Browser Hijacked....

Unknown
edited July 2004 in Spyware & Virus Removal
My browser got hijacked...On startup it defaults to 'youriskalka.com' and puts 4 bookmarks in my bookmarks folder. I tried updated versions of spybot, adaware and omegakiller that I downloaded from this site, but they didn't work. Here is my hijackthis log.

Logfile of HijackThis v1.98.0
Scan saved at 13:37:15, on 2004/07/28
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\system32\stisvc.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\mspmspsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\imejpmgr.exe
C:\WINDOWS\SYSTEM32\starter.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\MELCOINC\PC-MV3S\QuickTV.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\internat.exe
C:\windows\dllhlp.exe
C:\Program Files\SPACE INTERNATIONAL\CDSpace 4.0\LCDPlyer.exe
C:\Program Files\InterVideo\WinDVR\WinScheduler.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Bell\Local Settings\Temp\_AZTMP1_\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: ラジオ(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [EnsoniqMixer] C:\WINDOWS\SYSTEM32\starter.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [QuickTV] C:\Program Files\MELCOINC\PC-MV3S\QuickTV.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [dllhelp] c:\windows\dllhlp.exe
O4 - Global Startup: LCDPlayer.lnk = C:\Program Files\SPACE INTERNATIONAL\CDSpace 4.0\LCDPlyer.exe
O4 - Global Startup: InterVideo WinScheduler.lnk = C:\Program Files\InterVideo\WinDVR\WinScheduler.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O12 - Plugin for .cdx: C:\Program Files\Internet Explorer\plugins\Npcdp32.dll

Please help me get this thing deleted!!

Comments

  • vanagon40vanagon40 Indiana Member
    edited July 2004
    Welcome to Short Media.

    First, please move HJT out of the temporary directory and into its own folder (e.g. C:\HJT). HJT makes backups that can be used to restore necessary files that are inadvertently deleted. These backups will easily be lost or destroyed in the temporary folder.

    Next, make sure you can view hidden and system files: Instructions here => http://www.xtra.co.nz/help/0,,4155-1916458,00.html.

    Next, dllhlp.exe is a problem. The question is whether internat.exe is also a problem. Internat.exe is associated with Backdoor.Pointex (see => http://www.symantec.com/avcenter/venc/data/backdoor.pointex.html) . However, it may also be a legitimate program. Internat.exe is necessary for bilingual machines. The blue small square in the system tray where you can change the language you type in email messages cannot be displayed without enabling internat.exe. This applies to bilingual Windows only.

    You can check whether it is an original file by right clicking on the internat.exe icon and selecting properties > Select the version tab -> and verify that the information looks something similar to the following:
    Company Name: Microsoft Corporation
    Internal Name: INTERNAT
    Language : English (United States)
    Original Filename: INTERNAT.EXE
    Product Name: Microsoft(R) Windows(R) Operating System
    Product Version: 4.10.2222

    Assuming that internat.exe is NOT a problem, reboot in safe mode, run HJT and delete ("fix") the following:

    O4 - HKCU\..\Run: [dllhelp] c:\windows\dllhlp.exe

    Then, while still in safe mode, find and delete this file:

    c:\windows\dllhlp.exe

    Reboot normal, and post a new HJT log.
  • jomajp
    edited July 2004
    Hi there. It seems to have worked! I was able to set to a new startup page and delete the bookmarks, though we'll have to see if it's gone permanently.

    As for internat.exe, here are the specs:

    Company name: Microsoft Corporation
    Internal name: INTERNAT
    Language: Japanese
    Original filename: INTERNAT.EXE
    Product name: Microsoft(R) Windows (R) 2000 Operating System
    Product version:5.00.2920.0000

    I run Japanese windows (not NEC) by the way.

    Anyways, here's the new hijackthis log:


    Logfile of HijackThis v1.98.0
    Scan saved at 11:13:35, on 2004/07/29
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\MSTask.exe
    C:\WINDOWS\system32\stisvc.exe
    C:\WINDOWS\System32\WBEM\WinMgmt.exe
    C:\WINDOWS\System32\mspmspsv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\imejpmgr.exe
    C:\WINDOWS\SYSTEM32\starter.exe
    C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\MELCOINC\PC-MV3S\QuickTV.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\internat.exe
    C:\Program Files\SPACE INTERNATIONAL\CDSpace 4.0\LCDPlyer.exe
    C:\Program Files\InterVideo\WinDVR\WinScheduler.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\FinePixViewer\QuickDCF.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\hijackthis\HijackThis.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: ラジオ(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [EnsoniqMixer] C:\WINDOWS\SYSTEM32\starter.exe
    O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [QuickTV] C:\Program Files\MELCOINC\PC-MV3S\QuickTV.exe
    O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKCU\..\Run: [Internat.exe] internat.exe
    O4 - Global Startup: LCDPlayer.lnk = C:\Program Files\SPACE INTERNATIONAL\CDSpace 4.0\LCDPlyer.exe
    O4 - Global Startup: InterVideo WinScheduler.lnk = C:\Program Files\InterVideo\WinDVR\WinScheduler.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O12 - Plugin for .cdx: C:\Program Files\Internet Explorer\plugins\Npcdp32.dll

    Thanks a million Vanagon45 and the rest of you guys!
This discussion has been closed.