OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
RE: [Full-Disclosure] !! Internet Explorer !!

From: Jos Osborne (Josmeltemi.co.uk)
Date: Fri Jun 11 2004 - 09:18:21 CDT


You've been hijacked.

Search your registry for mshp.dll - there'll be a number of internet settings such as Home Page etc set to this. Re-set them to something more innocuous - like MSN.com.
After you've done that, try to get back on the web. If you can, go to Google, and find copies of HijackThis, AdAware ,CWShredder and Spybot Search and Destroy.
Download them, and run them.

Another site I've seen suggest that the following are names the hijacker uses to hide itself - search for them and if they've been created/modified recently then delete them.
IEFEATSL.DLL
MSIESH.DLL
SUBMITHOOK.DLL
UNINSTALL.EXE
UNINSTALL.INI
MSHP.DLL

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html