IE6 Homepage Hijack

[Scott]

My browser was Hijacked by about:blank.
I have downloaded and used Ad-Aware - Spyblocs,
StopZilla, Spybot, Startuplist, HijackThis!, Reglite and
others with no success. I have been to
http://www.akadia.com/services/about_blank_virus.html
and followed the instructions with no success. Something
keeps rewriting the code to make the browser go to
about:blank or a search page that I never visited.

What can microsft do? - I've been to the support (after
an extensive search) I found a page that proved to be no
help at all. There HAS to be something short of
reformatting to fix this!

 

[Scott]

I have since read another post and downloaded
Spywareguard which prevents the hijack - but with a
warning- this warning is constantly appearing as this
file tries to change the homepage back. Over 70 times in
a half hour so far - it stops the change but not the file.

 

[Jim Byrd]

Hi Scott - You can try this AT YOUR OWN RISK. I normally wouldn't advise
using a malware provider's uninstall, but this particular approach has been
reported to work. Paste the following IP into your browser:

195.190.118.131

On the screen you arrive at, you see a "Search For" window, and below it a
red "Uninstall Software". Download their uninstller, uninstall.exe. At
this point I would either use TotalUninstall or make a complete backup of my
system for safety's sake. Total Uninstall,
<http://www.geocities.com/ggmartau/tu.html> or direct dwnld here:
<http://files.webattack.com/localdl834/tun234.zip>


Before you try to remove spyware using any of the programs below, download a
copy of LSPFIX from any of the following sites:

<http://www.cexx.org/lspfix.htm>
<http://www.spychecker.com/program/winsockxpfix.html> (if your OS is Win2k
or
XP) The process of removing certain malware may kill your internet
connection. If this should occur, this program, LSPFIX, will enable you to
regain your connection


Run this uninstall program program that you downloaded from the malware
site, then UPDATE them and go to Safe mode to run UPDATED versions
CWShredder, AdAware and SpyBot per the following directions:




Note that this symptom often indicates the possibility of other malware.
You might want go to this page at Jim Eshelman's site, here:
<http://aumha.org/a/noads.htm> or here:
<http://inetexplorer.mvps.org/parasite.htm> and wait a little bit (be
patient), while an analysis of a number of possible parasites on your
machine will be made to help you identify and remove them. NOTE: You will
need to disable Ad Blocking in Zone Alarm 3.x, if present or any other Ad
Blocking software which interferes with Java Scripting for this scan to
work. You should get a message between the two lines of **** giving the
results of the scan.


..


All of these removal tools should be run from Safe mode
when possible


For the general hijack case, the best way to start is to get Ad-Aware 6.0,
Build 181 or later, here: <http://www.lavasoftusa.com/support/download/>.
UPDATE and run this regularly to get rid of most "spyware/hijackware" on
your machine. If it has to fix things, be sure to re-boot and rerun
AdAware again and repeat this cycle until you get a clean scan. The reason
is that it may have to remove things which are currently "in use" before it
can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: <http://security.kolla.de/> SpyBot Support Forum here:
<http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi>. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.


Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
<http://www.imilly.com/alexa.htm>


A currently common parasite is some malware called CoolWebSearch. Do the
following:

Download, UPDATE before running, and run:
<http://209.133.47.200/~merijn/files/CWShredder.exe> to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: <http://www.zerosrealm.com/downloads/CWShredder.zip>

BE SURE that you get v.158 or later!

You will need to show Hidden files first and then at the end clear the
malware garbage from your System Restore backups after you've cleaned up.
It's best to perform CWShredder (and most other malware fixers too) from
Safe mode and then reboot. AFTER cleaning things up, then you can disable
and then re-enable System Restore. See ******** below.

The following links give instructions on how to do these various functions:


HOW TO Restart in Safe Mode

HOW TO Enable Hidden Files

HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning or
use the suggested procedure for XP at the ******'s)
(WinXP)
(WinME)



Then download and run:
<http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg> to restore your
tabs and remove any restrictions that the parasite has put in place.

Now download and run:
<http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG> to restore
your search functions if they've been affected (as they probably will have
been).


Be sure that you also download and install hotfix Q816093, here:

<http://support.microsoft.com/?kbid=816093>

which blocks the exploit upon which this parasite family depends.


If they don't fix it then start here:

Download HijackThis, free, here:
<http://209.133.47.200/~merijn/files/HijackThis.exe> (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
<http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552
982a8baee6434cfc13>

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Unzip the downloaded HijackThis to any convenient folder, start it then
press Scan. Click on SaveLog when it's finished which will create
hijackthis.log. Now click the Config button, then Misc Tools and click on
Generate StartupList.log which will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
<http://216.180.233.162/~swicom/forums/>

or Net-Integration here:
<http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi?s=d3c2c886d536d5
7b5f65b6e40c55365e;act=ST;f=27;t=6949>

or Tom Coyote here: <http://forums.tomcoyote.org/index.php?act=idx>

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

<http://www.javacoolsoftware.com/spywareblaster.html> (Prevents malware
Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

<http://www.javacoolsoftware.com/spywareguard.html> (Monitors for attempts
to
install malware) Keep it UPDATED. Both Very Highly Recommended


Finally, go to Windows Update and ensure that ALL Critical updates are
installed.


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Jan Il]

Hi Scott

I have since read another post and downloaded
Spywareguard which prevents the hijack - but with a
warning- this warning is constantly appearing as this
file tries to change the homepage back. Over 70 times in
a half hour so far - it stops the change but not the file.

I too have SpywareGuard, and I can't seem to find a way to have the program
run 'silently', so that it does not visually alert to every problem.
Although, I have not seen this problem.

I would suggest replacing the SpywareGuard with Free SpyBlaster. It is a
sister program to the SpywareGuard, it is from the same company, it works
equally as good, and it has more adjments for user preferences. It may be
less 'in your face' about what it is doing.

SpywareBlaster - Free
http://www.javacoolsoftware.com/spywareblaster.html

Also, if something is constantly trying to change your home page, you might
download, install and run the HiJackThis program to see what might be
lurking on your system to cause the on-going problem. Also, if you don't
have a firewall installed, try the Free Zone Alarm. I have it, and it works
great.

Zone Alarm Free
http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp

Hope this helps.

Jan

 

[LuckyStrike]

Hi Jan -

I believe; no, I correct that; I know SpywareBlaster is a *preventative
measure* for spyware by blocking known CLSID's from installing BHO's and the
like. But SpywareBlaster will not remove or clean anything already at large
in the PC. It will prevent re-infection of what is there, once it has been
removed. I have and use them both, but actually I rarely have SpywareGuard
running in the background. Therefore I have removed a good deal of it's
efficacy, but at the same time am only notified of any changes once I start
it up.

But the most recent info on the *constant* Home Page Hijacking redirects can
be found at SpywareInfo Forums; pasted in part here:

<paste>
In the last few days ... This infection:
res://<random>.dll/<random>.html#<random> has spread like wildfire and we
are inundated with requests to help clear it. Sometimes the fixes that have
been created work, sometimes not - Unfortunately. .... It appears that
ad-aware is cleaning the files etc but not deleting the registry entries
associated with the clean....<snip>
If you still get the entries after booting into normal mode and are not sure
what to delete, post your log in the forum but mention what version of
ad-aware you run as well as the reference file version - This will help in
the resolution.

Also - If you request help, DO NOT reboot your computer until you receive a
response as the files change as soon as you reboot. If you receive no
response and you have rebooted - Post a new HijackThis log into your current
message - DO NOT start a new message again as we cannot keep up with all the
calls.
<paste/>

the above is from SpywareInfo Forums
http://forums.spywareinfo.com/index.php?showtopic=8847

I realize this poster may not have exactly the same type of Browser Hijack
as the above refers to, but 70 re-directs in a span of 1/2 hour is pretty
darn near. :-| <g>

 

[LuckyStrike]

Hi again Jan -

Thought I'd add this little extra bit of info (and a small correction as
regards *ActiveX* elements). This will be a copy and paste from an older
..mht file on SpywareBlaster that I cannot now offer as a link. It is from
Javacool itself though; this I assure you.
<paste>
SpywareBlaster doesn't scan and clean for spyware - it prevents it from ever
being installed.

By setting a "kill bit" for spyware ActiveX controls, SpywareBlaster can
prevent the installation of any spyware ActiveX controls from a webpage. It
does this while not interfering with "friendly" ActiveX controls.... <snip>
In addition, SpywareBlaster can prevent many of these spyware ActiveX
controls from running, even if they are already installed on your system.*

*You agree, as the user of this product, to take full responsibility for any
and all actions it performs. Some of the spyware it protects your system
against may be included in commercial programs, and you may not be allowed
to disable the spyware without uninstalling those programs. See each
program's license agreement for details.
<paste/>
~~~~~~~~~~~~~
From the current Javacool page it says: <quote> Prevent the installation of
ActiveX-based spyware, adware, browser hijackers, dialers, and other
potentially unwanted pests. <quote/>

From Bleeping Computer Tutorial:
http://www.bleepingcomputer.com/forums/index.php?showtutorial=49
<paste>
Many Spyware, Hijackers, and Dialers are installed on your Internet Explorer
Web Browser through a Microsoft program called ActiveX. These activex
programs are downloaded when you go to certain web sites and then they are
run on your computer. These programs can do a variety of things such as
provide legitimate services likes games or file viewers, but they can also
be used to install Hijackers and Spyware on to your computer without your
permission.

SpywareBlaster, a program created by Javacool, is used to secure your
Internet Explorer to make it harder for these ActiveX programs to run on
your computer, as well as disabling the ability of certain known offending
ActiveX programs from running at all. <snip>

As you can see SWB is a very powerful tool in the protection against Spyware
and Hijackers. Though this tool will not remove Hijackers/Spyware from your
system, it will prevent you from getting infected in the future. Therefore,
it is highly recommended that you use this tool to its fullest potential and
to constantly update it so that you can have protection from the latest
threats that may have arisen.
<paste/>

Later, and don't forget to check that your can of "Raid" is full. ;-)

 

[Guest]

try "Hijacker This" software at shareware.com

 

[Jan Il]

Hi Scott

I have since read another post and downloaded
Spywareguard which prevents the hijack - but with a
warning- this warning is constantly appearing as this
file tries to change the homepage back. Over 70 times in
a half hour so far - it stops the change but not the file.

I have to make a correction on this part of my previous post. Sorry if the
error has caused any confustion.

I would suggest replacing the SpywareGuard with Free Spy[ware]Blaster. It is
a
sister program to the SpywareGuard, it is from the same company, it works
equally as good, and it has more adjments for user preferences. It may be
less 'in your face' about what it is doing.

HTH

Jan

 

[Jan Il]

Hi LuckyStrike

Hi again Jan -

Thought I'd add this little extra bit of info (and a small correction
as regards *ActiveX* elements). This will be a copy and paste from an
older .mht file on SpywareBlaster that I cannot now offer as a link.
It is from Javacool itself though; this I assure you.
<paste>
SpywareBlaster doesn't scan and clean for spyware - it prevents it
from ever being installed.

By setting a "kill bit" for spyware ActiveX controls, SpywareBlaster
can prevent the installation of any spyware ActiveX controls from a
webpage. It does this while not interfering with "friendly" ActiveX
controls.... <snip> In addition, SpywareBlaster can prevent many of
these spyware ActiveX controls from running, even if they are already
installed on your system.*

*You agree, as the user of this product, to take full responsibility
for any and all actions it performs. Some of the spyware it protects
your system against may be included in commercial programs, and you
may not be allowed to disable the spyware without uninstalling those
programs. See each program's license agreement for details.
<paste/>
~~~~~~~~~~~~~
From the current Javacool page it says: <quote> Prevent the
installation of ActiveX-based spyware, adware, browser hijackers,
dialers, and other potentially unwanted pests. <quote/>

From Bleeping Computer Tutorial:
http://www.bleepingcomputer.com/forums/index.php?showtutorial=49
<paste>
Many Spyware, Hijackers, and Dialers are installed on your Internet
Explorer Web Browser through a Microsoft program called ActiveX.
These activex programs are downloaded when you go to certain web
sites and then they are run on your computer. These programs can do a
variety of things such as provide legitimate services likes games or
file viewers, but they can also be used to install Hijackers and
Spyware on to your computer without your permission.

SpywareBlaster, a program created by Javacool, is used to secure your
Internet Explorer to make it harder for these ActiveX programs to run
on your computer, as well as disabling the ability of certain known
offending ActiveX programs from running at all. <snip>

As you can see SWB is a very powerful tool in the protection against
Spyware and Hijackers. Though this tool will not remove
Hijackers/Spyware from your system, it will prevent you from getting
infected in the future. Therefore, it is highly recommended that you
use this tool to its fullest potential and to constantly update it so
that you can have protection from the latest threats that may have
arisen. <paste/>

Thank you for the very detailed and informative information, I really
appreciate your additional input.

I agree that the number of attempts to change *do*indicate a problem that
needs to be cleaned....but, according to the OP's initial post, he has
already tried the usual cleaning recommendations to no avail, and the
constant nagging of the SpywareGuard was beginning to become stressful of
him, in addition to coping with trying to find the solution for the
hijacker. By suggesting that he substitute the SpywareBlaster for the
SpywareGuard at this time was to still afford him protection, but, without
the stress of the on-going alerts, as he is aware that the problem persists
and is looking for a cure. I have both the programs on my machine, and I
have never seen anything of the SG but the SG logo in the lower System Tray.


I found Jim Byrd's recommendation quite interesting, in that it is an
unusual approach. But, evidently, this is a rather obstinate type of critter
that just refuses to go quietly into that good night. It calls cries out for
the ScumBusters

Later, and don't forget to check that your can of "Raid" is full. ;-)

Sadly, these days I must arm my Magic Wand with Pesky dust instead of Pixie
dust.....<sigh>.....and all those poor handsome Prince's out there still
waiting for me to set them free......(tsk tsk tsk..)

'Gator.... ;-)

Jan

 

[LuckyStrike]

How-dee .<s>

<snip>
Thank you for the very detailed and informative information, I really
appreciate your additional input.

You're welcome Jan. ;-)) It is handy to have as much info - as one can

I agree that the number of attempts to change *do*indicate a problem that
needs to be cleaned....but, according to the OP's initial post, he has
already tried the usual cleaning recommendations to no avail, and the
constant nagging of the SpywareGuard was beginning to become stressful of
him, in addition to coping with trying to find the solution for the
hijacker. By suggesting that he substitute the SpywareBlaster for the
SpywareGuard at this time was to still afford him protection, but, without
the stress of the on-going alerts, as he is aware that the problem persists
and is looking for a cure. I have both the programs on my machine, and I
have never seen anything of the SG but the SG logo in the lower System Tray.

Sure seems like it could use some serious clean-up. Yep...the SG alert can
be a nuisance...particularly if it is like ~ every 20 seconds! I didn't do
the math, but 70 alerts in 1/2 hour; close enough. hehe. You're a bit
luckier than I, as far as SG alerts. Every now and then I'll go surfing
somewhere, and forget I have enabled Active Scripting for a previous site,
then *bang*! You know - or maybe you don't - but you can well guess. <g>
Anyway, I'd go along with the idea of having SWB over SG if one were to have
only one of them installed. SWB is not the least bit intrusive. Also, I
don't know about you, but with my W98se, SG disables my tooltips when it
runs, so I don't even run it very often. :-\

I found Jim Byrd's recommendation quite interesting, in that it is an
unusual approach. But, evidently, this is a rather obstinate type of critter
that just refuses to go quietly into that good night. It calls cries out for
the ScumBusters

Sadly, these days I must arm my Magic Wand with Pesky dust instead of Pixie
dust.....<sigh>.....and all those poor handsome Prince's out there still
waiting for me to set them free......(tsk tsk tsk..)

Buy it in the "economy size" and save a few bucks, 'cause there's more pests
than ammo. Remember... use controlled short bursts! ;-D

'Gator.... ;-)

Jan

-Ade...;-D

 

[Jan Il]

DooDee Time! ;-)

How-dee .<s>



You're welcome Jan. ;-)) It is handy to have as much info - as one can
absorb. <g> I might have gone a bit over the top though. ;-D

I have been catching up on an extended discussion on a specific problem
area, so I did have to digest it in segments to keep from getting a headrush
of infoflux. <g> However, I agree that, with the stuff out there, you have
to keep your P's as sharp as the Q', and make sure the R's are well oiled,
or you could wind up with wet feet.

Sure seems like it could use some serious clean-up. Yep...the SG
alert can be a nuisance...particularly if it is like ~ every 20
seconds! I didn't do the math, but 70 alerts in 1/2 hour; close
enough. hehe. You're a bit luckier than I, as far as SG alerts. Every
now and then I'll go surfing somewhere, and forget I have enabled
Active Scripting for a previous site, then *bang*! You know - or
maybe you don't - but you can well guess. <g> Anyway, I'd go along
with the idea of having SWB over SG if one were to have only one of
them installed. SWB is not the least bit intrusive. Also, I don't
know about you, but with my W98se, SG disables my tooltips when it
runs, so I don't even run it very often. :-\

I wanted to try it myself, as I have seen a lot of posters asking/using it,
and I wanted to know first hand what it did/didn't do in comparision to
SpywareBlaster. I don't see a reason to have both on your system, and I
too, prefer to keep the SpywareBlaster. I like the added features it offers,
and the fact that it is a very good 'silent partner.'

Yeah, it sounds like a job for Sandi Hardmeier. <BG> She's prolly been
there, and done that I'll bet. hehe.

Buy it in the "economy size" and save a few bucks, 'cause there's
more pests than ammo. Remember... use controlled short bursts! ;-D

...........wholesale exterminator.....<sigh> What ever happened to the good
'ol days? With all the pomp and flare....err....flair......I feel like the

-Ade...;-D

Doo <g>

Jan

 

[LuckyStrike]

Nice to see your amusing and lightweight post here, and a good way to
conclude a full day. It's often so "critical mass" in the help arena that it
becomes infectious. (I've been there from the other side too; prolly be
there again at any time). Meanwhile, I don't know how and where you come up
with your witty comments at this late hour and long day.... Bravo. I managed
to crack a grin before having my fingers stumble about the keyboard, but am
too wiped to reply on par with your present standard of comical comments.
;-D

Anyway, that's it for now, departing ...jaw agape in sheer fatigue and
amazement. See you about then. <s>
Cheers,

 

[LuckyStrike]

Yeah...I was so bushed last night that I couldn't even say that my "S", "T",
and "U's" had pretty much ground to a halt (might as well add the
rest...that's "PID" along with the "STU"). Not only had my feet gotten wet,
but became webbed as well. <BG>

 

[Jan Il]

Nice to see your amusing and lightweight post here, and a good way to
conclude a full day. It's often so "critical mass" in the help arena
that it becomes infectious. (I've been there from the other side too;
prolly be there again at any time). Meanwhile, I don't know how and
where you come up with your witty comments at this late hour and long
day.... Bravo. I managed to crack a grin before having my fingers
stumble about the keyboard, but am too wiped to reply on par with
your present standard of comical comments. ;-D

Comical....oh. Well....ahmm.....I can be serious, but, it tends to give me
a headache.

I find a bit of humor can take the edge off some who are really stressed out
with their problem. By the time most posters get here, they have been
beating themselves up pretty good trying to figure out what the problem is.
All they want is the quick fix to ease the booboo. But, it is not always
possible to give them an easy fix, so I try to make the additional effort a
little less stressful. A calm mind tends to work better. Well.....in most
cases. )

Anyway, that's it for now, departing ...jaw agape in sheer fatigue and
amazement. See you about then. <s>

Yep, it's about that time alright. <g>

Jan

 

[Jan Il]

Yeah...I was so bushed last night that I couldn't even say that my
"S", "T", and "U's" had pretty much ground to a halt (might as well
add the rest...that's "PID" along with the "STU"). Not only had my
feet gotten wet, but became webbed as well. <BG>

..
Ahh...webbed feet. I see....one of The Donald's friends. ;-))

Jan

 

[LuckyStrike]

LuckyStrike wrote:

.
Ahh...webbed feet. I see....one of The Donald's friends. ;-))

How'd you know I once lived in NY? Though, the closest it gets to
Disneyworld is through a spelling error... like Dizzyworld. ;-D