Internet Explorer problem

Discussion in 'Computers' started by Jon_Are, Apr 7, 2005.

  1. Jon_Are

    Jon_Are Cinematographer

    Joined:
    Jun 25, 2001
    Messages:
    2,036
    Likes Received:
    0
    Trophy Points:
    0
    Here's the deal: Something sinister is re-setting my homepage in Internet Explorer, and when I try to change it, it won't stick.

    I've tried running an AV and using Ad-Aware, but no go. This is the second time this has happened - the last time, I ended up re-installing XP.

    What's weird is that the address of the forced home page is "about - blank", and contains the usual links to Viagra, etc. Obviously, this is some sort of spyware.

    If you have any suggestions, short of re-installing XP, I'd love to hear them.

    And please don't bother "selling" me on Mozilla - I already use it and love it for 99% of my browsing. I just need IE every now and then.

    Thanks!

    Jon
     
  2. Joseph DeMartino

    Joseph DeMartino Lead Actor

    Joined:
    Jun 30, 1997
    Messages:
    8,311
    Likes Received:
    13
    Trophy Points:
    0
    Location:
    Florida
    Real Name:
    Joseph DeMartino
    Download and install Spybot Search & Destroy and Microsoft's Anti-Spyware Beta. They can find things tha Ad Aware misses, and vice versa. I find running all three to be the best insurance against spyware. MS-A runs in auto-protect mode, as does Spybot, and also automatically updates itself and runs a scan once a day. The other two programs I update and run manually about once a week.

    MS Anti-Spyware also has a specific setting for home page hijackers: It lets you a page to which the homepage will automatically be reset if a rogue program changes it.

    Regards,

    Joe
     
  3. Greg*go

    Greg*go Supporting Actor

    Joined:
    Jun 14, 2002
    Messages:
    941
    Likes Received:
    0
    Trophy Points:
    0
    I'd also download and then run CWShredder. Do a search for that program and download it from here. Don't download CWShreddar 2.. Use the original one. That little program used to be the best at getting rid of hijackers. Also, do some searches at CastleCops. I'm sure there are several threads there that deal with your exact problem.

    I don't know if the MS-AS hijack preventer helps if you all ready have a hijacked page... I think it's just set to default to the current page, which doesn't do you much good if you are all ready hijacked. I haven't installed MS-AS on a computer that has been hijacked yet though, so I'm not certain on that.

    Good Luck.. let us know how it turns out.
     
  4. Mary M S

    Mary M S Screenwriter

    Joined:
    Mar 12, 2002
    Messages:
    1,544
    Likes Received:
    0
    Trophy Points:
    0
    this one is pesky but you should not have to reinstall your OS. I had it once last year? but my OS at that time on that DT was 98. I found 98 much easier when I was searching for files, XP seems to try to hide them.

    I really can't help with a step by step removal, its been too long, plus this one changes, it may have different files/dll's etc in diffrent users systems. At the time I checked files created and modified till I zeroed in the time of the hijack, via this I studied everything and started deleting, when you find the files some will start to be obvious they have the proper time stamp and have some varation in the name along the line of "search assistance" etc in the file extension. Somewhere there should also be a file with "about" (and/or blank) in the extenstion. I had to delete it several times, wiping internet cookies, objects etc, finally got down to one last embedded rootlike, file which was "in use" ...that one frustrated me, If I remeber it was tied to a legiminate process running in W98 whenever computer is booted. When I stopped all non-critical process's (including IE) temporally, I could delete this last file, then was finally clean.

    Recently I had seen mention on the 'about' hijack, on the web, it seems to stay out there, so try googling. I belive some have luck with CWShedder(?) as a tool. Also, I learned (till I got the last file involved, out) I had to delete all cookies/files in my browser EACH time before I booted the computer after each individual file delete, else a cookie was rewritten to my temp files?. I made the mistake of forgetting to manually remove the 'about blank .com' address from the 'use default' screen in internet options. Just removing the offending files that 'about' downloads, - will not re-set the 'default' homepage to your choice of preference. If you forget to retype it correctly. (after spending time finding and deleting all files), - the second you connect you just returned to the 'about blank' site and are reinfected. . ...I just had to dig it all out, (again). I believe there was at least one dll. involved and 2-3 misc files of some sort involved. I did not have to edit my registry, although some victims mention having to do this during a cleanout.
    I'm sure like all of them, it has evolved, and might require some registry cleanup now.
    Good luck.
     
  5. Jon_Are

    Jon_Are Cinematographer

    Joined:
    Jun 25, 2001
    Messages:
    2,036
    Likes Received:
    0
    Trophy Points:
    0
    I installed MS Anti-Spyware, and that seems to have fixed the problem - It found one browser hijack application, deleted it, and it looks like it shall never return.

    The spyware immediately tried to elbow its way back in, but MSAS quickly asked it to leave.

    Really cool program that I hadn't known about - thanks, Joseph.

    I'm also going to install Spybot - have had it before, but never re-installed after re-installing XP last time.

    Thanks to Greg and Mary as well - I'm thankful I didn't have to go through what Mary described.

    My next issue is pop-ups. I used Pop-Up Stopper, but it seems to have lost its effectiveness (I've checked for updates, there are none).

    Is there a similar pop-up program that is more effective?

    Thanks,

    Jon
     
  6. Scott Merryfield

    Scott Merryfield Executive Producer

    Joined:
    Dec 16, 1998
    Messages:
    12,312
    Likes Received:
    1,068
    Trophy Points:
    9,110
    Location:
    Michigan
    Jon,

    Check out Firefox as a replacement for Internet Explorer. It is much less vunerable to all the spyware out there that is designed to exploit the holes in IE. I've been running Firefox for several months after two nasty spyware attacks, and have been spyware-free ever since.
     
  7. Jon_Are

    Jon_Are Cinematographer

    Joined:
    Jun 25, 2001
    Messages:
    2,036
    Likes Received:
    0
    Trophy Points:
    0
    Seems I spoke too soon.[​IMG]

    The homepage hijack has returned with a vengeance. I'm just going to re-install XP, then do the MS Anti-Spyware thang.

    Scott - I know all about Firefox; see my initial post:


    Jon
     
  8. Glenise

    Glenise Supporting Actor

    Joined:
    Feb 5, 2001
    Messages:
    773
    Likes Received:
    2
    Trophy Points:
    0
    Let us know if reinstalling xp fixes the problem.
     
  9. Glenise

    Glenise Supporting Actor

    Joined:
    Feb 5, 2001
    Messages:
    773
    Likes Received:
    2
    Trophy Points:
    0

Share This Page