# Browser Hijack



## gunner (May 18, 2002)

Whilst messing around with my PC, I inavertantly closed my firewall(zonealarm) & Anti Virus (Avast) for a few minutes whilst still connected to broadband.

During this short space of time my PC has become infested with a whole host of trojans/viruses/browse hijackers etc.

I have managed to clean most of them off by running Avast anti virus, Ad Aware, Spy Bot & Hijack This.

However I still have a problem with unwanted web pages appearing (particulary starware) and wondered if anyone know of some free tools or other mechanism to remove this malware?

Just goes to show the problems you can get if no firewall/antivirus is running  .


----------



## saint (Dec 6, 2002)

there are fairly lengthy replies to this posted not too long ago - gives details of how to shut off the star program and then remove it.

I could post again if you have time to wait for reply.

PS - you were already infected (no doubt) just the av and likes were keeping stuff at bay - unless you were surfing some dodgy sites that asked for the av and fw to be turned off - then foolio youio :wink:


----------



## nutts (May 8, 2002)

Try the Microsoft Antispyware 

http://www.microsoft.com/athome/securit ... fault.mspx


----------



## renton72 (Feb 17, 2004)

Try the following Ewido security suite.

http://www.ewido.net/en/

If you download hijack this

http://www.spywareinfo.com/~merijn/downloads.html

and post the log generated on this forum (you will need to register) there are some great people on there that will guide you through the removal process.

http://forums.techguy.org/ (Post in the security Forum)

HTH

Regards,

Chris


----------



## gunner (May 18, 2002)

cheers guys


----------



## saint (Dec 6, 2002)

Now am back at work I might get some time.

What you need to do is....

Look through your c:\ , c:\program files & c:\windows dirs - look for rogue folders something that does not look right - may have one or two files - nothing else. In the case of the program you mention I am sure it's fairly obvious.

To stop the hijack you must first stop the program from running itself each time windows starts. You may think that deleting the program and the folder will work - IT WON'T - it will reappear.

You need to hit CTRL-ALT-DEL and try to identify starware and other running in the task manager processes - you can stop the programs there - you will then be able to delete the rogue identified folders. After this you MUST run a System Registry search to remove all links to the malware/hijack - anti-spyware will help but please install any anti-spyware progs before doing all of this.

To get into the system reg - start > run > regedit - you can then carry out a search.

There should be atleast 2 or 3 reference to starware in the reg - they should also point to the rogue program folders you found.
Again if you have properly identified the entries and folders you can delete the registry lines.

What all this does is stop the eternal loop of the malware resetting itself each time the machine starts - some anti-spyware and anti-hijackers can't stop the process.

This prolly makes no sense as am rushed - but it is very successful


----------



## gunner (May 18, 2002)

I understand what you mean Saint, will give it a try later


----------



## MonTheFish (Jul 6, 2005)

If you find "Starware" in Add/Remove Programs, begin your removal by uninstalling there. Kill these running processes with Task Manager:

programfilesdir+\common files\oe\uninstall.exe
programfilesdir+\common files\oe\uninstallwa.exe
programfilesdir+\orbit\ad.exe
programfilesdir+\orbit\update.exe
programfilesdir+\orbit\view.exe
systemroot+\bobsaver.exe
systemroot+\downloaded program files\conflict.1\oeloader.exe
systemroot+\downloaded program files\oeloader.exe

Remove AutoRun Reference:

If you find the value
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion
un\cc2kui HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion
un\orbitupdate
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion
un\orbitview
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion
un\sswplauncher

Unregister these DLLs with Regsvr32, then reboot:

programfilesdir+\common files\oe\msbb.dll
programfilesdir+\common files\oe
edirector.dll
programfilesdir+\common files\oe\search.dll
programfilesdir+\common files\oe\toolbar.dll
systemroot+\downloaded program files\conflict.1\oeloader.dll
systemroot+\system
edirector.dll
systemroot+\system32
edirector.dll

Remove these registry items (if present) with RegEdit:

HKEY_CLASSES_ROOT\clsid\{702ad576-fddb-4d0f-9811-a43252064684}
HKEY_CLASSES_ROOT\clsid\{d48f2e28-68e2-4920-9848-d6e6c7ab3eb7}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{702ad576-fddb-4d0f-9811-a43252064684}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{d48f2e28-68e2-4920-9848-d6e6c7ab3eb7}
HKEY_CLASSES_ROOT\typelib\{c3e17d0d-593a-457b-a1da-6d082e29323a}
HKEY_CURRENT_USER\clsid\{0fda4d2b-7975-405d-8d7c-f5e2247eae80}
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\shellbrowser\{fe6bc4ef-5676-484b-88ae-883323913256}
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{fe6bc4ef-5676-484b-88ae-883323913256}
HKEY_LOCAL_MACHINE\software\classes\appid\{bac984c9-78c8-4105-9e97-1675a4052686}
HKEY_LOCAL_MACHINE\software\classes\appid\dmserver.exe\appid
HKEY_LOCAL_MACHINE\software\classes\bho.csbho
HKEY_LOCAL_MACHINE\software\classes\bho.csbho.1
HKEY_LOCAL_MACHINE\software\classes\bho.csbho\clsid
HKEY_LOCAL_MACHINE\software\classes\bho.csbho\curver
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{702ad576-fddb-4d0f-9811-a43252064684}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{fe6bc4ef-5676-484b-88ae-883323913256}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{702ad576-fddb-4d0f-9811-a43252064684}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{d48f2e28-68e2-4920-9848-d6e6c7ab3eb7}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage
c:/windows/downloaded program files/conflict.1/oeloader.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage
c:/windows/downloaded program files/oeloader.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion
un\cc2kui
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion
un\orbitupdate
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion
un\orbitview
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion
un\sswplauncher
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
c:\windows\downloaded program files\conflict.1\oeloader.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
c:\windows\downloaded program files\oeloader.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\cc2k\displayname
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\cc2k\uninstallstring
HKEY_USERS\s-1-5-21-1409082233-1390067357-1801674531-500\clsid\{0fda4d2b-7975-405d-8d7c-f5e2247eae80}

Remove these files (if present) with Windows Explorer:

addremove.htm
addremove.js
addremove_cc.js
administrator.txt
adzap.lic
adzap_0001.js
autosrch.js
azunins.js
band.js
bobsaver.exe-2b87f43a.pf
bobsaver.scr-3492b408.pf
cars.xsl
cnfmgr.js
completedjobs.xml
context.js
controlpanel.js
csres.dat
dmfilemap.xml
dmserver.exe-375d1fbc.pf
hotels.xsl
inst43.exe-233e3ddf.pf
inst9753.exe-222ff47c.pf
license.js
logging.js
masterconfig.xml
oeuninstaller.exe-06b5e4b2.pf
pestpatrolcl.exe-32de342c.pf
productinfo.xml
programfilesdir+\common files\oe\msbb.dll
programfilesdir+\common files\oe
edirector.dll
programfilesdir+\common files\oe\search.dll
programfilesdir+\common files\oe\toolbar.dll
programfilesdir+\common files\oe\uninstall.exe
programfilesdir+\common files\oe\uninstallwa.exe
programfilesdir+\orbit\ad.exe
programfilesdir+\orbit\update.exe
programfilesdir+\orbit\view.exe
publickey.pbk
refbutton.js
related.js
related.xml
related.xsl
request.xml
response.xml
rundll32.exe-333c496f.pf
scr_adzap.js
settings.xml
smileytown.xml
sslaunch.exe-12da0b03.pf
sstbinst.exe-18a1b725.pf
sys_except.xml
systemroot+\bobsaver.exe
systemroot+\bobsaver.scr
systemroot+\downloaded program files\conflict.1\oeloader.dll
systemroot+\downloaded program files\conflict.1\oeloader.exe
systemroot+\downloaded program files\oeloader.exe
systemroot+\downloaded program files\oeloader.inf
systemroot+\system
edirector.dll
systemroot+\system32
edirector.dll
tbmgr.js
tbproducts.js
toolbar.js
travel.js
travel_0001.js
travel_context.xml
un_screensaver.xml
un_searchassist.xml
un_smileytown.xml
un_travel.xml
update.js
utillauncher.js
winutil.js
xupiter.orbitexplorer.txt

Remove these directories (if present) with Windows Explorer:

programfilesdir+\common files\oe
programfilesdir+\oe
programfilesdir+\orbit

Restore Settings:

Start Microsoft Internet Explorer. In Internet Explorer, click Tools -> Internet Options. Click the Programs tab -> Reset Web Settings.


----------



## gunner (May 18, 2002)

Finally fixed the problem by re installing windows.

Tried all suggestions offered and although I found a couple of funnies, could not get rid of the malware.

Moral - never turn firewall/antivirus off even for a few minutes !


----------

