full-disclosure - !! Internet Explorer !!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <E075A187B11EED409B12D00100CAAD662DBF@ntserver.meltemi.local>
From: Jos at meltemi.co.uk (Jos Osborne)
Subject: !! Internet Explorer !!

You've been hijacked.

Search your registry for mshp.dll - there'll be a number of internet settings such as Home Page etc set to this. Re-set them to something more innocuous - like MSN.com.
After you've done that, try to get back on the web. If you can, go to Google, and find copies of HijackThis, AdAware ,CWShredder and Spybot Search and Destroy.
Download them, and run them.

Another site I've seen suggest that the following are names the hijacker uses to hide itself - search for them and if they've been created/modified recently then delete them.
IEFEATSL.DLL
MSIESH.DLL
SUBMITHOOK.DLL
UNINSTALL.EXE
UNINSTALL.INI
MSHP.DLL