Browser Hijack?

A short time ago my browswer (IE5.5, recently upgraded from 5.0) started showing evidence of being hijacked. Sometimes when it started up and sometimes during use it would link to one of a number of pages and thence on to various porn sites. In fact on start up it would sometimes do this even though not connected to the internet.

The original links seen have been to pages on www7.paypopup.com, kathic.offshorechicks.com, www.xtrocash.org,www.exitorcash.com,www.cashexits.com.

Scans with AdAware and SpyBot Search and Destry have revealed nothing in particular and currently I've got my machine protected by AdSubtract and PopUpCop, which are doing fine in closing down the windows but are also having a detrimental effect of closing things I might want.

I have been a little suspicious of a module IstSVCwnd because I don't know what it is or where it came from and it sometimes is the cauise of machine hangs.

A recent connection also gave cause for doubt (incuding the word 'ist') when PopupCop said that a site was trying to download 'FREE SEX-XXXTOOLBAR' with a requesting web page of http://www.slotch.com/ist/scripts/istsvc_ads.php?version=1005...etc
and a download location of http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab


I'm running Win2000pro behing Outpost firewall and with (up to date) AVG virus scanner.

Any suggestions would be appreciated.

you need to get yourself ad aware
sounds like you got some nasty spyware.

Also delete your temp internet files and cookies.

From my original message you'll see that I said, "Scans with ***AdAware*** and SpyBot Search and Destry have revealed nothing in particular".

I've also cleared all temp. Inet files, including cookies. But it surely needs a program to be running to insert code into my local home page in order to cause the links to be set.

K.

Ken,try a small program called HijackThis:

HijackThis, a general homepage hijackers detector and remover.

Initially based on the article Hijacked!, but expanded with almost a dozen other checks against hijacker tricks. It is continually updated to detect and remove new hijacks.

It does not target specific programs/URLs, just the methods used by hijackers to force you onto their sites. As a result, false positives are imminent and unless you are sure what you're doing, you should always consult with knowledgable folks (e.g. the forums) before deleting anything.

download here

Many thanks Rev. I've had a look with HijackThis and it's shown up a lot of clearly dodgy things!

Suspicion is clearly pointed at IstSVC!

Also consider trying Mozilla. It has easy to configure tools to block the material that is giving you problems.

www.mozilla.org

I like mozilla very much. I have checked and it uses far less resources than say Internet explorer. This is great for people with older hardware that still want to surf. Give mozilla a shot, and press CONTROL-T to launch a new tab. I hit that combination 5-6 times, and then can surf on all my favorite sites at once :D

I also like Opera too.

This thread sounds like it was a response to a problem in another thread, is it?:D

remember to look in add/remove programs in control panel for any suspicious looking programs and remove them,

something is turning your computer into a possible webserver.

use this online scanner to see if it finds anything avg missed
http://housecall.antivirus.com/housecall/start_corp.asp

you should also contact lavasoft (ad-aware) and inform them of this software that is causing you grief.

they may already know about it and might have an update you can try.
contact them here
mailto:[email protected]

let us know any results

cheers
egghead

That could be the LOP spyware as it is very hard to remove, even Spybot cannot remove it.

Lop.com
Last updated Sep. 25, 2002
Lop.com has become one of the most hated names on the internet. All over cyberspace, from message boards to newsgroups to IRC chat rooms I've seen people begging for help in getting rid of this annoying software.

What is lop.com? Lop.com is a web site owned by C2 Media. It is mainly a pay-per-click search portal where other web sites pay for each click-through to their site via lop. This isn't a terrible idea, but rather than create a quality web site to get surfers to their site and clicking those links, they instead created a program which is labeled variously as an mp3 search program, a porn search program, or some other such thing. The installer turns the user's web browser into a device with a seemingly endless supply of links to lop.com.

An early version (installer name download_plugin.exe) installs two files in the user's wallpaper folder, one an html file and the other a shockwave file. The html file contains code to load the shockwave file. The installer sets the html file as the user's wallpaper so that the flash search engine program is sitting on the desktop at every boot. The flash file does little more than open and close a series of collapsible menus containing more lop internet shortucts and a search function which queries - take a guess - lop.com.

A later version (installer name mp3serch.exe) omits this desktop feature as its bugginess reportedly led to its being discontinued. Both versions install a stripped down browser which uses the Internet Explorer web browser engine. This browser automatically launches the following URL:
h**p://www.mp3search.com.

Not content to leave the user with this browser, the lop installer also makes dramatic changes to Internet Explorer, Mozilla Navigator, and most likely Netscape Navigator. The default search engine pages, toolbar settings, and start page are changed. The lop installer adds scores of internet shortcuts in Internet Explorer's Favorites folder and in Mozilla's Bookmarks.htm file. The download_plugin.exe version does not alter Mozilla Navigator.

These lop installers create a BHO which produces an accessories toolbar in Internet Explorer full of - you guessed it - even more lop.com internet shortcuts. This BHO also takes control of the browser to make it redirect to lop.com if there is some error loading a page. This BHO is named plg_ie0.dll. As with all BHOs, it can be disabled with BHODemon, although I've had two users report that after disabling it, another BHO was automatically generated with the name plg_ie1.dll.



read the rest here,
http://www.spywareinfo.com/articles/lop/

have you updated the DAT files for adaware? then rescan.

Conan - You are right. I sure got my signals crossed here. I was trying to respond to the hijacked browser issue. Don't know how I started a new thread.

By the way BB - You can also open a link in a new tab by pressing the scroll wheel. I find that more convienient than the two handed Contrl-T command. Also it the tab bar is open, you can right click on a blank part of the bar to get a drop-down menu to do a number of tab functions.

:D Thanks for the tip, but it doesn't work on my laptop. No scroll wheel :(

Merged EFC's Thread with this one :D

You can also use a program BHO Demon. It tells you what Browser Helper Objects (BHO) are installed. BHO's are the typical cause of Browser Hijacks.

You can get the application here.

OK, this seems to have spawned a lot of other issues but my original hijack issue seems to have been resolved. By the careful use of "HijackThis" it looks like the main culprit was something called IstSVC.

One thing I have discovered, however, is that whilst there are a great many such programs around - those that protect you from such nasties, those that detect that you've got them and so forth, it seems that the best protection is *as much as you can get*!!!

There's so much out there trying to get at your machine that the more protection you've got the better!

off topic:
can someone post a reply in this thread,i need to test something out.

Thanks.

Reply.:p

Thanks Barb. :)

Testing finished.

Quote:

---

Originally posted by efc
Also consider trying Mozilla. It has easy to configure tools to block the material that is giving you problems.

www.mozilla.org

---

Shameless ad: Or Mozilla Firebird, if you want a standalone browser.

i downloaded the HijackTHIS onto my computer and this was the results, what should i delete?
Logfile of HijackThis v1.99.1
Scan saved at 3:58:48 PM, on 12/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\gsicon.exe
C:\WINDOWS\system32\dslagent.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\הפוך על הפוך\Hebrew.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\Software602\Print2PDF\PrnPack.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\WINDOWS\euqtvd.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\Program Files\Zhfh\Mhqac.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Rivka Goldfarb.GOLDFARB\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://office.microsoft.com/clipart/....aspx?lc=en-us
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{01E69986-A054-4C52-ABE8-EF63DF1C5211} - (no file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem303.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Hebrew] C:\Program Files\???? ?? ????\Hebrew.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [PrintPack dispatcher] "C:\Program Files\Software602\Print2PDF\PrnPack.exe" /server
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [LhGGdZRaJ] C:\WINDOWS\euqtvd.exe
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [Lh$vשץš/‚²‘ֶfֿNb‰C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\euqtvd.exe
O4 - HKLM\..\Run: [Fcixkf] c:\Program Files\Zhfh\Mhqac.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Print2PDF - {5B7027AD-AA6D-40df-8F56-9560F277D2A5} - C:\WINDOWS\system32\Print602.dll
O9 - Extra 'Tools' menuitem: Print2PDF - {5B7027AD-AA6D-40df-8F56-9560F277D2A5} - C:\WINDOWS\system32\Print602.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {03177121-226B-11D4-B0BE-005004AD3039} (UploaderCtrl Class) - http://members7.clubphoto.com/_img/u...l_uploader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.clarkcolor.com/ClarkActivia.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/012bd095...p/RdxIE601.cab
O16 - DPF: {90051A81-3018-4826-8B38-DD60B6B53F9C} (Snapfish File Upload ActiveX Control) - http://www.clarkcolor.com/ClarkUpload.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.fujiprintnet.co.il/online...eUploader3.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

Well at first glance the Internet Optimizer should go as well as istsvc.exe which is "an advertising program by Integrated Search Technologies. This process monitors your browsing habits and distributes the data back to the author's servers for analyses. This also prompts advertising popups. This program is a registered security risk and should be removed immediately." Description courtesy of http://www.liutilities.com/products/...ibrary/istsvc/

But, exactly what problems are you having?

past week i started getting pop-ups. if i leave the computer "unattended" for a short while i start getting problems such as
a. MSEPSVCS.EXE application error
b. the instruction at "0X00320676" reference memory at "0X0000003C" the memory could not be "read". click to terminate the program/click cacel to debug the program.
c. insufficien system resorces exist to complete the requested service.
d. istsvcwnd (ending program)
optimize.exde encountered a program
e. msepsvcs. exe has encountered a problem
f. fcatmfd.exe application error dll initialization failed
g. internet explorer encountered a problem and needs to close
h. condition #5022-units-1782

all or some of these problems happend and i need to restart my computer all the time.

ok, well remove those 2 I mentioned in the first post, and see what happens after rebooting.

thank you so far things are ok.

Please let us know how it goes and...


Welcome to Techzonez.


:welcome:

the computer is working ok. thanx. microsoft internet explorer is working really slow and even though i blocked all popups i am still getting a pop[up from http://ad.yieldmanager.com. i restricted the site in the internet options, but it doesnt seem to hlep.
any ideas???

1. Try searching out and running CWShredder - it could be you've got one of the many variants of CoolWebSearch infecting your machine.

2. Switch to another browser - Firefox is currently the favoured alternative but the latest incarnation of Opera could well challenge it.

the CWShredder doesnt come up with anything. i use firefox but cannot use it fora ll the things i need to do.
but thanx anyway!

Are you familiar with using MSCONFIG? If so turn off all startup items and non-Microsoft services. After rebooting see if you still get the popups.

Hi drivkky,Rev mentioned you should check with the forums for any help with the hijackthis logs, it's also worth noting that you can also post your own log here http://www.hijackthis.de/index.php?langselect=english
It looks as if you have a few nasties.

Download and run mwav.exe from microworld inc it should identify all of your poot and if you then want it to rid them for you - you can pay the $9 and woohoo it does that too!!