Please help! Homepage hijacked

Author	Post
Endorphin Luminary 1185 Posts 3/00	Posted - Mar 25 2004 : 12:15AM Last night I was doing quite a bit of web surfing, and ran into a pop-up blizzard that pop-up starter could not prevent. When I turned on my computer today, my homepage had been hijacked and replaced with a search engine. Worse yet, everytime I turn on the computer my homepage gets put back to the search engine. Anyone know what I can do? And do you know the address of the person responsible for this so that I can go knock his teeth in? Campaigning for George Lynch to be in G3 Why don't you go off and love yourself If I did that Holly there won't be anything left for anyone else --from Well it's true that we love one another by the White Stripes FREE THE WEED!!! [Link]
rieekan333 Member 388 Posts 3/02	Posted - Mar 25 2004 : 12:39AM Download and run Spybot-S&D, which will remove the hijacker and prevent your computer from downloading hijackers in the future (click the immunity tab). Please don't knock Patrick Kolla's teeth in however. You could reverse DNS the offending website, if you know which one it is. [Link]
DenverDon Benevolent Firmly Embedded in Depravity 5914 Posts 7/02	Posted - Mar 25 2004 : 12:46AM If it's there the next time, you can also click on the Tools dropdown, check internet options and see what is loaded in as your default page. Get the key components (words) from that, and then you can search the registry to find it and eliminate it. There is almost always an entry in the registry to indicate your default page on startup. Also search your directory for the key words that load up because many times a small folder has been created to store the program and the registry just points to the program in the folder. (Use the normal caution when editing the registry though.) [Link]
Endorphin Luminary 1185 Posts 3/00	Posted - Mar 25 2004 : 5:02AM Thank you both for your help. I decided to go with Bazooka since it is manually controlled. I once ruined a computer with Adaware. The spyware was from CoolWebSearch. I get so frustrated when stuff like this happens, much like spam. Maybe I wouldn't punch teeth in, but I would like to paint the guy's house the color I choose, since somebody seems to think it is OK to choose my home page. I think they should reimburse me for the time I spent regaining my personal liberties that they took away. Thanks again, and I have no idea who Patrick Kolla is. Campaigning for George Lynch to be in G3 Why don't you go off and love yourself If I did that Holly there won't be anything left for anyone else --from Well it's true that we love one another by the White Stripes FREE THE WEED!!! [Link]
rieekan333 Member 388 Posts 3/02	Posted - Mar 25 2004 : 7:13AM The internet is just like safe sex. Be safe, have fun I get so frustrated when stuff like this happens, much like spam. Click to expand Learn from past frustrations. I take it you've been riding the internet bareback, without any form of security measures. Your willy- I mean computer - can catch all sorts of things! [Link]

abradarba Member 89 Posts 2/04	Posted - Mar 31 2004 : 10:41PM I got infested with that coolwebsearch thing, and Patrick Kolla's brilliant program wouldn't touch it. (Or it still came back) Searching the web found something called CWshredder .exe, which is a custom utility for getting rid of only coolwebsearch. Worked great. I second the recommendation for Spyware S&D, it's safe and effective, and a powerhouse. I believe it's better than Adaware, but I'll check out Bazooka, too. [Link]
Pontus Maximus Senior Member Man of Steel, meet your match. 1346 Posts 9/02	Posted - May 12 2004 : 1:52PM rieekan333 wrote: Download and run Spybot-S&D, which will remove the hijacker and prevent your computer from downloading hijackers in the future (click the immunity tab). Please don't knock Patrick Kolla's teeth in however. You could reverse DNS the offending website, if you know which one it is. Click to expand Just as happened with Endorphin, my homepage has been hijacked and replaced with a search engine. The difference is that mine is called "I Can Find It" (http://www.icanfindit.net). When I go to Internet Options to change it back to my normal homepage, it reverts back to "I Can Find It" the next time I go online. In addition to my homepage being hijacked, I also noticed that several links have been forcibly added to my "favorite places" (bookmarked websites). These are websites that I've never visited and have no interest in. When I delete these links from my favorite places, they're still there the next time I go online. In addition, I'm noticing that each day, more of these links are being forcibly added to my "favorite places." Here are the titles of some of these links: Anal Rape (raped teens) Animal Sex FREE ANIMAL SEX incest sex (Dad and daug...) Online Pharmacy News Online Gambling News I followed the advice that Rieekan provided. Unfortunately it didn't work for me. Spybot-S&D didn't solve the problem. I saw an add for SpyHunter, but I don't want to risk the $29.95 for something that might not even fix the problem. I really could use some help. This problem is driving me crazy. My computer is infected with all kinds of spyware. Also please note that I'm not a techie at all. So, if you offer advice, please keep it simple. Thanks. [Link]
Em Member 198 Posts 4/04	Posted - May 12 2004 : 2:26PM Also please note that I'm not a techie at all. So, if you offer advice, please keep it simple. Thanks. Click to expand If you are prone to falling into such situations, perhaps it would be a good idea to install a secure browser... Em [Link]
Endorphin Luminary 1185 Posts 3/00	Posted - May 12 2004 : 3:56PM Pontus, give Bazooka a try. I liked it, though I couldn't find one of the spywares it told me I had. I have not had problems since. Bazooka finds the spyware, gives you information about it, and gives you step by step instructions to remove it. Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances. --from..er..some important document type thing. FREE THE WEED!!! [Link]
jamesn Senior Member Cambridge, MA 750 Posts 1/04	Posted - May 12 2004 : 6:51PM I agree with Em, if you're going to use IE, download one of the free shells, i'm using slimbrowser light(avantbrowser/MYIE2 are also good). They're still IE, but allow you to disable flash, popups, and all of the other junk you don't need on websites. The mozilla/gre-based browsers are usually safer and most who start using them don't go back. Spybot is useful, especially for it's hosts file and I don't think any commercial program is really in the same league right now. Remember, you're installing MORE software to get rid of software and potentially bogging down your system with stuff you don't use daily. If you know someone who can spare 15 minutes to fix it and then explain it, all you need to do is use regedit-the changes it made are in plain view. I'd left a string to copy and paste for a really similar situation on here, maybe a week earlier. It should work for your homepage issues, but if you're not comfortable, ask someone to show you. **(regedit should fix it. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main under "start menu", just type in the addy you want,)-from that other message if you learn the basics of how your registry is set up and works, windows all of a sudden gives you more options than the control panel, lots are useful. if that's not going to happen, download a decent registry cleaner like regsupreme or jv16 power tools since if you haven't ever checked, there are probably a thousand useless entries slowing you down and occasionally crashing things. good luck with everything-James Edited by - jamesboston on 5/12/2004 6:52:40 PM [Link]
Endorphin Luminary 1185 Posts 3/00	Posted - Jul 10 2004 : 9:27AM Now I have a new problem. I was doing a search and went to a site, then all of the sudden the fonts on my browser changed. some of the fonts are bigger. When I read threads, certain sections are in bold print even if theyr were not set up that way. I was not even visiting a porn site. I don't recall any pop-ups and no box appeared. I tried Bazooka to no avail. I tried to restore my system. I restored internet explorer. I checked under fonts in internet explorer. They are latin based, Times New Roman, Courrier New. I'm not sure if that is what they were before. Norton antivirus also ran since then. Does anybody have a clue what is going on? Your help would be greatly appreciated. [Link]
DenverDon Benevolent Firmly Embedded in Depravity 5914 Posts 7/02	Posted - Jul 10 2004 : 10:40AM Try this Endo. Assuming you have a scroll mouse, hold down the Ctrl key and they scroll the wheel. That will change the font sizes on the screen. DenverDon [Link]
Endorphin Luminary 1185 Posts 3/00	Posted - Jul 10 2004 : 11:30AM DD, thanks, but when I scrolled, nothing happened. I switched to FireFox as a browser per the reccommendation of a friend, but I would still like to resolve this problem. Especially since I fear that whatever happened may change other things on my computer. [Link]
Kperv The Cuddler *struck (She slipped) 1818 Posts 1/04	Posted - Jul 10 2004 : 11:46AM IIRC you can set the font size somewhere in the View menu. Does that make any difference? [Link]
Endorphin Luminary 1185 Posts 3/00	Posted - Jul 10 2004 : 11:57AM Kperv, yes it does. Thanks! Everything seems to be back to normal....however, that only may solve half of the problem. I am still concerned about 'WHY' the problem ocurred in the first place. Do not kill. Do not rape. Do not steal. These are principles which every man of every faith can embrace. These are not polite suggestions, these are codes of behavior, and those of you that ignore them will pay the dearest cost. --from Boondock Saints. FREE THE WEED!!! [Link]

Harry Joystick Member 740 Posts 8/02	Posted - Jul 10 2004 : 12:17PM I use Start Page Guard [Link]
Kperv The Cuddler *struck (She slipped) 1818 Posts 1/04	Posted - Jul 10 2004 : 12:27PM Endorphin wrote: Kperv, yes it does. Thanks! Everything seems to be back to normal....however, that only may solve half of the problem. I am still concerned about 'WHY' the problem ocurred in the first place. Click to expand If that worked, DD's Ctrl+Wheel solution should have worked as well. Maybe it's Alt or Shift instead of Ctrl. I don't remember for sure. Try clicking on some text on a web page to select that frame and try it again. If the wheel thing works you probably just triggered it by accident once. [Link]
marduk Senior Member 1008 Posts 2/03	Posted - Jul 11 2004 : 8:39AM Hi ! I had these coolwebsearch trojans too ! I used a few programs : 1) "HijackThis" : to scan , and record log files , then post them on a forum about computer problems , the experts will tell you which lines you must fix 2) "CWShredder" : against Coolwebsearch trojans 3) "a²free" : this is an antivirus against trojans especially . It removed more than 200 files from my computer : TrojanDownloader.System32 what are CWS files ( this is a variation of CWS : Smartsearch2 , so that many files were created by this trojan ) . And SPYBOT didn't find them !!! 4) AD AWARE 5) SPYBOT ( AD AWARE and SPYBOT are complementary but AD AWARE finds SPYBOT as a spyware , but it is not one ) 6) SPYWAREGUARD 7) SPYWAREBLASTER SPYWAREGUARD and SPYWAREBLASTER are like firewalls , but against trojans . They are complementary , created by the same man . You must update all the programs regulary and scan your hard drive(s) in safe mode and without system restore , to make the programs more useful . Take Care when you download a program : look whick size is it , and look which size you will download , because some hackers put some spywares in the download files to make them great spywares ! Good Luck ! [Link]
GaySatyr Senior Member Half dirty ol' man; half horny ol' goat! 1684 Posts 10/00	Posted - Jul 11 2004 : 3:28PM DD's [Ctrl]+[wheel] shortcut works sometimes and not others: Its effectiveness depends on how text size was defined on the current page. ~ GS [Link]
junglew Senior Member 1042 Posts 12/02	Posted - Jul 16 2004 : 12:43AM rieekan333, I download Spybot the other night and it gave me a bar that said "A required.dll.file.w52- 32.dll.was not found." The great search/zyweb search has captured my home page. Could they have deleted that particlar file to make it impossible to load Spybot? I am about to get rid of this old .1G computer and get a new one but would like to practice on the registry when the new computer is up and run ning. Wayne & Geek Wantabe In Dallas [Link]
marduk Senior Member 1008 Posts 2/03	Posted - Jul 16 2004 : 4:21PM junglew , I suggest you to download A²FREE . After downloading , update it and scan your hard drive(s) in safe mode . It finds and deletes many malwares . Maybe one malware or a few malwares has ( have ) corrupted some files on your computer , and A²FREE will fix it . :) [Link]
rieekan333 Member 388 Posts 3/02	Posted - Jul 21 2004 : 8:42AM Could they have deleted that particlar file to make it impossible to load Spybot? Click to expand It's entirely possible though I don't know whether it's likely or not. You should try one of the other programs mentioned in this thread, such as AdAware. [Link]