1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Resolved Browser hijack?

Discussion in 'Windows XP' started by DaveC1947, 2009/08/15.

  1. 2009/08/15
    DaveC1947

    DaveC1947 Inactive Thread Starter

    Joined:
    2008/03/21
    Messages:
    23
    Likes Received:
    1
    Hi all,

    I've been asked to open this thread, was in Malware & Virus section

    Problem:
    I always set my homepage to About:blank, helps detect browser hijacks as about:blank is a local file and does not require internet access.
    3 days ago Ad-Aware told me that I had a trojan in Wininet.dll, and promptly quarantined the file. Explorer.exe uses this file, so all I could get was my background screen and no programme access, not even in safe mode.
    Re-installed XP and all service packs.
    When I open IE6 or IE7, Zone Alarm tells me IE is asking for internet access through the loop-back adaptor 127.0.0.1 port 5152.
    This has not happened for the previous 3 years on XP, and I believe that 5152 is a UDP port ie no handshake protocols
    Is this a Trojan??, Google Chrome opens to the blank page without asking for access to the internet.
    We cannot find any sign of an infection, but IE still asks for internet access when opening About:blank

    any ideas???

    many thanks

    Dave:
     
    DaveC1947,
    #1
  2. 2009/08/15
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    Broni already told you your system wasn't infected. You won't get Malware advise in the XP forum.
     
    Admin.,
    #2


  3. to hide this advert.

  4. 2009/08/15
    DaveC1947

    DaveC1947 Inactive Thread Starter

    Joined:
    2008/03/21
    Messages:
    23
    Likes Received:
    1
    Broni also told me to post here!, so where do you suggest I post it (clean answers only please)
     
    Last edited: 2009/08/15
    DaveC1947,
    #3
  5. 2009/08/15
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    The point being that 127.0.0.1 is not the Internet, its your local PC. I don't know what to tell you about ZA, other then to ask in their own forums. I don't like their software one bit.
     
    Admin.,
    #4
  6. 2009/08/15
    DaveC1947

    DaveC1947 Inactive Thread Starter

    Joined:
    2008/03/21
    Messages:
    23
    Likes Received:
    1
    Couldn't agree more, Arie. ZA were great until Checkpoint got them, used to run ZA Pro until I got fed up with the system crashes.
    At the risk of running way off topic, I'm now also getting a message that Wndows BBS is trying to open activeX controls, have seny a message to Admin(you perhaps?)
    I know that 127 adresses are reserved for local hosts, but if I don't allow internet access blank will not open, and despite being unable to find any infections, something is going on that is not quite right.

    Dave
     
    DaveC1947,
    #5
  7. 2009/08/15
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I suggest, you uninstall ZA, and try something else, like Comodo.
     
    broni,
    #6
  8. 2009/08/16
    mailman Lifetime Subscription

    mailman Geek Member

    Joined:
    2004/01/17
    Messages:
    1,901
    Likes Received:
    11
    The brief (and resolved) discussion in this link implicates Java Quick Starter (JQS) as the culprit. I think JQS is a fairly recent "enhancement" for Java (because I recall seeing references to it only recently). I have not researched to determine when JQS was first pushed by Sun.

    I looked at your ComboFix log and found the following.
    My guess is the O2 BHO (browser helper object) entry (jqs_plugin.dll) may be causing your localhost (127.0.0.1) port 5152 connection attempts whenever you open IE.

    I bet Broni can tell you whether it's safe to have HijackThis "fix" the O2 BHO entry or not ;) (or whether there's a better method for disabling/removing the BHO or not).

    I currently do not have Java installed so I cannot easily check the Java in my Control Panel to see if there's a simple setting (to turn off Java Quick Starter). I bet you can though. ;)


    EDIT: I read that "resolved" thread more carefully and looked at your Malware & Virus Removal thread again. I also found the following "Running Process" in your computer.
     
    Last edited: 2009/08/16
    mailman,
    #7
    DaveC1947 and Admin. like this.
  9. 2009/08/16
    DaveC1947

    DaveC1947 Inactive Thread Starter

    Joined:
    2008/03/21
    Messages:
    23
    Likes Received:
    1
    Bingo!!
    Problem resolved. For information, and for any other possible readers, I also disabled Jusched through msconfig, another java file to slow down the system & cause major page fault problems.
    If you are running Avast on access scanner, this will listen on port 12080 whenever IE is opened.

    many thanks

    Dave
     
    DaveC1947,
    #8
  10. 2009/08/16
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Nice job, mailman :)

    I believe JQS was introduced around update 10, or 11.
    The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.
     
    broni,
    #9
  11. 2009/08/16
    mailman Lifetime Subscription

    mailman Geek Member

    Joined:
    2004/01/17
    Messages:
    1,901
    Likes Received:
    11
    You're very welcome, Dave. I'm glad I could assist. Thank you for following up to let us know and tagging the thread as "Resolved ".

    Thank you, Broni. :)


    BTW, in ZoneAlarm's defense, ...

    I think ZA was properly doing its job. Now that you know the alert was about a non-malicious action, you could alternatively configure ZA to always allow that event and then leave the JQS running. However, it seems that might open up your computer to potential (undiscovered) vulnerabilities in JQS. Probably safest to simply disable JQS.

    The first firewall I used was ZA and then later I used ZAPro for years. I also use Norton SystemWorks (NSW). I know I'm going "against the grain" regarding the opinions of several other people around here. :p If I recall correctly, I switched from ZAPro to Comodo for two reasons.
    • My ZAPro license was near expiration.
    • I suspected conflicts between ZAPro and NSW because the events in my firewall log did not seem to correspond to the applications that should be involved.

    If I recall correctly, ZA seems to be a good free firewall to install for computer novices: not much configuration needed to make ZA do its job (and do it silently in most cases).
     
    mailman,
    #10

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...