Help: Yahoo toolbar update hijacked IE (about:blank)

Discussion in 'malware problems & news' started by thanatos_theos, Jun 2, 2007.

Thread Status:
Not open for further replies.
  1. thanatos_theos

    thanatos_theos Registered Member

    Joined:
    Apr 28, 2007
    Posts:
    540
    My hompage is www.google.com. It changed to about:blank after I updated the yahoo toolbar. I can still change my homepage back to Google. However, after cleaning the pc with CCleaner and restarting it, the hompage reverts to about:blank again. This does not happen in the past. Any form of help will be greatly appreciated! Thanks.

    According to the net about:blank hijacker is a variant of cw. However, Trend's cwshredder did not find anything. According to this site http://www.securiteam.com/securityreviews/5RP0L0UD5U.html, I should fix these entries using reglite,

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
    res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
    res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
    res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
    res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP =
    about:blank

    I was not able to find such entries in the pc. Instead these entries showed up (I used hijackthis),

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.us.acer.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

    Adware Away 3.1.2 Trial found these 5 objects. I cannot fix them because the product is not registered.

    Auto Run: HKLM\Session\PendingFileRenameOperations=\??\C:\DOCUME~1\LOCALS~1\Temp\_iu14D2N.tmp
    IE UrlSearchHook(HKCU): {EF99BD32-C1FB-11D2-892F-0090271D4F88}=C:\Program Files\Yahoo\Companion\Installs\cpn01\yt.dll
    IE UrlSearchHook(HKLM): DefaultUrlSearchHook Missing=
    File Association: regfile=regedit.exe%1
    File Association: scrfile="%1" %*

    PS: My Trend Micro IS 2006 did not detect anything.

    thanatos
     
    Last edited: Jun 3, 2007
  2. OldMX

    OldMX Registered Member

    Joined:
    Sep 1, 2005
    Posts:
    170
    Install and update SUPERAntispyware and give a full computer scan, hope that helps

    oldmx
     
  3. thanatos_theos

    thanatos_theos Registered Member

    Joined:
    Apr 28, 2007
    Posts:
    540
    @OldMX
    I scanned the PC using SAS like what you said. But Adware Away still shows 4 problems. Auto Run: HKLM\Session\PendingFileRenameOperations=\??\C:\DOCUME~1\LOCALS~1\Temp\_iu14D2N.tmp is gone now. Here is the log of SuperAntiSpyware,

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 06/03/2007 at 02:21 PM

    Application Version : 3.8.1002

    Core Rules Database Version : 3248
    Trace Rules Database Version: 1259

    Scan type : Complete Scan
    Total Scan Time : 00:25:20

    Memory items scanned : 460
    Memory threats detected : 0
    Registry items scanned : 5762
    Registry threats detected : 6
    File items scanned : 27270
    File threats detected : 8

    Unclassified.Unknown Origin
    HKLM\Software\Classes\CLSID\{598F4775-6FB6-477B-9842-E0426824E077}
    HKCR\CLSID\{598F4775-6FB6-477B-9842-E0426824E077}
    HKCR\CLSID\{598F4775-6FB6-477B-9842-E0426824E077}
    HKCR\CLSID\{598F4775-6FB6-477B-9842-E0426824E077}\InprocServer32
    HKCR\CLSID\{598F4775-6FB6-477B-9842-E0426824E077}\InprocServer32#ThreadingModel
    C:\DOCUME~1\COMMIS~1\LOCALS~1\TEMP\~DP7.DLL
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598F4775-6FB6-477B-9842-E0426824E077}

    Adware.Tracking Cookie
    C:\Documents and Settings\Commission on Audit\Cookies\commission on audit@adinterax[1].txt
    C:\Documents and Settings\Commission on Audit\Cookies\commission on audit@doubleclick[1].txt
    C:\Documents and Settings\Commission on Audit\Cookies\commission on audit@ad.yieldmanager[2].txt
    C:\Documents and Settings\Commission on Audit\Cookies\commission on audit@realmedia[1].txt
    C:\Documents and Settings\Commission on Audit\Cookies\commission on audit@clicksor[2].txt
    C:\Documents and Settings\Commission on Audit\Cookies\commission on audit@atdmt[1].txt
    C:\Documents and Settings\Commission on Audit\Cookies\commission on audit@yadro[1].txt

    DP7.dll according to Trend was ADW AGENT.MIE. SAS said it was Unknown Origin.Unclassified.BHO (not sure). They both blocked it. The SAS Complete Scan seems to have deleted it completely. For now there are no real time notifications from Trend and SAS.

    I used the following repair utilities of SAS. Not sure if they were able to fix the problem.

    Home Page Reset
    Internet Zone Security Reset
    Local Page Reset

    Is Adware Away's detection of the Yahoo Toolbar a false postive? Help please.

    thanatos
     
  4. thanatos_theos

    thanatos_theos Registered Member

    Joined:
    Apr 28, 2007
    Posts:
    540
    I scanned using Adware Away 2.2.8.9. This version allows you to fix the problems even in trial. Unfortunately, its definition is not updated; 1/16/2006. The version 2.2.8.9 fixed these things,

    IE UrlSearchHook(HKCU): {EF99BD32-C1FB-11D2-892F-0090271D4F88}=C:\Program Files\Yahoo\Companion\Installs\cpn01\yt.dll
    File Association: regfile=regedit.exe%1
    File Association: scrfile="%1" %*

    I scanned using version 3.1.2 and now only 2 problems were found,

    Auto Run: HKLM\Session\PendingFileRenameOperations=\??\C:\DOCUME~1\LOCALS~1\Temp\_iu14D2N.tmp
    IE UrlSearchHook(HKLM): DefaultUrlSearchHook Missing=

    That is 3/5. The Auto Run: HKLM\Session\PendingFileRenameOperations=\??\C:\DOCUME~1\LOCALS~1\Temp\_iu14D2N.tmp is back again. Whenever IE is open, Adware Away always detects it. Help please... Has anyone encountered this problem also?

    PS: Are there any Adware Away or Yahoo people here in the forum? Please help me.

    Hoping,
    thanatos
     
    Last edited: Jun 3, 2007
  5. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
  6. thanatos_theos

    thanatos_theos Registered Member

    Joined:
    Apr 28, 2007
    Posts:
    540
    @snowbound
    Thanks snowbound. I posted a new thread in GSF regarding my problem.

    thanatos
     
  7. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    You're welcome and good luck. :)



    snowbound
     
  8. thanatos_theos

    thanatos_theos Registered Member

    Joined:
    Apr 28, 2007
    Posts:
    540
    LoPhatPhuud of GSF verified that the PC is clean. Thank you LoPhatPhuud :D.

    Thanks a lot,
    thanatos
     
  9. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    Good to see everything is as it should be. :thumb:



    snowbound
     
Loading...
Thread Status:
Not open for further replies.