WTF?
Never has this happened before to me.First time I have even heard about Browser Hi Jacking.But I do know this.I can not set a Home Page.
When they say Hi-Jack they really mean it. :blink:
Printable View
WTF?
Never has this happened before to me.First time I have even heard about Browser Hi Jacking.But I do know this.I can not set a Home Page.
When they say Hi-Jack they really mean it. :blink:
Cut&Pase from : http://www.tweakxp.com/display.aspx?id=123726
"Hijacked IE default Homepage
Views: 797 | Avg. Rating: 4 out of 5 (6 Votes) | 3/16/2004 2:35:56 AM | Print
When you install certain things from some websites, the application would change your default Homepage setting or even add in some URLs, into your "Favourites" folder without you knowing until your next restart.
For certain cases, a simple change of the default homepage setting at the InternetOptions could be enough. However, some hijacks are even harder to crack against. Some can't be fixed even by a useful utility "HijackThis".
To revert back to the original settings that you had, do these;
1. run 'regedit'
2. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
3. at the right window panel, look for the following strings;
* Default_Page_URL
* Default_Search_URL
* Search Bar
* Search Page
* Start Page
* Local Page
4. Double click on each of them and change the values to the URLs of the websites you want IE to start with.
Local Page's value is default as C:\WINDOWS\System32\blank.htm
5. Lastly, restart your computer, and the homepage and searchpage should be the same as what you configured it to be."
Start Page Guard will make sure that your start page does not get hijacked again but to cure the cause of your problem you need to run some spyware detection programs:
Spy Sweeper is the best one, but it's not free. SpyBot S&D is also pretty good, as is Adaware.
A combination of those 3 normally solves the root of the problem, but if not then use CWS Shredder, this is used for tougher spyware ;)
Ok.I have used ad aware and spybot already this morning.I should of mentioned that.Sorry.I also changed the default homepage setting in the InternetOptions.First thing I tryed.
And it still did not fix the problem.I am going to try what you all have Posted and thanks for the help. :)
I just have never heard of this problem.Guess you learn something new everyday. ;)
manker posted it all lol :D
And FC use a real webbrowser :) Internet Explorer is not very secure :ph34r:
BOT
you do know what regedit is?
goto start - run - typein :regedit
Yes I am doing all that right now.And about to try one of them programs manker talked about.Quote:
Originally posted by Zedaxax@24 June 2004 - 07:30
you do know what regedit is?
goto start - run - typein :regedit
And no BOT. :P
Ok but stay away from the pr0n :lol:Quote:
Originally posted by FuNkY CaPrIcOrN@24 June 2004 - 13:32
And no BOT. :P
Check add/remove programs sometimes You find unwanted programs there.
BOT
One problem I am haveing.
* Default_Page_URL
* Default_Search_URL
I do not see them two.I see all the rest and have changed them. :huh:
http://img2.imageshack.us/img2/7122/untitled184.jpg
Ohhh and I see something that says HOMEOldSP that has that "about:blank" shit. :blink:
hello,
download hijack this here.
unzip it into it's own folder. scan and save a log. it will open in notepad so copy and paste the contents here.
Bad thing is that those files generates random filenames and activates themself until You completly remove them.
BOT
;) Read what Zedaxax posted that was copied from another site.....Quote:
Originally posted by dopey@24 June 2004 - 07:44
hello,
download hijack this here.
unzip it into it's own folder. scan and save a log. it will open in notepad so copy and paste the contents here.
"Some can't be fixed even by a useful utility "HijackThis"."
Now I am really lost. :blink:
that's true, but at least it's a place to start and will usually point to the direction on how to proceed. without it, i really don't know what's going on.
Thanks the only thing that worked for me was "StartPage Guard"Quote:
Originally posted by manker@24 June 2004 - 12:15
Start Page Guard will make sure that your start page does not get hijacked again but to cure the cause of your problem you need to run some spyware detection programs:
Spy Sweeper is the best one, but it's not free. SpyBot S&D is also pretty good, as is Adaware.
A combination of those 3 normally solves the root of the problem, but if not then use CWS Shredder, this is used for tougher spyware ;)
The *default page url and search url
are here
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
guy gave wrong string.
You should also take a look at these two tweaks
http://www.tweakxp.com/display.aspx?id=2076
http://www.tweakxp.com/display.aspx?id=123864
After installing all these SpyWare Programs, running them and changeing them strings that Zedaxax listed only one thing worked.
"StartPage Guard" that manker Posted.
Donnie Darko says that is the only thing that worked for him also.
So who knows what kind of spyware it is. :blink:
Thanks to everybody. :)
:frusty: Damn it!Now it is not working.
Ohhh screw it.They can spy on me all they want.I give up!
:lol:
Yeah stoped working for me too :( :angry:
But "hijack this" worked
http://img22.imageshack.us/img22/738/untitled128.jpg
I think me and Donnie Darko got hit with something more then just spy ware. :(
This will solve ALL your Problems : http://www.mozilla.org/products/firefox/
;) :lol:
edited: mistake
naw im fixed now,Did you try hijack this :huh:Quote:
Originally posted by FuNkY CaPrIcOrN@24 June 2004 - 13:33
http://img22.imageshack.us/img22/738/untitled128.jpg
I think me and Donnie Darko got hit with something more then just spy ware. :(
naw im fixed now,Did you try hijack this :huh: [/b][/quote]Quote:
Originally posted by Donnie Darko+24 June 2004 - 08:37--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (Donnie Darko @ 24 June 2004 - 08:37)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin-FuNkY CaPrIcOrN@24 June 2004 - 13:33
http://img22.imageshack.us/img22/738/untitled128.jpg
I think me and Donnie Darko got hit with something more then just spy ware. :(
:blink: It says do not delete anything you are not for sure what it is.Show to people who do.It came up with alot of files.But I am not going to delete something I might need to run my PC. :blink:
Live life take changes,pluse it worked for me. :)
the SPG alert is Start Page Guard telling you that something is attempting to change your start page. If you run Start Page Guard you can reset your startpage back to what you want.Quote:
Originally posted by FuNkY CaPrIcOrN@24 June 2004 - 13:33
http://img22.imageshack.us/img22/738/untitled128.jpg
I think me and Donnie Darko got hit with something more then just spy ware. :(
however
your problem isn't fixed. I would run HiJack-This and post a log either here for someone skilled in that area (like dopey or jg427) to decipher or post it in a HiJack-This specialist forum.
Because whatever spyware you have sure is devious, I dont have any other suggestions :o
Hi Jack Log
:huh: I have no idea what that stuff is. :huh:
:lol: :lol: :lol:Quote:
Originally posted by FuNkY CaPrIcOrN@24 June 2004 - 13:27
:frusty: Damn it!Now it is not working.
Ohhh screw it.They can spy on me all they want.I give up!
:lol:
thats funny, but don't let the bastards win! :lol:
Try this technique:
What you want to do first is reset your homepage to whatever you want it to be. Also, delete any bookmarks that has been automatically added.
Then, Open up spybot. Goup to the top and click mode and then advanced. Some more bars will appear on the left and the one you want to click is tools and then IE tweaks. Check lock IE start page and your done. You won't be able to change the homepage, they won't be able to change it. The only way to change it is if they changed the settings in spybot.
Now for the automatic favorite adder. Start up admuncher (provided you own it) and click on the OPTIONS tab and look for "prevent scripts from adding themselves to favorites". Restart, and turn off that startpage guard. See if your homepage is changed after 2 more restarts. If it isn't thank spybot :)
Damn.That did not even work.I do not know what this is.But somebody got me good. :blink:Quote:
Originally posted by TheKiler@24 June 2004 - 09:11
Try this technique:
What you want to do first is reset your homepage to whatever you want it to be. Also, delete any bookmarks that has been automatically added.
Then, Open up spybot. Goup to the top and click mode and then advanced. Some more bars will appear on the left and the one you want to click is tools and then IE tweaks. Check lock IE start page and your done. You won't be able to change the homepage, they won't be able to change it. The only way to change it is if they changed the settings in spybot.
Did you look at these two tricks?
i repeat
You should also take a look at these two tweaks
http://www.tweakxp.com/display.aspx?id=2076
http://www.tweakxp.com/display.aspx?id=123864
?
edit: the second one even has a registry package ready for u but try the first one um 1st
The best solution ever:
Get your XP cd. Boot from it. Delete your partition. Create a new partition. Sit back, relax, and follow the instructions on the screen.
I am checking them out now Zedaxax.Thanks. :)Quote:
Originally posted by Zedaxax@24 June 2004 - 09:36
Did you look at these two tricks?
i repeat
You should also take a look at these two tweaks
http://www.tweakxp.com/display.aspx?id=2076
http://www.tweakxp.com/display.aspx?id=123864
?
edit: the second one even has a registry package ready for u but try the first one um 1st
*I am going to need sleep soon.lol*
HiJackthis will make a backup copy of any file you fix with it. The backup copy will appear in your hjt folder, just in case.
Close all browser windows, run hjt and checkmark to fix:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\FUNKYC~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\FUNKYC~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\FUNKYC~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\FUNKYC~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\FUNKYC~1\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\FUNKYC~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {C8ECC921-A38F-4497-86F8-A1484D0C0B8C} - C:\WINDOWS\System32\dhbknjp.dll
Reboot into safemode and delete in bold
C:\WINDOWS\System32\dhbknjp.dll
C:\Documents and Settings\username\Local Settings\Temp\sp.html
reboot in normal mode and post a new hjt log
Were you hijacked by CoolWebSearch? If so, download CWShredder. It's never failed me for that particular hijack.
:ninja:
So did you fix it???????????
After all that, check your IE security settings.
One of the things nearly all of these hacks do is set your security settings to LOW. So you clean up the mess left by this attack, but your pc is wide open to the next one that comes along.
Or get a decent borwser, fire fox sake.
You haven't mentioned what your home page has been changed to.
It's not KFC.com by any chance, is it?
Trojan.StartPage
This just poped up tonight when I got home from the Concert.I knew it was more then ad ware. :(
FC the experts for HT! are here. h**p://forums.net-integration.net