Windows Security Tutorials - Herong's Tutorial Examples - v3.01, by Dr. Herong Yang
js.users.51.la - hosts File Entries
This section describes malicious JavaScript code host, js.users.51.la, entered by the PWS Trojan into the Windows hosts file.
In the HijackThis scan log file, I also noticed 4 strange hosts file entries:
O1 - Hosts: 127.0.0.1 a.com O1 - Hosts: 127.0.0.1 js.users.51.la O1 - Hosts: 127.0.0.1 a.com O1 - Hosts: 127.0.0.1 js.users.51.la
The last modified time of the hosts file, C:\WINDOWS\system32\drivers\etc\hosts, was 10/26/2008 9:36pm This tells me that the PWS Trojan modified the host file twice, and the timestamp matches well with McAfee log file records.
The host name entered by the PWS Trojan has been reported on the Internet as a malicious Web site hosting malicious JavaScript codes.
Of course, I removed those entries from the hosts file.
Table of Contents
About This Windows Security Book
Windows 8: System Security Review
Windows 8: System Security Protection
Windows 8 Defender for Real-Time Protection
Windows 7: System Security Review
Windows 7: System Security Protection
Windows 7 Forefront Client Security
Norton Power Eraser - Anti-Virus Scan Tool
McAfee Virus and Malware Protection Tools
Spybot - Spyware Blocker, Detection and Removal
Keeping IE (Internet Explorer) Secure
Malware (Adware, Spyware, Trojan, Worm, and Virus)
HijackThis - Browser Hijacker Diagnosis Tool
IE Add-on Program Listing and Removal
"Conduit Search" - Malware Detection and Removal
"Tube Dimmer", "Scorpion Saver" or "Adpeak" Malware
Malware Manual Removal Experience
Vundo (VirtuMonde/VirtuMundo) - vtsts.dll Removal
Trojan and Malware "Puper" Description and Removal
VSToolbar (VSAdd-in.dll) - Description and Removal
►PWS (Password Stealer) Trojan Infection Removal
What Is PWS (Password Stealer) Trojan?
JS/Downloader.gen - JavaScript Downloader Malware
PWS-Mmorpg.gen - A Password Stealer Trojan
heb.exe - The Trojan Installer Program
.exe and .dll Files Installed by the Trojan
my.exe - A Second PWS Trojan Infection
.exe and .dll Files of the Second Trojan
Explorer.EXE Trying to Install a Trojan
AccessProtectionLog.txt Log File Records
ATF-Cleaner.exe - Temporary File Remover
Trajon Files Left in the System Folder
Removing PWS Trojan Startup Entries
Command Processor AutoRun - Registry Value
UserInit - Winlogon Registry Key
►js.users.51.la - hosts File Entries
Image File Execution Options - Registry Key