Computing.Net > Forums > Security and Virus > Browser Hijack attempt?

Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free!

Browser Hijack attempt?

Reply to Message Icon

Original Message
Name: Mr Mister
Date: June 5, 2004 at 16:04:36 Pacific
Subject: Browser Hijack attempt?
OS: w98
CPU/Ram: p2/200mb
Comment:

Hi. I have a question regarding a possible browser hijack attempt on my computer. After running AdAware, i remove two infected registry keys. Here is the info:

Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainStart Pageabout:blank

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "about:blank"
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "about:blank"

Possible browser hijack attempt : .Default\Software\Microsoft\Internet Explorer\MainStart Pageabout:blank

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "about:blank"
Rootkey : HKEY_USERS
Object : .Default\Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "about:blank"

Not a problem. I quarantine and delete it. Then, when i open up my internet explorer, my homepage is now www.msn.com. So i run the adaware again, same deal. It finds the same registry keys, i quarantine/delete them, and again, my homepage is redirected to MSN.com

Im only redirected to msn once i delete these registry keys. Plus, they keep coming back time and time again. My nortons says no virus found, i update twice a week. What is causing this and how can i rid myself of this problem for good?

P.S. Can this be caused by my pop up killer? Its called NoAds 2002.11.05. I dont know, just a theory. Maybe coincidence. Any help is appreciated please.

Thanks in advance.

i have dual boot win98 and win XP, my problem is how to edit the MBR, because my Win XP does not boot properly (it boots again and again without getting in to the proper OS of Win XP). What will I do?


Report Offensive Message For Removal


Response Number 1
Name: Abnormal
Date: June 5, 2004 at 16:34:23 Pacific
Reply: (edit)

http://www.lavahelp.com/articles/v6/04/05/1801.html

Answer found at
http://www.lavahelp.com/


Report Offensive Follow Up For Removal

Response Number 2
Name: Abnormal
Date: June 5, 2004 at 17:32:23 Pacific
Reply: (edit)

From SpyDie:

Remove that entry and your Start-page for IE will be reset to msn.com. Now, reset it again to About:Blank. Re-run a new scan with Ad-aware and place that object on the ignore list (right-click on the item in the 'results' window and select 'Add selection to Ignorelist')


Report Offensive Follow Up For Removal

Response Number 3
Name: Mr Mister
Date: June 6, 2004 at 06:35:40 Pacific
Reply: (edit)

thanks! that helped

Mr. Mister


Report Offensive Follow Up For Removal

Response Number 4
Name: Djet3k
Date: June 27, 2004 at 06:12:13 Pacific
Reply: (edit)

hy

i have the exact same problem;( but now i did what you said and still have the same problem;( and adware now just ignores those (8) files ! ;( what should i do?????


Report Offensive Follow Up For Removal

Response Number 5
Name: Djet3k
Date: June 27, 2004 at 06:26:16 Pacific
Reply: (edit)

should i quarantine em first before i ignore em?


Report Offensive Follow Up For Removal


Response Number 6
Name: Djet3k
Date: June 27, 2004 at 12:02:46 Pacific
Reply: (edit)

these are the ones that keep comming back;(

Possible Browser Hijack attempt RegData Data Miner HKEY_CURRENT_USER:Software\Microsoft\Internet Explorer\Main\"about:blank" (Ignored)
Possible Browser Hijack attempt RegData Data Miner HKEY_LOCAL_MACHINE:Software\Microsoft\Internet Explorer\Main\"about:blank" (Ignored)
Possible Browser Hijack attempt RegData Data Miner HKEY_CURRENT_USER:Software\Microsoft\Internet Explorer\Main\"file://C:\DOCUME~1\IRONHE~1\LOCALS~1\Temp\sp.html" (Ignored)
Possible Browser Hijack attempt RegData Data Miner HKEY_CURRENT_USER:Software\Microsoft\Internet Explorer\Main\"file://C:\DOCUME~1\IRONHE~1\LOCALS~1\Temp\sp.html" (Ignored)
Possible Browser Hijack attempt RegData Data Miner HKEY_CURRENT_USER:Software\Microsoft\Internet Explorer\Search\"file://C:\DOCUME~1\IRONHE~1\LOCALS~1\Temp\sp.html" (Ignored)
Possible Browser Hijack attempt RegData Data Miner HKEY_LOCAL_MACHINE:Software\Microsoft\Internet Explorer\Main\"file://C:\DOCUME~1\IRONHE~1\LOCALS~1\Temp\sp.html" (Ignored)
Possible Browser Hijack attempt RegData Data Miner HKEY_LOCAL_MACHINE:Software\Microsoft\Internet Explorer\Main\"file://C:\DOCUME~1\IRONHE~1\LOCALS~1\Temp\sp.html" (Ignored)
Possible Browser Hijack attempt RegData Data Miner HKEY_LOCAL_MACHINE:Software\Microsoft\Internet Explorer\Search\"file://C:\DOCUME~1\IRONHE~1\LOCALS~1\Temp\sp.html"


Report Offensive Follow Up For Removal

Response Number 7
Name: dapper
Date: July 1, 2004 at 10:10:01 Pacific
Reply: (edit)

Hi,I have a question regarding Browser Hijack attempt on my computer.My computer shows some symptoms like SCREEN FLICKERING. ALso it downloads 2 file named "o.bat" and "o" After running AdAware, i removed 4 Registry keys. One was related to "Alexa" and other three were concerned with "Cydoor". Also I removed other Objects that Adaware suspected to hav caused such problem. But all in vain.
If anybody can Help me that would be great. Thanx to all
Chao

Dapper


Report Offensive Follow Up For Removal

Response Number 8
Name: BachaoAandolan
Date: July 19, 2004 at 13:23:29 Pacific
Reply: (edit)

Here's the help:

http://www.softwarepatch.com/tips/about-blank-adware.html


Report Offensive Follow Up For Removal

Response Number 9
Name: Pottergurl
Date: July 28, 2004 at 17:41:12 Pacific
Reply: (edit)

I dunno why my startup homepage on IE is always " about:blank" with the stupid 'Search for...' written on top. I've constantly went to Tools and set the homepage as 'www.google.com" but it doesnt work and I always get that 'about:blank" thing and i've tried everything and downloaded every program....I have adware (the latest version) but it just seems to ignore it. I really need help on removing this spyware stuff....and those annoying pop-ups and everything. If anyone knows the solution.....please..PLEASE EMAIL ME.
Thanks.


Report Offensive Follow Up For Removal






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home








Do you own an iPhone?

Yes
No, but soon
No


View Results

Poll Finishes In 7 Days.
Discuss in The Lounge
Poll History




Data Recovery Software