Internet Problem: I'm condemned to repeat the past??

[samifan24]

Lately I've been having a weird problem: while at class, I come back to my computer and I have found both IE and Mozilla browser windows open to sites I haven't visited in a couple of days. I did not leave these windows open! My virus definitions are already up to date so I know that isn't the problem and I run Adaware and Spybot on a regular basis as well. I cleaned out my IE history as well and today it was an IE window that was open when I returned from class. Does anyone have any idea what could be causing such an odd problem?

[rkmsuf]

You are going insane?

[DaddyTorgo]

roomies messing with your mind??

[samifan24]

roomies messing with your mind??

No, I have my own apartment.

[fantastic flying froggies]

No, I have my own apartment.
Then, the cleaning lady messing with your mind ?

[rkmsuf]

Did you feed them past midnight again?

[samifan24]

Then, the cleaning lady messing with your mind ?

No roommates, no cleaning lady, no pets of any kind!

[flere-imsaho]

Somewhat Related. (http://www.computing.net/security/wwwboard/forum/12836.html)
Also kinda useful. (http://www.annoyances.org/exec/forum/winme/t1065081114)

I'll look for the mcc.exe thing first (see first link). If that isn't it try a new keyboard/mouse or try unplugging them when you're away from the computer for a while and see if the problem continues.

Relatedly, you could install a keylogger and thus see if the windows are being opened by phantom keyboard or mouse commands, or if a trojan/virus is spawning the processes.

[Breeze]

Your browser's been hijacked

[samifan24]

Somewhat Related. (http://www.computing.net/security/wwwboard/forum/12836.html)
Also kinda useful. (http://www.annoyances.org/exec/forum/winme/t1065081114)

I'll look for the mcc.exe thing first (see first link). If that isn't it try a new keyboard/mouse or try unplugging them when you're away from the computer for a while and see if the problem continues.

Relatedly, you could install a keylogger and thus see if the windows are being opened by phantom keyboard or mouse commands, or if a trojan/virus is spawning the processes.

Well I checked out the Task Manager under "running processes" and mcc.exe was nowhere to be found.

[samifan24]

Your browser's been hijacked

I didn't know browsers could be hijacked. :eek: What can I do?

[rkmsuf]

Bat-signal

[samifan24]

Ok, I downloaded Hijackthis! The log is below:

Logfile of HijackThis v1.98.2
Scan saved at 1:31:40 PM, on 9/22/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\runservice.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\SM1BG.EXE
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\devldr32.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\SEGA\NHL Eastside Hockey Manager\hm1.exe
C:\Documents and Settings\Owner.BRENDAN-GOZZN3S\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2904844a01fe9a20e501/netzip/RdxIE601.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.dll
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4308/mcfscan.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by9fd.bay9.hotmail.msn.com/activex/HMAtchmt.ocx


Can anyone decipher this? As far as I can tell, I don't have the mcc.exe trojan which would "hijack" my browser and, in comparing my list to others I've seen online, I actually don't have very much running in the background.

[hoosierdude]

Do you have any of your programs set for automatic updates? I see real.com as a download (O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2904844...ip/RdxIE601.cab)

Do you have anything else that you allow access without your intervention to access the Net and download? I would also sign up over at the forums for Hijack This and post your problem and this print out. They should be able to help as well.

[samifan24]

Some programs are set for automatic update, especially my McAfee antivirus software, but I went into ZoneAlarm and double checked and removed Internet access from programs which I was unsure of. As for Real.com, I have no idea what that is because I hate RealPlayer and never use it and don't even have it installed on my system.

[Breeze]

There are some steps on how to regain control of your browser at the link below. The steps are at the bottom following some descriptions of hijacked browsers. However, you have an advanced version (probably newer than the steps on this site), because it not only takes over your browser but opens it.

I had this at work. I was able to overcome it by doing some registry settings, but it took a bunch of research.

Good Luck, sorry I can't be of more help.

There are some forums on the Internet that can help with this issue.


http://www.geekgirls.com/net_hijacked.htm

[primelord]

Hang out geekgirls.com a lot do ya Breeze? :)

[Breeze]

Yeah...I like them to look like librarians. :D

Actually, I can't remember where I went to find the information on how to fix my computer, so I did a search and found these steps. They involve going into the registry, which I had to do several times, so I figured they might work.

[klayman]

Sorry. It was me. I didn't think it would be a problem.