Sorry your browser is not supported!

You are using an outdated browser that does not support modern web technologies, in order to use this site please update to a new browser.

Browsers supported include Chrome, FireFox, Safari, Opera, Internet Explorer 10+ or Microsoft Edge.

Geek Culture / Ebay massive hijack!

Author
Message
Matt Rock
19
Years of Service
User Offline
Joined: 5th Mar 2005
Location: Binghamton NY USA
Posted: 23rd Apr 2006 20:28
Every time I try to enter EBay, my internet explorer crashes. Also, on almost every webpage I visit several words are highlighted and/ or underlined, and when I mouse-over them the taskbar at the bottom of explorer says the name of the site / the word that's highlighted. And sometimes when I click on a link to go to a site, it completely re-directs me to some other website (like an ad-site). I've run Ad-Aware 6.0, AVG, Spybot S&D, Spysubtract, and Windows Defender, and none of them have found what's causing the problem. I'd post a Hijack This log, but HJT won't run (I've even tried re-installing from multiple sites). It seems as though this is the worst hijack I've ever faced, especially since Hijack This has apparently been hijacked too. Anyone know what I can do?


"In an interstellar burst, I'm back to save the universe"
dark coder
22
Years of Service
User Offline
Joined: 6th Oct 2002
Location: Japan
Posted: 23rd Apr 2006 20:32
safe mode and wipe anything that isnt required from your startup folder, or hit ctrl+alt+del and try to close any programs that dont sound vital, use google to check if your unsure.

Halowed are the ori.
Matt Rock
19
Years of Service
User Offline
Joined: 5th Mar 2005
Location: Binghamton NY USA
Posted: 23rd Apr 2006 20:40
I've tried that as well. Here's what it says is running when I do that:

taskmgr.exe / wmiprsvse.exe (won't close) / msmpeng.exe (won't close) / iexplore.exe / wuauclt.exe (won't close) / spoolsv.exe / 6 instances of svchost.exe / atiaxx.exe / ati2evxx.exe / lsass.exe / services.exe / winlogon.exe / smss.exe / ati2evxx.exe (again?) / wuauclt.exe (again?) / system / system idle process

And sure enough, when I visit ebay it crashes


"In an interstellar burst, I'm back to save the universe"
adr
21
Years of Service
User Offline
Joined: 21st May 2003
Location: Job Centre
Posted: 23rd Apr 2006 20:45
There's an app called killbox which can delete files which aren't normally deletable.

[center]
iv tryed everything!!!!!!!!!! could u please just add The gun and shooting Code thats All!!!!!!!!!
Matt Rock
19
Years of Service
User Offline
Joined: 5th Mar 2005
Location: Binghamton NY USA
Posted: 23rd Apr 2006 20:52
I have killbox but without a Hijack This log I'm unsure what to delete


"In an interstellar burst, I'm back to save the universe"
OSX Using Happy Dude
21
Years of Service
User Offline
Joined: 21st Aug 2003
Location: At home
Posted: 23rd Apr 2006 20:59 Edited at: 23rd Apr 2006 23:23
I can assure you, eBay has nothing to do with it.

Reformat your hard drive (or get a new one), re-install Windows and a decent AV program.

Matt Rock
19
Years of Service
User Offline
Joined: 5th Mar 2005
Location: Binghamton NY USA
Posted: 23rd Apr 2006 21:15
I don't think ebay has anything to do with it. I'm betting it has something to do with ebay's dependence on Java. But my 160 GB hard drive has a little over 140 GB's of stuff packed into it... that's a whole lot of DVD-R's to fill, plus Sony didn't send me a disc so re-installing XP is out... formatting isn't an option. But what if I deleted Internet Explorer or java? Would that help?


"In an interstellar burst, I'm back to save the universe"
SirFire
19
Years of Service
User Offline
Joined: 4th Apr 2005
Location: North America
Posted: 23rd Apr 2006 21:22 Edited at: 23rd Apr 2006 22:04
Quote: "Reformat your jard drive (or get a new one), re-install Windows and a decent AV program."


No offense Nicholas, but I really hate to hear people give that advice.

Yes, that is sure to fix the problem, but it's like killing a caterpillar with a flamethrower!

@Matt, try going to IE menu tools/internet options (or control panel/internet options), in the general tab click settings, click view objects, delete everything there except for obviously safe modules like quicktime or shockwave. Also delete all temporary internet files and cookies. Restart IE and see if you still have problems.

For processes that won't die, go to a command prompt and type AT 14:03 /INTERACTIVE TASKMGR where 14:03 is a time one or two minutes from the present time. At the set time, task manager will launch under "system" access, which is more powerful than your "administrator" access, and usually you can kill processes that can't be killed even by the administrator account.

Good luck ")

[EDIT]
changed command to AT 14:03 /INTERACTIVE TASKMGR

Hawkeye
21
Years of Service
User Offline
Joined: 19th Sep 2003
Location: SC, USA
Posted: 23rd Apr 2006 21:36
What's a jard drive? Is it like a yard drive?


I am but mad north north-west; when the wind is southerly I know a hawk from a handsaw - Hamlet, Hamlet
Killswitch
22
Years of Service
User Offline
Joined: 2nd Oct 2002
Location: School damnit!! Let me go!! PLEASE!!!
Posted: 23rd Apr 2006 21:50
It's like a ship in a bottle, only with harddrives...

~Heed my word hobags: Jism~
CattleRustler
Retired Moderator
21
Years of Service
User Offline
Joined: 8th Aug 2003
Location: case modding at overclock.net
Posted: 23rd Apr 2006 23:17
the others look ok but the two...

Quote: "wmiprsvse.exe (won't close) / msmpeng.exe (won't close) "


look those up on one of those process database sites.
not sure I've seen those before

OSX Using Happy Dude
21
Years of Service
User Offline
Joined: 21st Aug 2003
Location: At home
Posted: 23rd Apr 2006 23:24 Edited at: 23rd Apr 2006 23:27
Quote: "but it's like killing a caterpillar with a flamethrower!"

Yes, but it still ends up dead...

The point is, there probably one or more virus and/or trojans or corrupt Windows files - either of which is bad news, and most likely unfixable. Ergo, the only recourse is to re-install Windows.

Mind you, if a decent AV had been installed in the first place, and another browser had been used, the problem wouldn't have been there

Richard Davey
Retired Moderator
22
Years of Service
User Offline
Joined: 30th Apr 2002
Location: On the Jupiter Probe
Posted: 23rd Apr 2006 23:55
I would say try out Firefox and see what happens. If ebay then works the problem is just within IE, which does at least narrow down the problem somewhat.

Personally with such a deeply infected system I would format and re-install. Sucks, but it works.

Bite my shiny metal ass
Matt Rock
19
Years of Service
User Offline
Joined: 5th Mar 2005
Location: Binghamton NY USA
Posted: 24th Apr 2006 00:23 Edited at: 24th Apr 2006 00:24
I tried it out in Netscape (commencing shower sequence now ) and alas, I was able to access ebay through there. I rebooted in safe under the admin login and sure enough, I was able to get killbox working. It turned out to be some wacky virus called "sinntroj.exe" that I couldn't find on google, so I'm thinking maybe I've found something new? Anyway, I killboxed it, and now spysubtract, spybot S&D, and ad-aware have found TONS of other stuff with that one file gone. What's scary is, I run my anti-spyware/ malware regimen once per week, every tuesday, so I don't know how it could have gotten this infected in such a short period of time. Also, I've never heard of spyware or a trojan that could block spyware and virus-hunting programs from finding other stuff... this puppy was one fugly virus.

Now that it's gone, wmiprsvse.exe and msmpeng.exe aren't running anymore (I looked them up at www.processlibrary.com and it'd never heard of them). But now my Vaio Media Console server isn't running or even loading when I try to start it, not that I ever use it, but it's still annoying... I'm guessing that was infected or something. ACK! Anyway, thanks for all the advice guys. As Rich pointed out, maybe it's time for me to switch to Firefox...


"In an interstellar burst, I'm back to save the universe"
Zone Chicken
20
Years of Service
User Offline
Joined: 25th Jan 2004
Location: `~-..-~`~-..-~`
Posted: 24th Apr 2006 00:38 Edited at: 24th Apr 2006 01:02
wmiprsvse.exe = Windows Server 2003: Wmiprvse.exe

msmpeng.exe = MsMpEng.exe is the Windows Defender Auto-Protect Service that is the core engine of Windows Defender, which is originally Microsoft AntiSpyware software. At the time of writing, Windows Defender is still in beta 2 phase, so do not be too surprised when you encounter a few errors.

Wuauclt.exe = Windows automatic update.

sinntroj.exe : troj usually means trojan.

And only thing i could find on ati2evxx.exe

What is it?
ATI External Event Utility EXE Module AKA ATI Hotkey Poller - ati2evxx.exe

What does it do?
ati2evxx.exe - This process provides optional features that the majority of us really couldn't care less about. The XT's overdrive feature uses this. If you have an XT you'll probably want to leave this on.


This is installed as a service so you'll need to do the following to disable:
Start --> Run --> services.msc
Find ATI Hotkey Poller and double click it.
Change the startup type to disabled

According to ATI this process is supposed to have 2 instances running. ( link )

The best explanation I've managed to find for this is: (Source)
We have to have the 2 instances to support multisession (fast user switch) support. A system service does not have access to change per user settings on a any session other than the default session. In fast user switch, multiple sessions get created. To be able to change the settings on non-default session we need to create a per user instance of the external event.

Many users have reported this process to slow their boot time down.

Virus Precaution:
The original ati2evxx.exe from ATI gets placed at C:WINDOWSSystem32ati2evxx.exe . If you find it anywhere else then you should be suspicious for sure.

You'll want to keep an eye on this google search for any known viruses. At this time I have not found ANY viruses that run themselves using this filename. All of the results currently affect this file in some way, but do not actually run as this filename.


ati2evxx.exe is made by a Third Party but is most likely safe

Your signature has been erased by a mod -- please resize to under 600x120...
Les Horribres
18
Years of Service
User Offline
Joined: 20th Nov 2005
Location: My Name is... Merry
Posted: 24th Apr 2006 01:07
Yeah, was about to say.. I know wmiprsvse runs all the time with me.

And if you look closely, ati runs under system and user.

What you first noticed is an ADWARE... I've seen that several times before...

And even though you 'removed' the adware and spyware with your programs.... reformat. No one knows it all.
BTW, if you only 'killed' the process, then you should send it to one of those user thingys...

We all have our inner noob. Join the NJL, and have more fun!
I believe society is flawed; our notions on life, on child rearing, stem too far back to be of relevance in this day and time.
Aoneweb
22
Years of Service
User Offline
Joined: 9th Sep 2002
Location: Tucson, Arizona
Posted: 24th Apr 2006 01:10
http://hijack-this.net/


Game resource forum and arcade, click sig.
Megaton Cat
21
Years of Service
User Offline
Joined: 24th Aug 2003
Location: Toronto, Canada
Posted: 24th Apr 2006 01:20 Edited at: 24th Apr 2006 01:21
oops, wrong one.


It's like a Megaton Cat radar, 24 hours a day.
ionstream
20
Years of Service
User Offline
Joined: 4th Jul 2004
Location: Overweb
Posted: 24th Apr 2006 01:57
Quote: "Yes, that is sure to fix the problem, but it's like killing a caterpillar with a flamethrower!"


Its more like, killing a caterpillar to cure it's cold. Poor caterpillar .


Spyboy S&D can kill processes and also has a process database list.

Les Horribres
18
Years of Service
User Offline
Joined: 20th Nov 2005
Location: My Name is... Merry
Posted: 24th Apr 2006 03:43
I hate catapillars.

@A1, as I was saying, nothing can detect everything. Doesn't really matter what program you use. Want to get passed these 'registry filters'? Just add a few bytes to iexplore. No big deal. The fact is one or 2 spywares a week, thats okay i guess. Just the small stuff that filters though. But if you have a backdoor opened to let in a world of spyware, you really can't ever say it is gone until you reformat.

We all have our inner noob. Join the NJL, and have more fun!
I believe society is flawed; our notions on life, on child rearing, stem too far back to be of relevance in this day and time.
x1b
20
Years of Service
User Offline
Joined: 19th Sep 2004
Location:
Posted: 24th Apr 2006 03:50
give it up,guys. surely this is the clever work of "data 98junkiee"


Saikoro
21
Years of Service
User Offline
Joined: 6th Oct 2003
Location: California
Posted: 24th Apr 2006 13:42
Now if he got the computer up and running, doing what he wants with no problems, why should he reformat? I don't know about you, but if I had a hard drive nearly full, I wouldn't reformat unless I had to. Nothing can block everything to be sure, but unless he was the sole specific target of a new trojan, then more people are sure to have it and thus one of his multiple spyware blocking programs know about it and have either fixed the problem or are currently fixing it.

"One World, One Web, One Program" -Microsoft ad.
"Ein Volk, Ein Reich, Ein Führer"(One People, One Kingdom, One Leader)-Adolf Hitler.
Jess T
Retired Moderator
21
Years of Service
User Offline
Joined: 20th Sep 2003
Location: Over There... Kablam!
Posted: 25th Apr 2006 09:25
Formatting's good though, it forces you to organize and backup all your stuff

Team EOD :: All-Round Nice Guy
Want Better dbHelp Files?
http://jt0.org
David R
21
Years of Service
User Offline
Joined: 9th Sep 2003
Location: 3.14
Posted: 25th Apr 2006 20:54 Edited at: 25th Apr 2006 20:54
No point formatting in this instance though, unless you do a low level format. Otherwise, all the crap you are erasing can easily come round and get you again

Quote: "Let's think the unthinkable, let's do the undoable, let's prepare to grapple with the ineffable itself, and see if we may not eff it after all."
Xander
21
Years of Service
User Offline
Joined: 3rd Mar 2003
Location: In college...yeah!
Posted: 25th Apr 2006 22:52
Hmm...this gives me a new idea for my new game

Xander Moser - Bolt Software - Firewall
OSX Using Happy Dude
21
Years of Service
User Offline
Joined: 21st Aug 2003
Location: At home
Posted: 26th Apr 2006 00:00
Quote: "Otherwise, all the crap you are erasing can easily come round and get you again"

Makes more sense to buy a new hard drive.

Les Horribres
18
Years of Service
User Offline
Joined: 20th Nov 2005
Location: My Name is... Merry
Posted: 26th Apr 2006 01:38 Edited at: 26th Apr 2006 01:41
Quote: "Nothing can block everything to be sure, but unless he was the sole specific target of a new trojan"


Quote: "some wacky virus called "sinntroj.exe" that I couldn't find on google, so I'm thinking maybe I've found something "



Yes, he was a 'sole target'. Hence I said
Quote: "you have a backdoor opened to let in a world of spyware"


Quote: "give it up,guys. surely this is the clever work of "data 98junkiee""

That guy make a virus... LOL!!! You crack me up...
Or mabey, he was a genius masquarding as an idiot... Proboards DOES has IP Records... Perhaps it was a ploy to get everyones IP!

Matt, did you post on his board?

We all have our inner noob. Join the NJL, and have more fun!
I believe society is flawed; our notions on life, on child rearing, stem too far back to be of relevance in this day and time.
Seppuku Arts
Moderator
20
Years of Service
User Offline
Joined: 18th Aug 2004
Location: Cambridgeshire, England
Posted: 26th Apr 2006 01:48
Personally I would drop internet explorer, I mean even little innocent sites have said they do not recommend you use IE when visiting their site. Firefox, as said, is highly recommended, ever since I started using it, most of my problems went away, a year trial of EZ AV and sygate firewall (free) solves the rest of my problems, except when that trial runs out

As for now, the easy way would be a reformat, and personally what I would normally do, however I have 40 gig HD, which is easier to backup important data with.

Attempt an entire clean up of unwanted files, clear cookies, temporary files and whatever that isn't needed for personal use, or to run something, but a virus checker should be useful, even if you are using a trial of an app, it can help solve it

Yey! I removed the sig...
A Llama called Dalai
Jeku
Moderator
21
Years of Service
User Offline
Joined: 4th Jul 2003
Location: Vancouver, British Columbia, Canada
Posted: 26th Apr 2006 04:01
Quote: "No point formatting in this instance though, unless you do a low level format. Otherwise, all the crap you are erasing can easily come round and get you again"


A low level format will damage most modern hard drives if I remember correly.

And no, if you format your hard drive the normal way, the files you are erasing can't come back again. I realize that yes, the data is still resident on the hard drive, but your FAT table will not see them.

David R
21
Years of Service
User Offline
Joined: 9th Sep 2003
Location: 3.14
Posted: 26th Apr 2006 13:05
Quote: "A low level format will damage most modern hard drives if I remember correly."


Low level formats simply write a null value to every sector of the hard drive. Has absolutely no effect on the drive itself, and there's no possible way the drive can be damaged.

Files can come back even if the FAT table is erased. Several boot sector virii manage this; one of which infected my PC - hence my recommendation of a low level format

Quote: "Let's think the unthinkable, let's do the undoable, let's prepare to grapple with the ineffable itself, and see if we may not eff it after all."
Perokreco
19
Years of Service
User Offline
Joined: 5th Apr 2005
Location: Bosnia and Herzegovina
Posted: 26th Apr 2006 16:26
Apparently low disk format isnt null writing. From wikipedia:

Low-level formatting, below, is frequently confused with "zero-writing" in which every bit of data on the disk is systematically overwritten with zeros returning the drive to a "factory-fresh" state.

A formatting of a disk involves two quite different processes known as "low-level formatting" and "high-level formatting." The former deals with formatting of disk surfaces required by the disk controller hardware; the latter with software-specific information written by a specific operating system.
Cash Curtis II
19
Years of Service
User Offline
Joined: 8th Apr 2005
Location: Corpus Christi Texas
Posted: 26th Apr 2006 16:41
Quote: "Also, I've never heard of spyware or a trojan that could block spyware and virus-hunting programs from finding other stuff... this puppy was one fugly virus."


About a month ago I got a virus that hijacked Norton Anti-virus. It was scary. Norton was totally disabled. I download the trial version of McAfree on my laptop and used that. Fortunately it worked, and business continued as usual. That was actually the first virus I've ever gotten, as I'm usually very good about keeping things clean. The moral of the story? Most viruses are ill-gotten in the first place. Be prepared to pay for your sins.


Come see the WIP!
indi
22
Years of Service
User Offline
Joined: 26th Aug 2002
Location: Earth, Brisbane, Australia
Posted: 26th Apr 2006 16:52
take your hard drive to another machine, run a virus checker from another system checking the other drive.

If no-one gives your an answer to a question you have asked, consider:- Is your question clear.- Did you ask nicely.- Are you showing any effort to solve the problem yourself 
David R
21
Years of Service
User Offline
Joined: 9th Sep 2003
Location: 3.14
Posted: 26th Apr 2006 20:32 Edited at: 26th Apr 2006 20:36
Quote: "Low-level formatting, below, is frequently confused with "zero-writing" in which every bit of data on the disk is systematically overwritten with zeros returning the drive to a "factory-fresh" state."


That article is quite inaccurate. Low level formatting can be achieved in multiple ways, not just via the hard disk controller - by warping the data via encryption to make it full but unreadable (ready for overwriting) and zero writing, among other methods

Quote: "The former deals with formatting of disk surfaces required by the disk controller hardware"


That's if you perform a low level format via or onto the hard disk controller. This is usually an optional component, not a necessity.


Google define gave me this;
Quote: "Normally when you format a disk, all that happens is that the File Attributes Table is cleared out. The actual data that is stored on the disk is not actually deleted or overwritten. A low level format actually goes across the entire disk and deletes and resets all the disk sectors, effectively destroying all the information stored on the disk. If you have performed a low level format, you typically cannot recover any information from the disk."


Resetting being the equivalent of zeroing

Quote: "Let's think the unthinkable, let's do the undoable, let's prepare to grapple with the ineffable itself, and see if we may not eff it after all."
Jeku
Moderator
21
Years of Service
User Offline
Joined: 4th Jul 2003
Location: Vancouver, British Columbia, Canada
Posted: 27th Apr 2006 01:04
Ok then, if low-level formatting is simply putting null or 0 on every bit of the disk, then it's not what it used to be, that's for sure. Believe me, low-level formatting originally wrecked modern hard drives :-P

SirFire
19
Years of Service
User Offline
Joined: 4th Apr 2005
Location: North America
Posted: 27th Apr 2006 03:13
This is my understanding of how low-level formatting is done:

Modern drives keep drive settings on the actual disk, as opposed to older drives that stored info in ROM chips. A new method of low-level formatting has come about where you use the manufacturer's software to reset the data on the disk when the low-level format takes place. Using an old generic low-level formatting program would destroy a modern hard drive, since it does not replace the drive data table that gets destroyed during the format.

/2 cents

Les Horribres
18
Years of Service
User Offline
Joined: 20th Nov 2005
Location: My Name is... Merry
Posted: 29th Apr 2006 00:04
@indi: Wouldn't it be better to have a OS on disk, so you could boot something and run a Virus Scanner in the saftey of a virtual environment?

We all have our inner noob. Join the NJL, and have more fun!
I believe society is flawed; our notions on life, on child rearing, stem too far back to be of relevance in this day and time.
OSX Using Happy Dude
21
Years of Service
User Offline
Joined: 21st Aug 2003
Location: At home
Posted: 29th Apr 2006 01:10 Edited at: 29th Apr 2006 01:12
Really, Windows (for PC's) should do what Windows for Mobiles, and what Acorn used to do - stick the OS in ROM

Any updates would then be loaded to 'replace' OS code. You get instant booting and safety...

The latest RISC OS (4, I believe) takes up 4MB of ROM...

Les Horribres
18
Years of Service
User Offline
Joined: 20th Nov 2005
Location: My Name is... Merry
Posted: 29th Apr 2006 01:28
Of course that just means a different aproach to virus writting. Instead of attacking the os while running, attack it while booting by masquating as a update.

We all have our inner noob. Join the NJL, and have more fun!
I believe society is flawed; our notions on life, on child rearing, stem too far back to be of relevance in this day and time.
OSX Using Happy Dude
21
Years of Service
User Offline
Joined: 21st Aug 2003
Location: At home
Posted: 29th Apr 2006 01:34
If all updates are digitally signed and the area protected by the OS then it should be fine.

Besides, one main advantage is that even if a virus was introduced (and this was the clever bit with RISC OS), you could boot into the CLI and delete/amend anything offensive.

The fact that you could run programs without booting into the OS is neither here nor there

Les Horribres
18
Years of Service
User Offline
Joined: 20th Nov 2005
Location: My Name is... Merry
Posted: 29th Apr 2006 01:53
The fact that you could run programs without booting into the OS is neither here nor there...
confused... are you trying to say that I can't run a program before the os boots?

Quote: "If all updates are digitally signed and the area protected by the OS then it should be fine."

Digital Sigs are just a challange, be it a simple code somewhere in the file, or data for an algorithm, people can figure it out... you can even use a program to record what is going on while one of these 'updates' are installing.

We all have our inner noob. Join the NJL, and have more fun!
I believe society is flawed; our notions on life, on child rearing, stem too far back to be of relevance in this day and time.
OSX Using Happy Dude
21
Years of Service
User Offline
Joined: 21st Aug 2003
Location: At home
Posted: 29th Apr 2006 06:30
Quote: "are you trying to say that I can't run a program before the os boots?"

I was saying that you could run BASIC and CLI commands before the desktop started - in RISC OS, part of the ROM includes the BASIC interpreter, and is always availiable.

Pricey
21
Years of Service
User Offline
Joined: 22nd Feb 2003
Location:
Posted: 29th Apr 2006 11:13
are you sure these underlined bits of texts are not intelligent ads that the site runs?

like if i typed

i want a computer

on an intelligent ad site
it would make computer into a link to a site where you can buy computers. :S

:: 3Ghz Pentium 4 / Hyper Threading, 1024mb RAM, 250GB HDD, 256mb Radeon 9600XT Graphics ::


Login to post a reply

Server time is: 2024-11-17 00:35:14
Your offset time is: 2024-11-17 00:35:14