Browser Hijack: http://1-se.com/home.html

Forums: Computers
Email this Topic • Print this Page

I have run into one I can not seem to locate: my home page keeps reseting to http://1-se.com/home.html. Fixing this with HijackThis does not eliminate the proble as it returns with the next boot.

Logfile of HijackThis v1.97.7
Scan saved at 10:02:01 PM, on 4/2/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\AGRSMMSG.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
C:\PROGRAM FILES\HOMENETWORK\ICM.EXE
C:\PROGRAM FILES\DEERFIELD.COM\INTERQUICK\INTERQUICK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\PRINTRAY.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\ICSMGR.EXE
C:\PROGRAM FILES\HOMENETWORK\ICMMONITOR.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
D:\PROGRAM FILES\MICROSOFT\OFFICE\OFFICE\OSA.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
D:\PROGRAM FILES\WMCONNECT\WMTRAY.EXE
D:\PROGRAM FILES\MICROSOFT\OFFICE\OFFICE10\MSOFFICE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\WINFILE.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\TCFHAJQB\HIJACKTHIS[1].EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://in.webcounter.cc/-/?mszoe (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://in.webcounter.cc/-/?mszoe about:blank (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\homepage.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://1-se.com/home.html (obfuscated)
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:80
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.seagate.com/redirects/campai...eatools/cd
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://in.webcounter.cc/--/?mszoe (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://1-se.com/srchasst.html (obfuscated)
F1 - win.ini: run=fntldr.exe
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [Soundmx] \soundmx.exe
O4 - HKLM\..\Run: [Windows Shell Library Loader] load shell32.dll /c /set
O4 - HKLM\..\Run: [ICSMGR] ICSMGR.EXE
O4 - HKLM\..\Run: [ICMMonitor] C:\PROGRAM FILES\HOMENETWORK\ICMMonitor.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [MOSearch] C:\PROGRA~1\COMMON~1\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE
O4 - HKLM\..\RunServices: [MDM7] "C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE"
O4 - HKLM\..\RunServices: [ICMEngine] C:\PROGRAM FILES\HOMENETWORK\ICM.EXE -9Xservice
O4 - HKLM\..\RunServices: [InterQuickEngine] C:\PROGRAM FILES\DEERFIELD.COM\INTERQUICK\INTERQUICK.EXE -9Xservice
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [olehelp] C:\WINDOWS\olehelp.exe
O4 - Startup: Office Startup.lnk = D:\Program files\Microsoft\Office\Office\OSA.EXE
O4 - Startup: Microsoft Office.lnk = D:\Program files\Microsoft\Office\Office10\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = D:\Program files\Microsoft\Office\Office\FINDFAST.EXE
O4 - Startup: Wal-Mart Connect Tray Icon.lnk = D:\Program files\wmconnect\wmtray.exe
O8 - Extra context menu item: Web Search - C:\WINDOWS\ex.htm
O16 - DPF: {11111111-1111-1111-1111-111111111111} - mhtml:file://C:NXSFT.MHT!http://66.117.38.54:80/iex/ofile.exe?url=http://66.117.38.54:80/dexUS585.exe
O19 - User stylesheet: C:\WINDOWS\color.css
O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)

Topic Stats
Top Replies
Link to this Topic

Type: Discussion • Score: 1 • Views: 2,422 • Replies: 10

No top replies

Haven't a clue, but always on the lookout for a bargain. PM me if you'd like and explain the screen name?

0 Replies

knives4less, have you gotten rid of the problem yet? If you still need help I'll look through your logfile a bit later on. Sorry I didn't see this earlier.

0 Replies

No, it is still there. I suspect that one of the following programs is to blame as they are running as soon as windows loads and shutting them down with [Ctrl] [Alt] [Del] does not affect the operation of the computer:
Ctfmon, Osa, Winmgmt, Svchost, TCA, TCM, and Olehelp. Stoping Ctfmon does not kill it as it comes right back.

Using Hijack this to remove all those (obfuscated) entries and MOSEARCH helps but I hate to do it every time I reboot.

I found a number of suspicious files in my root directory and renamed them from I.EXE to I.XXX, etc. This did not change anything but it has not hurt.

Lately, I have noticed that I basically can not do anything until I eliminate this junk. My old Gateway P233 with 256 meg is unable to switch from my homepage to any of my favorites.

0 Replies

You've got a CoolWebSearch infection. Download CWShredder, run it, click 'Fix', follow its prompts & instructions, press 'Next' & allow it to fix everything it finds. Then reboot & rescan with HijackThis, & post your new log here in this thread...There'll be less to fix.

Olehelp is part of a CoolWebSearch parasite variant...it's gotta go.
The rest of the process names you mentioned are usually fine, however, a couple of them (ctfmon & svchost) are occasionally used by viruses & other parasites, so it depends on what the processes' exact filenames are & where they're located (for example if you have files named svchost in places other than your windows\system32 folder, they're likely virus related).

0 Replies

Alternatively, if you prefer to fix it manually, here's what you need to do...Run HijackThis, & with no other programs running check off the following then click 'Fix':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://in.webcounter.cc/-/?mszoe (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated)

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://in.webcounter.cc/-/?mszoe about:blank (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\homepage.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://1-se.com/home.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://in.webcounter.cc/--/?mszoe (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://1-se.com/srchasst.html (obfuscated)
F1 - win.ini: run=fntldr.exe

O4 - HKLM\..\Run: [Soundmx] \soundmx.exe
O4 - HKLM\..\Run: [Windows Shell Library Loader] load shell32.dll /c /set

O4 - HKCU\..\Run: [olehelp] C:\WINDOWS\olehelp.exe

O8 - Extra context menu item: Web Search - C:\WINDOWS\ex.htm
O16 - DPF: {11111111-1111-1111-1111-111111111111} - mhtml:file://C:NXSFT.MHT!http://66.117.38.54:80/iex/ofile.exe?url=http://66.117.38.54:80/dexUS585.exe
O19 - User stylesheet: C:\WINDOWS\color.css
O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)

Reboot, then delete:

fntldr.exe
soundmx.exe
C:\WINDOWS\olehelp.exe
C:\WINDOWS\ex.htm
C:\WINDOWS\color.css
C:\WINDOWS\hh.htt

Run a search for the files which I didn't specify a location for. You also might need to enable viewing hidden files & folders in order to find them.

When you're done, reboot then post a new hijackthis log here.

0 Replies

Thank You! That did it! Very Happy

My new log looks much better.

Logfile of HijackThis v1.97.7
Scan saved at 7:24:43 PM, on 4/10/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\AGRSMMSG.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
C:\PROGRAM FILES\HOMENETWORK\ICM.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\PRINTRAY.EXE
C:\WINDOWS\SYSTEM\ICSMGR.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\HOMENETWORK\ICMMONITOR.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
D:\PROGRAM FILES\THE CLEANER\TCA.EXE
D:\PROGRAM FILES\THE CLEANER\TCM.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
D:\PROGRAM FILES\MICROSOFT\OFFICE\OFFICE\OSA.EXE
D:\PROGRAM FILES\WMCONNECT\WMTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
D:\PROGRAM FILES\MICROSOFT\OFFICE\OFFICE10\MSOFFICE.EXE
D:\PROGRAM FILES\WMCONNECT\WWM.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
D:\PROGRAM FILES\HIJACKTH\HIJACK~1.EXE

F1 - win.ini: run=fntldr.exe
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [ICSMGR] ICSMGR.EXE
O4 - HKLM\..\Run: [ICMMonitor] C:\PROGRAM FILES\HOMENETWORK\ICMMonitor.exe
O4 - HKLM\..\Run: [tcactive] D:\PROGRAM FILES\THE CLEANER\tca.exe
O4 - HKLM\..\Run: [tcmonitor] D:\PROGRAM FILES\THE CLEANER\tcm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [MDM7] "C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE"
O4 - HKLM\..\RunServices: [ICMEngine] C:\PROGRAM FILES\HOMENETWORK\ICM.EXE -9Xservice
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: Office Startup.lnk = D:\Program files\Microsoft\Office\Office\OSA.EXE
O4 - Startup: Microsoft Office.lnk = D:\Program files\Microsoft\Office\Office10\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = D:\Program files\Microsoft\Office\Office\FINDFAST.EXE
O4 - Startup: Wal-Mart Connect Tray Icon.lnk = D:\Program files\wmconnect\wmtray.exe

Search could not find fntldr.exe, soundmx.exe, or mosearch. I also used Hijackthis to remove ctfmon & svchost from the registry but I notice ctfmon is back. I found that I.EXE had reinstalled in the root and deleted it. Finally, I opened IE Tools without connecting to an ISP, deleted files & cookies, and set my homepage to http://www.google.com/.

My computer is now running better than it has in a long time - not just on the internet Laughing

0 Replies

ctfmon is involved with the language/alternative input services in Office XP. It will continue to put itself back into startup when you run the Office XP apps as long as the Text Services and Speech applets in the Control Panel are enabled. (It can be disabled from Control Panel > Text & Speech Services)

From Microsoft: OFFXP: What Is CTFMON and What Does It Do?

Mosearch is also a feature of Office XP (which is why I didn't mention removing it), but it is an unnecessary resource hog so yeah personally I would've just removed it too.

See this article for more info: OFFXP: Hard Disk Runs Continuously After You Install Office XP

One thing though, you've still got the following entry listed:

F1 - win.ini: run=fntldr.exe

Was it removed earlier?
Check it off it HijackThis & click 'Fix checked' again, or just open the win.ini file and remove the line which mentions fntldr.exe (do not delete win.ini as it's an important file).

If it returns again let me know.

And you should probly run a scan on your system using CWShredder anyway, in case it picks up any orphaned files left behind from the removal procedure.

__________

HijackThis
Spybot
Ad-Aware
CWShredder
SpywareBlaster
Housecall online antivirus scan
Stinger

0 Replies

I can not find a file called fntldr.exe on my computer. i suspect that this is only a WIN.INI entry. Most likely, it was being re-inserted by Tapicfg, which CWShredder removed:

Windows ME (4.90.3000 )
Windows dir: C:\WINDOWS
Windows system dir: C:\WINDOWS\system
AppData folder: C:\WINDOWS\Application Data
Username: Larry Bates

Found Hosts file: C:\WINDOWS\hosts (2 bytes, R)
Found CWS.Control (if filesize is over 50k) file: C:\WINDOWS\control.exe (2144 bytes, A)
Registry value: Stylesheet (HKLM) [User Stylesheet] C:\WINDOWS\hh.htt
Registry value: DefaultPrefix (should be http://) [] http://
Registry value: WWW Prefix (should be http://) [www] http://
Registry value: Mosaic Prefix (should be http://) [mosaic] http://
Registry value: Home Prefix (should be http://) [home] http://
Found Win.ini file: C:\WINDOWS\win.ini (7694 bytes, A)
Found line in Win.ini: load=
Found line in Win.ini: run=fntldr.exe
Found System.ini file: C:\WINDOWS\system.ini (1784 bytes, A)
Found line in System.ini: shell=Explorer.exe

Done!
Removed from your system:
- CWS.Tapicfg
- 1 infected IE registry values

Windows ME (4.90.3000 )
CWShredder v1.56.1
Written by Merijn - [email protected]

For any additional help with this program or removing CWS, visit: http://forums.spywareinfo.com/

For information and documentation on the Coolwebsearch trojan and its variants, visit:
http://www.spywareinfo.com/~merijn/cwschronicles.html
For donations to help support CWShredder, visit:
http://www.spywareinfo.com/~merijn/donate.html

I also can not find a file called MOSearch but it shows up as a running process. I guess it is being generated by the office shortcut bar. Killing it helps everything run faster. Maybe I can eventually find out how to delete it for good.

Two things I did delete are causing warning messages: RealPlayer and VB Scripting. I get a message that each is needed everytime I sign onto Walmart's version of AOL. Contrary to WMConnect's assertation, these are not needed.

I had read elsewhere that RealPlayer and Macromedia can be used to run vireses so I took out PealPlayer with control panel and have never let Macromedia install anything.

HijackThis must have gotten VB Scripting as the change was a complete suprise but the result is a much more secure computer so I can put up with a few warning messages.

Again, thanks a million & God bless you for your service to internet users. Very Happy

0 Replies

Great!

No prob, K4L, glad to help.

0 Replies

As for disabling MOSearch, if it cannot be done using msconfig (details for WinME, which you're using, are here), see the instructions in the article I linked to above. I'll copy it here: Microsoft KB: OFFXP: Hard Disk Runs Continuously After You Install Office XP

0 Replies

Browser Hijack: http://1-se.com/home.html

Related Topics

Quick Links

My Account

able2know