problem with Firefox

Printable View

November 13th, 2004, 08:42 PM
smif123

problem with Firefox

im pretty new to using Mozilla Firefox but so far i'm lovin it compared to explorer, but i've encountered my first problem with it.
the first time i load Firefox every day it sends me to the website "http://www.dxstar.com/" . It's not changing my homepage, just sending me there once a day. Any suggestions as to how to get rid of it? i'll post my HijackThis log here (although there's nothing in there I see that would cause this problem). Thanks in advance - Smif123

Logfile of HijackThis v1.98.2
Scan saved at 11:37:22 AM, on 13/11/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\WUPDPIJ32.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\********\My Documents\Programs\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.ca/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [emqgmqhi] C:\WINDOWS\System32\tppznyqt.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Update Pro] WUPDPIJ32.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Xyoulbvt] C:\WINDOWS\System32\kghnl.exe
O4 - HKCU\..\RunOnce: [Windows Update Pro] WUPDPIJ32.EXE
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_1_0_0_44.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by24fd.bay24.hotmail.msn.com/...x/HMAtchmt.ocx
November 13th, 2004, 08:53 PM
Soda_Popinsky

Ladies and Gentlemen...

We have our first FireFox hijack. :eek: I would love to know the vector on that one...

I am off to class, so unfortunately I can't help review your log. I just find it very interesting that it seems FF has been hijacked. (who said it wouldn't happen ) ;)
November 13th, 2004, 10:09 PM
Tiger Shark

Smif:

You definitely have some odd processes running or called at start. Unless you can pisitively ID them I would try the foloowing:-

1. Open Task Manager and stop the process C:\WINDOWS\system32\WUPDPIJ32.EXE if you can.
2. Fix the following keys:-

O4 - HKLM\..\Run: [emqgmqhi] C:\WINDOWS\System32\tppznyqt.exe
O4 - HKLM\..\Run: [Windows Update Pro] WUPDPIJ32.EXE
O4 - HKCU\..\Run: [Xyoulbvt] C:\WINDOWS\System32\kghnl.exe
O4 - HKCU\..\RunOnce: [Windows Update Pro] WUPDPIJ32.EXE (note this is a runonce key, the other is a run key... there are 2.... unusual IMO).

3. I really am not happy about this one either... You might want to consider getting rid of it too unless you know what it is:-

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...meInstaller.exe

4. Any clue what this is?

O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by24fd.bay24.hotmail.msn.com...ex/HMAtchmt.ocx

That's my assessment..... Comments anyone?
November 13th, 2004, 10:17 PM
groovicus

Spot on. :) Also make sure to delete those files too.

The first 016 entry is a quicktime installer. I have no idea what the second one does, other than something for (obviously) Hotmail. 016's are always safe top remove withHJT. If they are ever needed again, they will be automatically downloaded.
November 13th, 2004, 10:26 PM
Tiger Shark

Thanks Groove, (the HJT King)....

BTW, I forgot to mention.... After fixing restart the box and run HJT again to make sure they left. If thet are still there repost the HJT logs so we can look at it again.... It's possible that if you can't stop the WUPDPIJ32.EXE process that it will re-instate itself at shutdown, (actually, it's not an issue of "possible" it's quite bloody common for this crap to do it.... :rolleyes: ).
November 13th, 2004, 10:56 PM
chsh

Re: problem with Firefox

Quote:

Originally posted here by Soda_Popinsky
Ladies and Gentlemen...
We have our first FireFox hijack. :eek: I would love to know the vector on that one...

From the sounds of it, it's not a Firefox problem. :D
November 13th, 2004, 11:11 PM
Soda_Popinsky

Although I would expect that process got placed through means that didn't involve FF, I don't see anything that argues that FF didn't get exploited?
Except maybe this, but would require some clarification from the thread's author:

Quote:

im pretty new to using Mozilla Firefox but so far i'm lovin it compared to explorer, but i've encountered my first problem with it.

Maybe IE was responsible for the hijacker, but why would malware target Firefox when it gets there through IE? If IE gets exploited, then that means the exploited user has IE as their preferred browser, making FF functions of the payload irrelevant?

Either IE got exploited with malware as a payload that predicts the user would switch to FF after being exploited, or FF itself got exploited... My money is on the former, but it would be damning for FF to get hijacked right after their final release.

Or maybe any browser would be redirected to that page? A cross browser hijack? :p

Malware gets complicated sometimes. :mad:
November 13th, 2004, 11:25 PM
Relyt

I’ve been trying to keep an eye open for Firefox Hijackers and there has been some discussion about them, but nothing has really been directly related to FF. Here are some of the recent boards:

http://www.trojaner-board.de/showthread.php?t=7428

Translated versions: :D

Here:

Resolution to what they thought was a FF Hijack - Javascript refresh

Here:

Soda presents some very interesting scenarios, they will make them more difficult to detect and why not a "cross browser hijack" coming next?

cheers
November 13th, 2004, 11:31 PM
groovicus

I was sitting here trying to noodle through what may have happened, then relyt said something that made sense, Javascript refresh. I was about to bet that if the user turned off javascript and jave in FF, that the redirect would no longer happen. So my thought is that it is actually a windows issue.

Since I have no earathly clue about JavaScrpt, would it be correct to assume that each browser has to use the same interpreter (assuming that it is an interpreted language), and therefore it wouldn't matter what browser was being used?

Now I am making my head hurt.
November 13th, 2004, 11:33 PM
ShagDevil

Quote:

O4 - HKLM\..\Run: [emqgmqhi] C:\WINDOWS\System32\tppznyqt.exe
O4 - HKLM\..\Run: [Windows Update Pro] WUPDPIJ32.EXE
O4 - HKCU\..\Run: [Xyoulbvt] C:\WINDOWS\System32\kghnl.exe
O4 - HKCU\..\RunOnce: [Windows Update Pro] WUPDPIJ32.EXE (note this is a runonce key, the other is a run key... there are 2.... unusual IMO).

Tiger is dead on on those files. I checked Google, Yahoo, Answers That Work, and WinTask Library for those files and found nothing. They seem extremely shady to me.
For starters, follow Tiger's advice and repair those files with HJT. Next,
(and I'm surprised it wasn't mentioned) you should download:Spybot and/or
Ad-Aware
Run those and see what they find. You appear to have some kind of porn hijacker.
November 13th, 2004, 11:34 PM
Tiger Shark

Smif:

Did you import your settings from IE or did you say "import nothing"?
November 13th, 2004, 11:36 PM
Soda_Popinsky

If I was to write a cross browser hijack, I would maybe insert <script> Document.Location(mysite)</script> into the html returned from a get request, sorta like a man in the middle, but local?

Although, if you were able to "inject" like that, why not just change the html received into your own webpage? Then you can phish or whatever the hell you want.

edit:

hmmm... good point about that imported material... then I would have to ask, Was this hijack present in IE?
November 14th, 2004, 12:00 AM
smif123

here's the update on my box
tiger, the process you talked about is gone, and it didnt come back when i re-set. i did all the HJ stuff and my log is currently lookin like so:
Logfile of HijackThis v1.98.2
Scan saved at 2:51:38 PM, on 13/11/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\********\My Documents\Programs\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.ca/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_1_0_0_44.cab

to answer other questions...i did actually run ad-aware when this problem first came up, but it didnt find anything so i didnt think to mention it here. also, as for importing explorer setting, i imported my favorites from IE but i dont remember telling it to import all the settings.
When i re-set my box before making the changes in HJ the site came up again, but after doing as i was told it did not (and i'll add that my box runs faster now too :) ) so i think my problem's fixed. thankyou all for your time - smif
November 14th, 2004, 04:09 AM
chsh

Quote:

Originally posted here by Soda_Popinsky
Maybe IE was responsible for the hijacker, but why would malware target Firefox when it gets there through IE? If IE gets exploited, then that means the exploited user has IE as their preferred browser, making FF functions of the payload irrelevant?

Using Occam's Razor on the two principal possibilities:
- Firefox got exploited
- Malware got onto the system via some other means and simply uses the default browser to open a site
I think the latter is the far simpler of the two. I've seen this happen with lots of different browsers on windows (Opera, NS4.x, Mozilla1.x, Firefox, IE, etc), it's not specific to each browser, nor is opening a webpage indicative of a hijack.

Simple way to find out: Smif, is Firefox set as your default browser?
November 14th, 2004, 04:29 AM
smif123

yes it is
November 14th, 2004, 05:21 AM
Soda_Popinsky

I may be beating a dead horse here, but I find this interesting. I agree that he was most likely exploited through means other than a Firefox exploit, but I still have questions:

1. Did you see this behavior on IE?
2. Why did you switch browsers in the first place?
3. Is IE/XP fully patched and was it before you switched browsers?
4. Did you use IE at all after you got firefox?
5. What version of Firefox are you using?

Quote:

the first time i load Firefox every day it sends me to the website "http://www.dxstar.com/" .

Although I bet it's possible, I would expect it would be too complicated to code malware to redirect the initial homepage in your default browser. Pop up's in the default browser are simple stuff, but this sounds unreasonable.

It still sounds to me like the malware is specifically targeting FF, instead of a default browser. Which is odd, because I believe it would only do that if the writer knew ahead time that Firefox would be the browser being used. (exploit....?)
November 14th, 2004, 07:04 AM
smif123

soda, here are the answers to your questions
1. no, i didnt have this prob with IE
2. i switched for many reasons, the amount of browser hijacks on IE is one of them, but also a friend was raving about how great FF is comparativly and so i tried it out on his suggestion and continued using it cause i like it
3. to the best of my knowledge xp and IE are fully patched, and they were when i switched browsers
4. IE has not been used since intalling FF
5. i have FF 1.0

as to the other stuff you said, my home page was never changed (i did say this before), i was just sent to dxstar the first time i loaded FF. and also (as earlier stated) FF is my default browser, not IE.
hope this answers your questions
November 14th, 2004, 07:37 AM
Soda_Popinsky

You did, thanks.

Open Internet Explorer, go to tools, and update Windows. For everything else, go ahead and use FF. If there are any high priority updates, let us know.

Quote:

my home page was never changed (i did say this before),

I know what you are saying, it's just really odd, which makes it so much more interesting.

If you haven't deleted tppznyqt.exe, WUPDPIJ32.EXE, and kghnl.exe, stick 'em in a zip and send them my way, if that isn't a problem. :D
November 14th, 2004, 10:37 AM
Vorlin

To play devil's advocate for just a second...but there could be a simple answer to this:

Did you import settings from IE at the end of your Firefox install? If your home page is set due to something either you did or a browser hijack, and you imported it to FF, then it would certainly answer why it fires up like that.

Just curious, hehe...