a HijackThis log, it's quite short and all looks legit, I'll post it to their forum, though would prefer to do a Spybot scan first. There's nothing obvious in the process list or installed programs either. CWshredder finds nothing.

How do I find out why AntiVir and Spybot can't find a web connection? I've not looked at registry entries yet. Are there any utilities that would tell me either what things there are on my machine to connect to, or what AV and Spybot are trying to connect to? I wonder if there is a Spybot install that doesn't need web connect (goes to search ...) ? On another machine, the spybot install suceeds, there it wanted to connect to 87.106.2.233.

System is Sempron, XP(SP3), with a wired connection to Dlink hub/ADSL

Interstingly the machine won't now start up in safe mode; as the list of drivers goes whizzing by, it stalls at the graphics driver gagp30kx.sys which could be a clue. I thought that all graphics adapters had a default plain vanilla VGA mode, and that safe used the minimum number of drivers? Is this related, how might I fix this?

The nuclear option is, of course, a rebuild ( she'll love rebuilding her Sims universe if it won't export)
<edit> No, not gone, one of the google redirects is to lovingclicks, and it intercepts access to security sites like free-av.com, and presumably what spybot is trying to connect to, though there's still nothing that adaware doesn't like </edit>

<edit> A while ago I did try to download windows defender, but couldn't, as I couldn't understand what I needed to do to download the downloader, each downloader appeared to need a different one, and eventually gave up </edit>

<edit> as expected, 87.106.2.233 is the spybot site, so the hijacker is reditrecting it, however hosts is still clean, and there is no occurence of "87.106" in the registry, so it's presumably buried deeper than that. How else will the redirection be mediated? </edit>

Bjørn

Mon Oct 27 2008, 08:52AM

Registered Member #27 Joined: Fri Feb 03 2006, 02:20AM
Location: Hyperborea
Posts: 2058

I recommend this online scanner:

it often finds things that other methods fail to detect.

gagp30kx.sys seems to be an AGP driver that is needed since plain VGA does not exist anymore after the ISA bus got replaced. It seems that it is quite common for it to hang during boot for different reasons so it might be a coincidence.

You should also look for rootkits to be sure there is nothing hiding that virus scanners can't find. For example by using one of these:

Steve Conner

Mon Oct 27 2008, 11:03AM

Registered Member #30 Joined: Fri Feb 03 2006, 10:52AM
Location: Glasgow, Scotland
Posts: 6706

Boot and nuke! Boot and nuke!

Ken M.

Wed Oct 29 2008, 05:22AM

Registered Member #618 Joined: Sat Mar 31 2007, 04:15AM
Location: Us-Great Lakes
Posts: 628

It might lso be a new version of hacking, I read about in a co workers IEEE mag, where you can hijack an isp cache causing the isp to redirect a persons browser to a website that looks like a legitimate website but is actually a malicious website.

Dr. Slack

Sun Nov 02 2008, 08:15AM

Registered Member #72 Joined: Thu Feb 09 2006, 08:29AM
Location: UK St. Albans
Posts: 1659

Searching to post the hijackthis log led me to techsupportforum.com, an army of whitehats who like nothing more than to lead noobs by the hand through a disinfecting process, I would thoroughly recommend them. It took combo-fix with a custom script to sort it. Clean now, without a rebuild.

Carbon_Rod

Mon Nov 03 2008, 07:32PM

Registered Member #65 Joined: Thu Feb 09 2006, 06:43AM
Location:
Posts: 1155

Indeed, the B&N option is the most robust solution.
If and only if you are NAT firewalled, the only host infected, and use safe media when reinstalling.

Some malware systems use a known worm or trojan to bait an AV scanning process. So the AV appears to "work", but the newest Windows plague includes some armored code that tricks the AV into killing & quarantining well known firewall components (finding out Zonelab's products were vulnerable to such issues was surprising.)

The end result is the user feels the system has resumed normal operation, and the remaining firewall appears to be functioning... except the process is not the firewall anymore.

This hit a few of our local systems last week, and was isolated on Saturday.

Often recommend for novice users:
Ubuntu 8.10
Pigeon (MSN chat, Yahoo! IM, IRC )
Firefox + noScript + adBlock Plus
Qemu w/ kernel mod + XP image (read only OS image)

Cheers,

Conundrum

Mon Nov 10 2008, 06:56PM

Registered Member #96 Joined: Thu Feb 09 2006, 05:37PM
Location: CI, Earth
Posts: 4061

Grr. Yeah I heard something about another variant that replaces the antivirus as well after first disabling the "real" antivirus. Pretty evil, when will these scumbags get a real job instead of writing fraudware?

I say sentence a few of them to 25 years w/out parole. that'll learn them.

Moderator(s): Chris Russell, Noelle, Alex, Tesladownunder, Dave Marshall, Dave Billington, Bjørn, Steve Conner, Wolfram, Kizmo, Mads Barnkob