The Hijacked Browser

From: Dan Shterev @Macnamara_Dan

Today I would like to share a issue which arose with one of our clients recently, and most importantly, the solution.

The problem was quite tricky - when internet explorer is opened a message pops up on the screen asking you to complete a survey otherwise will not let you browse the page.

Of course, if you click to start the survey you were automatically redirected to one of those silly websites where you can play poker, games etc.

The funny thing was that you could not get rid of this message in any way in Internet explorer.

It would be natural to assume that it could be easily fixed, however this was not the case.

I tried to reset Internet Explorer-which in most of the cases would solve your problem with Internet explorer. However, in this case the message kept appearing.

I tried logging on as administrator but the message continued to appear even when opening stable sites like bbc.co.uk or aol.com.

Interesting enough was that there wasn’t any information in Google about this message in particular which I was getting on the screen so I had to find my way to resolve this issue.

After running an antivirus scan I did not get any viruses detected, then I tried Malwarebytes but it was the same-the computer looked clean and not infected at all.

I checked the running processes but still I didn’t see anything suspicious but I decided to run one more check with Trojan Remover. The difference between Malwarebytes and Trojan remover is that TR checks all running processes and if some of them are infected it tries to clean and repair them. To my surprise TR detected infected file called infocard.exe, which I had noticed before with HijackThis but ignored because the description of the file says: "infocard.exe is a Windows CardSpace from Microsoft Corporation belonging to Microsoft® .NET Framework". This naturally made me think it was insignificant.

Basically the file was needed by Windows but it was infected and this was causing the browser to be hijacked-meaning that whatever you do when try to open page this process was trying to redirect you to certain web pages - potentially unsafe ones.

After rebooting the machine, TR had successfully cleaned the file and the problem was gone.

Problem:
Message popup in Internet Explorer could not let you access address bar or browse websites – instead trying to redirect you to unsafe websites.


Solution:
1. Run Trojan Remover – disinfecting “infocard.exe”
2. Reboot

The Ghost File!

From @macnamara_dan

I have recently dealt with a BSOD (Blue Screen of Death) with one of our clients. It was causing constant reboots with message:

Problem seems to be caused by the following file aopyjy.sys.
Fault found in nonpaged area.

My first step was to research for information about the file and see what it is. To my surprise my search yielded no info about this file(!) I tried Google search, Yahoo, Bing, Ask, Livesearch but found nothing-zero! No info whatsoever. The file was located in C:\Windows\System32\Drivers\aopyjy.sys

My first thought was that could be some kind of malware so I started with antivirus scan which returned with: no threats found.
I then I ran Malware bytes antimalware-updated to latest version, full scan- still no threats found.
I then I ran HiJack this -I looked over the log and there was nothing unusual.
Next step was ADS spy scan plus Trojan remover, and yet again – no threats found!
Next I ran the registry scan for this file and found a key in registry under Search assistant-ACMru-5603 folder key (a typical place for storing malware files). I removed this key, but the BSOD kept appearing.
Then I decided to check what why this file was in this particular directory and see if there was any way to remove it manually.

What I noticed was that, the file was around 800kb and the strangest thing is that the file was being modified every minute. It was as if someone or something was constantly using the file and modifying it in the background. That was scary but this was not the only issue.

I tried to delete or rename it however, surprise surprise, this was not possible. To try and remedy this I went into Safe mode-no luck. The file was being loaded with the operating system and was not possible to delete whilst Windows is running.

So my next step was to log on from another windows installation through Windows Live CD boot disk-I have tried couple of them, such as Hiren Boot CD and Erd Commander but no luck- this time I got another blue screen. So I decided to try to logon through Windows recovery console from Windows installation CD but this was not possible-another blue screen.

In this case I gave up and ran some check disk tests, because I had in mind that there was possible hard drive failure (info which I gleaned from the second blue screen. Obviously, if you suspect that the hard drive is failing, you run command prompt "chkdsk" the integrated tool in Windows designed to check the disk for errors. So if you have bad sectors on your hard drive, then you should strongly consider replacing the hard drive, because it's possible to lose all your data when the hard drive eventually fails.

The command prompt returned bad sectors, which confirmed my concerns for failed hard drive. A failed hard drive is obviously a serious issue which can be costly. So I checked the computer was still under warranty by phoning Dell.

At Macnamara we use Dell as our partner because we feel they offer the best after sales service and support in the business. Following my telephone call they have resolved the problem by replacing the hard drive-which resolved my problem once for all. However, I keep wondering, what this file was and why there is no information about it anywhere on the Web!!!

Has anyone else encountered this problem and how did they solve it? If you have read this post whilst researching for a resolution to the aopyjy.sys file, we hope our experience helped you.

If you have used our solutions, we’d love to hear from you. Just drop us a comment on our blog.