Browser Hijack?

Browser Hijack?

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Browser Hijack? jedsam 02-21-2007
Posted by David H. Lipman on February 21, 2007, 6:19 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| helloe jedsam
| I had the same problem..seems the culprit is a company called drive cleaner.
| Makes your PC run real slow.They somehow get into your PC with
| malware/spyware etc. and u keep getting annoying pop ups telling u that u
| have a security problem and should download or run their systems scan..and
| then they want u to buy their software. Not a nice business practice huh?
| Anyways I called my broadband provider "which has free anti virus/spyware
| protection" wish I knew that in the first place. They directed me to their
| symantec.com site. I ran a free hour long system scan. It told me that "drive
| cleaner" was a "threat" to my computer. It also gave my the file info. I did
| a system search on my computer for it and deledted it manually. I also got a
| months credit of my broadband bill because they didn't initially inform of
| their free protection. My suggestions:
| Contact your internet provide and
| Try symantec.com and run their check.
|
| Good luck
| Dash Riprock

Sorry... Faux conclusion.

Drive Cleaner is non-viral malware that is suggested such as other non-viral
malware in what
is know as a SmitFruad Trojan infection.

At the base of this infection is having a ZLob or FakeAlert Trojan (8 out of 10
times it is
a ZLob Trojan) and once you are infected the Trojans will generate Pop-Ups
indicateding one
or more of the following...


Computer is infected w/trojan i worm-attck-v122.02a

warning: w32.myzor.fk@yf is a virus that infects files with .exe extensions.
It attempts to steal passwords and private information from the infected
computer.

Title: 'Alert! Trojan.Virus.Z.32.exe launch attempt detected...'
Message: 'It is recommended that you run a full system scan now to
reveal other possible threats. Click here to download spyware
remover.'

Title: 'Internet attack attempt detected...'
Message: 'Somebody's trying to infect your system with spyware or
harmful viruses. Run system scan now to secure your PC from Internet
attacks and hijacking attempts!
Click here to download spyware remover now...'

Title: 'Alert!'
Message: 'Trojan.Virus.Z.32.exe launch attempt detected and blocked!
It is recommended that you run a full system scan to reveal other
possible threats.
Click here to visit Security Center web site and protect your system
against spyware and harmful viruses...'

Title: 'Credit card hijacking attempt detected...'
Message: 'This is a result of harmful spyware activity.
Scan your PC now to reveal and remove malicious spyware.
Visit Windows Security site to download antispyware...'

Title: 'Alert: You are receiving spam!'
Message: 'This means your computer is infected with malicious spyware.
Scan your computer now. Click here to protect your computer against
spyware, adware and trojans!'

Title: 'Danger! Spyware activity detected on your computer...'
Message: 'Full system scan highly recommended to remove possible
malicious spyware. Scan now to remove all spyware and adware!
Visit Windows Security Center web site to protect your computer...'

Title: 'Warning! Your computer is not protected against spyware...'
Message: 'This may lead to your PC getting infected with malicious
spyware able to steal your data including passwords, credit card
numbers, etc.
Scan your computer for spyware now!'

Title: 'Your data is being transmitted to another computer...'
Message: 'DATA MINER - a dangerous spyware stealing and collecting
your data, possibly does this. Scan your PC now to get rid of this
malicious program. Click here to download spyware remover to protect
your PC.'

Title: 'Warning: Your security and privacy are at risk!'
Message: 'Spyware has been detected on your computer.
Click here to run a full system scan to protect your PC...'

Title: 'Alert:'
Message: 'The following program C:\windows\system\keylogger.exe#CR#is
trying to monitor and log login names and passwords entered from your
keyboard. Scan your PC now to remove possible keyloggers and other
spyware!'

Title: 'Danger: Potential spyware operation!'
Message: 'Your computer is making unauthorized copies of your system
and Internet log files. Run full scan now to prevent any unauthorized
access to your log files!
Visit Windows Security Center web site now...'

Title: 'Warning! Outside access attempt detected:'
Message: 'Somebody's trying to gain access to your PC using DATA MINER
program. Run System Scan now to block further unauthorized access
attempts.
Click here to visit Windows Security web site...'

Title: 'Your computer is working slowly!'
Message: 'Slow operation speed might have been caused by malicious
spyware. Run Spyware scan now to remove all viruses and spyware
programs from your computer!
Click here to visit Windows Security Center web site...'

Title: 'System alert:'
Message: 'Warning! Spyware detected on your computer.
Click here to remove all spyware and viruses immediately...
Protect your system today.'

Title: 'Warning: System Protection notice!'
Message: 'Protect your system against spyware and harmful viruses.
Click here to protect your PC immediately!'

The Trojan can cause you to install various Rougue anti malware software such
as, but not
limted to,...
SpySheriff, SpyAxe, AdwareDelete, Adwarepunisher, adwaresheriff,
Alphacleaner,Anti-Leech,
AntispywareSoldier
{ A good list is here... http://www.internetinspiration.co.uk/roguefix.htm }

Also WinFixer, WinAntiVirus and WinAntiSpyware and even the Drive Cleaner you
suggested.

{NOTE: WinFixer, WinAntiVirus and WinAntiSpyware are most often associated with
Vundo
Trojans /Virtumonde Adware infections but there have been links to the ZLob
"suggesting" the
use of these Rogues }

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by =?Utf-8?B?amVkc2Ft?= on February 22, 2007, 2:36 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Thanks for the INFO. It seems a long and complicated cleansing procedure. I
think I would get myself in a bit of a PICKLE being a computer novice! As the
problem I have is only a very minor inconvenience I think I will leave it for
now. But if things get much worse I will reset the computer back to 'factory
despatch' condition. I think I can cope with that and it should be good as
new!

"David H. Lipman" wrote:

>
> | helloe jedsam
> | I had the same problem..seems the culprit is a company called drive cleaner.
> | Makes your PC run real slow.They somehow get into your PC with
> | malware/spyware etc. and u keep getting annoying pop ups telling u that u
> | have a security problem and should download or run their systems scan..and
> | then they want u to buy their software. Not a nice business practice huh?
> | Anyways I called my broadband provider "which has free anti virus/spyware
> | protection" wish I knew that in the first place. They directed me to their
> | symantec.com site. I ran a free hour long system scan. It told me that "drive
> | cleaner" was a "threat" to my computer. It also gave my the file info. I did
> | a system search on my computer for it and deledted it manually. I also got a
> | months credit of my broadband bill because they didn't initially inform of
> | their free protection. My suggestions:
> | Contact your internet provide and
> | Try symantec.com and run their check.
> |
> | Good luck
> | Dash Riprock
>
> Sorry... Faux conclusion.
>
> Drive Cleaner is non-viral malware that is suggested such as other non-viral
malware in what
> is know as a SmitFruad Trojan infection.
>
> At the base of this infection is having a ZLob or FakeAlert Trojan (8 out of
10 times it is
> a ZLob Trojan) and once you are infected the Trojans will generate Pop-Ups
indicateding one
> or more of the following...
>
>
> Computer is infected w/trojan i worm-attck-v122.02a
>
> warning: w32.myzor.fk@yf is a virus that infects files with .exe extensions.
> It attempts to steal passwords and private information from the infected
computer.
>
> Title: 'Alert! Trojan.Virus.Z.32.exe launch attempt detected...'
> Message: 'It is recommended that you run a full system scan now to
> reveal other possible threats. Click here to download spyware
> remover.'
>
> Title: 'Internet attack attempt detected...'
> Message: 'Somebody's trying to infect your system with spyware or
> harmful viruses. Run system scan now to secure your PC from Internet
> attacks and hijacking attempts!
> Click here to download spyware remover now...'
>
> Title: 'Alert!'
> Message: 'Trojan.Virus.Z.32.exe launch attempt detected and blocked!
> It is recommended that you run a full system scan to reveal other
> possible threats.
> Click here to visit Security Center web site and protect your system
> against spyware and harmful viruses...'
>
> Title: 'Credit card hijacking attempt detected...'
> Message: 'This is a result of harmful spyware activity.
> Scan your PC now to reveal and remove malicious spyware.
> Visit Windows Security site to download antispyware...'
>
> Title: 'Alert: You are receiving spam!'
> Message: 'This means your computer is infected with malicious spyware.
> Scan your computer now. Click here to protect your computer against
> spyware, adware and trojans!'
>
> Title: 'Danger! Spyware activity detected on your computer...'
> Message: 'Full system scan highly recommended to remove possible
> malicious spyware. Scan now to remove all spyware and adware!
> Visit Windows Security Center web site to protect your computer...'
>
> Title: 'Warning! Your computer is not protected against spyware...'
> Message: 'This may lead to your PC getting infected with malicious
> spyware able to steal your data including passwords, credit card
> numbers, etc.
> Scan your computer for spyware now!'
>
> Title: 'Your data is being transmitted to another computer...'
> Message: 'DATA MINER - a dangerous spyware stealing and collecting
> your data, possibly does this. Scan your PC now to get rid of this
> malicious program. Click here to download spyware remover to protect
> your PC.'
>
> Title: 'Warning: Your security and privacy are at risk!'
> Message: 'Spyware has been detected on your computer.
> Click here to run a full system scan to protect your PC...'
>
> Title: 'Alert:'
> Message: 'The following program C:\windows\system\keylogger.exe#CR#is
> trying to monitor and log login names and passwords entered from your
> keyboard. Scan your PC now to remove possible keyloggers and other
> spyware!'
>
> Title: 'Danger: Potential spyware operation!'
> Message: 'Your computer is making unauthorized copies of your system
> and Internet log files. Run full scan now to prevent any unauthorized
> access to your log files!
> Visit Windows Security Center web site now...'
>
> Title: 'Warning! Outside access attempt detected:'
> Message: 'Somebody's trying to gain access to your PC using DATA MINER
> program. Run System Scan now to block further unauthorized access
> attempts.
> Click here to visit Windows Security web site...'
>
> Title: 'Your computer is working slowly!'
> Message: 'Slow operation speed might have been caused by malicious
> spyware. Run Spyware scan now to remove all viruses and spyware
> programs from your computer!
> Click here to visit Windows Security Center web site...'
>
> Title: 'System alert:'
> Message: 'Warning! Spyware detected on your computer.
> Click here to remove all spyware and viruses immediately...
> Protect your system today.'
>
> Title: 'Warning: System Protection notice!'
> Message: 'Protect your system against spyware and harmful viruses.
> Click here to protect your PC immediately!'
>
> The Trojan can cause you to install various Rougue anti malware software such
as, but not
> limted to,...
> SpySheriff, SpyAxe, AdwareDelete, Adwarepunisher, adwaresheriff,
Alphacleaner,Anti-Leech,
> AntispywareSoldier
> { A good list is here... http://www.internetinspiration.co.uk/roguefix.htm }
>
> Also WinFixer, WinAntiVirus and WinAntiSpyware and even the Drive Cleaner you
suggested.
>
> {NOTE: WinFixer, WinAntiVirus and WinAntiSpyware are most often associated
with Vundo
> Trojans /Virtumonde Adware infections but there have been links to the ZLob
"suggesting" the
> use of these Rogues }
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
>

Posted by PA Bear on February 22, 2007, 7:27 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
The machine is *already* infected.

So How Did I Get Infected Anyway?
http://www.wilderssecurity.com/showthread.php?t=27971

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)


jedsam wrote:
> When I select the Homepage on my internet explorer browser I am
> immediately
> taken to the security centre with the following address
> http://asafetynotice.com/ It advertises a number of security programs you
> can download (at cost). Though I already have McAffee antivirus/firewall
> installed which has not detected any problems. It is annoying but it
> only
> happens when trying to open the 'Homepage'
> Would appreciate any ideas. Thanks


Similar ThreadsPosted
Browser hijack attempt resulting in lost favorites (= no bookmarks) October 11, 2005, 8:51 pm
posting log of Hijack This December 31, 2005, 6:19 pm
Computer Hijack June 28, 2006, 3:41 am
Download.Trojan (aka Desktop HiJack) April 25, 2006, 11:13 pm
Google Gmail E-mail Hijack September 26, 2007, 3:37 pm
Is Browser using Localhost OK ? July 27, 2005, 11:57 am
Browser being hijacked? February 21, 2007, 7:03 am
What, exactly, is a 'normal' browser? December 10, 2008, 5:54 pm
Browser Re Direct or Similar August 11, 2005, 4:01 pm
HP loads PC with nonexistent web browser September 23, 2008, 9:21 am

The site map in XML format XML site map

Contact Us | Privacy Policy