Help -- Browser Hijack

[Track Collector]

Somehow I have encountered some type of browser hijacker. It re-directs to various other sites whether I use IE or Firefox. I have McAfee and this security program does not find anything in the scan. I have tried to download the free version of AVG but have been unsuccessful.

Any suggestions, or do I have to take it to a computer store to see what they can do?

NOTE: When re-directed, the resulting page does not let me search the general internet.

[HUSKER55]

Only thought I have is to reload your software. Sometimes things go awry simply because they do.

You could open the task manager and hunt for files that don't fit.

I am not a guru. just a couple thoughts.

good luck

[xfile]

I've had good results from
http://www.cyberdefender.com/

[Track Collector]

I've had good results from
http://www.cyberdefender.com/

Hello xfile,

Thanks for the suggestion, but unfortunately, and after purchasing the program and running all the scan options, the selected websites still "re-direct" or "jump" to other webpages. In the address line, it shows the sites to places such as Forless.com and "asklots.com". The latter one showed web page as "Tazinga!".

[BillW]

Hello xfile,

Thanks for the suggestion, but unfortunately, and after purchasing the program and running all the scan options, the selected websites still "re-direct" or "jump" to other webpages. In the address line, it shows the sites to places such as Forless.com and "asklots.com". The latter one showed web page as "Tazinga!".

Do a google search for those sites. There are quite a few hits with people complaining about your same issue. You may find your answer there.

[JustRalph]

http://www.fixya.com/support/t2817073-tazinga_highjacker

doing a restore seems to fix it for some

[johnhannibalsmith]

Since I have been playing a perpetual game of cat and mouse with this AntiSpy Soft piece of shit for months, I've learned how to "manage" it since I'm too scared to learn how to do a clean install and then actually look for the system discs and do it.

Among those new skills that I've learned is that anytime my browsers seem to be out of my control - I go to the properties -> connections -> LAN settings and make sure that there is no check mark telling the browser to use a proxy server. Pretty much any time things get screwed up, I can count on the browser being set to a proxy server that commandeers it to and fro.

Just a thought that takes literally seconds and doesn't require a trip anywhere on the off chance it helps resolve the problem at least temporarily until you can get to the bottom of what is causing it.

[PaceAdvantage]

I had some luck with http://www.malwarebytes.org during a recent attack a few months ago...

[Dick Schmidt]

I had this infection a while ago. Spybot Search and Destroy got it on the first pass and took it all the way out. I sent them money I was so pleased.


Dick

I would like to live in a world where a chicken can cross a road without anybody questioning his motives.

[judd]

I had some luck with http://www.malwarebytes.org during a recent attack a few months ago...
hows that new computor pace ?

[PaceAdvantage]

hows that new computor pace ?it's doing the job...

[Track Collector]

Thanks everyone for the suggestions.

I ended up taking it to a local computer professional. Long story made short, he was able to get rid of several infections, but he thinks some corruption has taken place and that my laptop system is unstable. It works ok now, but he believes the only way to get back to a stable system is a complete wipe out and to re-install everything.

He removed McAfee and a few other programs I tried and installed Norton. For now it seems to be working as Norton continues to block access by other programs/computers.

It is interesting to note that these things happen even when you are using some of the better known programs.

[kitts]

"webroot" software has defeated three hijack attempts for me in recent weeks plus detecting/blocking suspicious items. I got it through Amazon.

[Hanover1]

I run a free version of Malwarebytes that tackles these types of problems quite well. I have also felt that Norton is hands down, less intrusive, and more effective than Macaffee. Running Windows Defender in the background is a good idea as well........it alerts you to potential system config changes before they happen, and gives you the options. Do not load emoticon or cursor toolbars either, or any other type of toolbar for that matter, unless you are aware that they frequently change your default browser. There are also ways to configure your browser settings, but I leave that for others to explain.

[Hammerhead]

I had a big srew up Saturday night. While on this site I got a pop up that would not let me go anywhere except buy there product. I could not open any programs or any web pages.

I contacted MS and In safemode was able to download a program that took about 5 hours to clean up puter. Works fine now. The program that infected my puter was from England and was called something like AntiSpyware. They wanted from 49.00 to 69.00 for the stuff. It came on with every key stroke and startup.

[gillenr]

Over the last few days, Avast has blocked several attempts by something on this site from getting in my PC. Next time it happens, I'll document it here.

[Hammerhead]

The program I downloaded from MS is VIPERescue6375.

[PaceAdvantage]

Over the last few days, Avast has blocked several attempts by something on this site from getting in my PC. Next time it happens, I'll document it here.Please do. I'm on here more than anyone and I can assure you I am not infected with a thing...

You should be able to document exactly where this "something" is coming from and what this "something" is...

[PaceAdvantage]

I had a big srew up Saturday night. While on this site I got a pop up that would not let me go anywhere except buy there product. I could not open any programs or any web pages.Just because you happened to be here when you became aware of the hijacking, doesn't mean "here" was the cause. Not saying you are claiming this, just saying is all...

[Hammerhead]

Hey PA happened again tonight . Same thing. As I tried to post the same thing I was ejected and spent 3 more F'n hours with MS cleaning it up. I was on and off all day until I tried to say something about the small puddle in the sea. Same F'n ad same F'n problem poped up. Total time wasted 10 Hours. I mentioned the same F'n company both times. Hell of a quinckeydink!!! BS

[PaceAdvantage]

Hey PA happened again tonight . Same thing. As I tried to post the same thing I was ejected and spent 3 more F'n hours with MS cleaning it up. I was on and off all day until I tried to say something about the small puddle in the sea. Same F'n ad same F'n problem poped up. Total time wasted 10 Hours. I mentioned the same F'n company both times. Hell of a quinckeydink!!! BSWell then, you're the only one getting infected. And that would be impossible if it were coming from my site...so it ain't coming from my site...

Perhaps you were ineffective in ridding your machine of the infection in the first place. Those browser hijacks can be a bitch to remove.

I assure you there is nothing on here infecting anyone. It ain't me buddy. If it were, you'd see a helluva lot more people in here complaining...I have hundreds and hundreds of people on here each and every day.

Remember, there were a few posts on another thread about people getting infected from Ultimate Selector's site. Do you go there? Maybe you're picking it up there...

[PaceAdvantage]

JustRalph is a computer expert...JustRalph, ever get your browser hijacked here on PaceAdvantage?

These allegations are starting to piss me off...

[JustRalph]

Nope.........but browser hijacks can be activated by invoking java scripts or php calls etc that are dormant until you log into a site that is using PHP or Java.

Probably just a coincidence that some script or php on PA is kicking off the popup in his system. He could go to a million other sites and have the same thing happen. It could even be one of the advertisements here on PA that is calling the problem/malware etc. The actual problem is some resident item on his computer that is just waiting for the right thing to kick it off.

Hammerhead, post more info about what happens etc....... where it takes you and maybe a screenshot if possible........ I will try to help you out with it.....

[OTM Al]

I think what Ralph is saying might be true. I got nailed by that damn thing Sunday night and this was the last site I was on. Know how to kill it now, but was a real pain in the rear. That browser hijack is a nasty addition to the original virus. Funny thing is I don't go to many sites but the wife does, but her profile on the computer was clean while mine was the one that got nailed. Did help to have that additional user profile to be able to get to the web to clean up the hijack issue, though having the iPad helped a lot too.

[PaceAdvantage]

Unless there is some rogue advertisement coming through Google ads (and I find that to be almost impossible to believe), the only thing you get from the PaceAdvantage.com website is a cookie. Nothing has changed in the past many years in that regard, and nobody has access to the inner workings of this site but me.

There are no activeX programs running...nothing downloaded to your browser...nothing but a cookie, which obviously can't hijack your browser.

If anyone has any evidence to the contrary, please let me know ASAP. I have a PC here that I use to browse PaceAdvantage that runs absolutely NO REAL TIME ANTI-VIRUS or ANTI-SPYWARE SOFTWARE (no real time stuff other than built in Windows Defender) whatsoever...NONE....

And my browser (IE 8...a very hijackable browser) has not been hijacked.

[OTM Al]

Talked to the tech guys at work and they confirmed that it is working the way Ralph described. They've had to deal with this thing nearly every day since it surfaced so they've had a lot of experience with it. The virus is not coming from this site. What happens is that you get the thing (and they aren't even sure how it is happening) and it sits dormant on your disk until it gets triggered by the scripts running in things like the ads on this and many other sites. So the designer is using sites like this one as the trigger for the bomb that's already been planted.

[Robert Goren]

Have they found a cure?

[WeirdWilly]

Have they found a cure?

I've got one - public trials and executions of virus, trojan, spyware, and worm creators!

[Robert Goren]

I've got one - public trials and executions of virus, trojan, spyware, and worm creators!I'm all for that. We had a computer hacker in Nebraska get pre trail deversion here a few years ago. :bang:

[PaceAdvantage]

Nope.........but browser hijacks can be activated by invoking java scripts or php calls etc that are dormant until you log into a site that is using PHP or Java. Wouldn't this PHP or Java code have to directly address the hijack spyware that is sitting dormant on your PC?

Or are you saying any Java code (like when I pull up a radar map on noaa.gov) or PHP code (like what generates this website) will trigger?

[JustRalph]

any java script, php that usually performs some mundane function like "post" or one that invokes a certain call etc.......depends on how it is written. some are actually bots sitting on the users computer like a trojan. They sit there until something wakes it up to call home and get the latest message from homebase. It can even be on a timer.........these things are nasty. It just may wait 24 hours etc and the next java app will wake it up and it will use the java app to take off.........that is how you sometimes get rotating ads on a hijack.....they rotate the ad to be displayed at the homebase.....

it's a dirty business. But until you are clean.....it could happen anywhere.

http://www.symantec.com/content/en/us/home_homeoffice/images/theme/misleading/nor-misleading-apps-how-they-attack.gif

see this page

http://www.symantec.com/norton/theme.jsp?themeid=mislead

[Rwahi1]

Browsing the web as an administrator is dangerous and is not good for your computer. People keep doing that and they keep getting infected.

When I first got my computer I use to have the same problems with infections like everybody else. Now its been five or six years I have never been infected with malware and I go to lots of unsavory sites just to see if i can get infected.
Look...even if you must use administrative account when surfing the web with IE at-least have right kind of protection. AV is not going to help you. Everyone have AV, they still get infected!. You should look into GeSWall,Buffer Zone or SandBoxie. They have free version also, so you don't have to pay for it.
Me personally I like to surf the web with IE but i have disabled downloads, nothing get downloaded with IE and I surf the web as a limited user. When I want to download I use Google Chrome. Which is one of the safest browser in my books.
If you guys want to read more about it( I am not very good at explaining..my english is not very good ) these links will help you understand better.

http://msdn.microsoft.com/en-us/library/ms972827.aspx

http://cybercoyote.org/security/drop.shtml

Regards,

Raman

[Rwahi1]

In my earlier post I did not mention how I learned to protect my computer.

I hang out at www.wilderssecurity.com and I got to give credit to members of this site for teaching me about securing my computer from hackers,malwares and what not.

And especially making my browser secure with the help with this link :

http://www.wilderssecurity.com/showthread.php?t=262475

[trying2win]

The only problem I've had lately that seems like a hijack on the computer, is when I go to an ADW site for example and click on the 'CONTACT US' button, the computer is redirected to a Russian website. I'm guessing it's the Google equivalent of a Russian search engine, because the page that is displayed on screen has a lot of words in Russian with the odd slot for putting in information. The website address has a .ru suffix.

The funny thing is, when clicking links on a business page, only the 'CONTACT US' link is redirected to a Russian webpage. So it's a real mystery. This hijack is not causing any major problem with my computer, but still I'd like to find a way to remove it without doing a restore.

I've tried several malware removers, commercial and free ones to no avail to get rid of this hijack (virus, trojan?). If my recollection is correct, I think so far I've tried NOADWARE, SPYBOT and the PA-recommended MALWARE BYTES softwares. All three of them found some interesting pieces of malware (but not the one I was hoping they'd find).

Can anyone suggest any other free spyware removers that you found helpful?

Thanks,

trying2win
-------------------------------------------------------------------------
~"Never think if you can solve a problem. Think how you can solve it."

--Norman Vincent Peale
-------------------------------------------------------------------------

[Rwahi1]

Sorry to read about your problem. I hope you downloaded Malwarebytes from a ligit site. There are fake or rough softwares pretending to be real one.
The right address is.....www.malwarebytes.org
You should also try SUPERAntiSpyware from.......www.superantispyware.com
They have a free version. Let us know how it works out. If this does not help
then there are other methods to try.

[trying2win]

RWAHI:

Thanks for the advice. I just got some good results though.....FINALLY! Shortly after I made that post, I downloaded the latest updates for NOADWARE software, ran a scan, and in the scan results a trojan was listed. Naturally, I gave the software permission to delete it. That solved the redirect problem. :jump:

T2W

[Rwahi1]

I am glad for you. Now you got to figure out how did you get infected in the first place. Do you have a basic protection i.e, a firewall, Anti-virus software.
You should also install WOT( Web of Trust ) for your browser. The WOT add-on warns you about risky sites before you click ( www.mywot.com ).

I wanted to learn more about NOADWARE software, so I googled "noadware" and I am sorry to inform you that my security software won't even let me go to their site and then WOT shows that they are not good! What can I say...
they helped you out. How much did you pay for NOadware software?
What is your operating system?

[Robert Goren]

I am glad for you. Now you got to figure out how did you get infected in the first place. Do you have a basic protection i.e, a firewall, Anti-virus software.
You should also install WOT( Web of Trust ) for your browser. The WOT add-on warns you about risky sites before you click ( www.mywot.com (http://www.mywot.com/) ).

I wanted to learn more about NOADWARE software, so I googled "noadware" and I am sorry to inform you that my security software won't even let me go to their site and then WOT shows that they are not good! What can I say...
they helped you out. How much did you pay for NOadware software?
What is your operating system? I ran NOADWARE free scan and it found a couple of files. I deleted them myself without the aid of the software which they want $48 for. It has solved several problems I have had over the last week or so. We will see if the fix holds. Just for it is worth.

[Rwahi1]

I ran NOADWARE free scan and it found a couple of files. I deleted them myself without the aid of the software which they want $48 for. It has solved several problems I have had over the last week or so. We will see if the fix holds. Just for it is worth.

Any software that ask for money before they fix the problems you should be afraid of. 99% of the time these fake software install malware when you install them.

Mr. Goren....its getting close to handicapping the Belmont card, I won't bore you with my rant about security. When you have some time why don't you come by Wilderssecurity forum and just browse and feel the place.

How would you like if you never get malware and can surf the web without being afraid of getting infected for no cost. It wouldn't cost you a dime! I can show you how to do that.

Right now I am looking at the Belmont card. I got to see if I can make some money. I will catch up with you later

[headhawg]

I wanted to learn more about NOADWARE software, so I googled "noadware" and I am sorry to inform you that my security software won't even let me go to their site and then WOT shows that they are not good! What can I say...Me too. I am not sure why people don't stick with the known good anti-malware programs but to each his own, I guess. The scary thing is that these lesser known programs may fix certain problems but I get this uneasy feeling that they have added their own malware.

[Greyfox]

From what I can determine this morning the major web host server

Lunar Pages has been hijacked.

That means that hundreds of websites hosted by that company have been smacked out and redirected to some black internet page.

Even Lunar Pages main website has been taken over by this hacker.

[Robert Goren]

Me too. I am not sure why people don't stick with the known good anti-malware programs but to each his own, I guess. The scary thing is that these lesser known programs may fix certain problems but I get this uneasy feeling that they have added their own malware. People like me get desperate. I have had Norton for years and have had very few problems. Then along comes two problems. The first one is that 0x6beb7776 thing. The second is every time I try to use a search engine, I get hijacked. I even called Norton , no help. I tried all the the well know programs, no help. I post here and on 2+2, no help. Then I try the NOADWARE thing and it finds 3 files and I get rid of them and the 0x6beb7776 goes away and has stayed gone for several days now. The hijacking is still there. I hear all about all these better firewalls, etc, but when ever I put one up, It is like it is 1996 all over again. Slower than molasses. I am not paying $50 a month for 1996 speed. I am not going to use Linux since I had a really bad experience with that. I might try google chrome, but I have been a little reluctant because every time use a google program, I spend a half an hour getting rid of things like the toolbar.

[Track Collector]

Well, things are better than when I originally encountered this problem, but from time to time while browsing in one window (such as the Racing Channel), a new tab opens up with a re-direct.

I have tried full scans with the following:
Cyberdefender
Norton
Malwarebytes (free version)
SuperantiSpyware (free version)
Spybot (free version)

If possible, I do not want to re-format, as I do not know how to do it, AND, I may not have all the disks to re-install the programs.

I really appreciate all the well-meaning advice I have received to date.

[Rwahi1]

Go to www.prevx.com and download their free program first. Scan your computer. This is a new technology ( Cloud Tech ). I use to use this software. It is a very good software. I don't use it now because I have set up my computer differently than most users. They have a forum at Wilders Security. http://www.wilderssecurity.com/forumdisplay.php?f=105

I hope your computer is fully patched up with Windows updates.
I am curious to know what this software will find ?

[TrifectaMike]

Well, things are better than when I originally encountered this problem, but from time to time while browsing in one window (such as the Racing Channel), a new tab opens up with a re-direct.

I have tried full scans with the following:
Cyberdefender
Norton
Malwarebytes (free version)
SuperantiSpyware (free version)
Spybot (free version)

If possible, I do not want to re-format, as I do not know how to do it, AND, I may not have all the disks to re-install the programs.

I really appreciate all the well-meaning advice I have received to date

Go to www.iobit.com (http://www.iobit.com) and download their free Advanced System Care and their free Security 360.

Mike

[Rwahi1]

Go to www.iobit.com (http://www.iobit.com) and download their free Advanced System Care and their free Security 360.

Mike

I would not trust any software from this company. If you don't beleave me...you should read this....http://forums.malwarebytes.org/index.php?showtopic=29681

Regards

[TrifectaMike]

I would not trust any software from this company. If you don't beleave me...you should read this....http://forums.malwarebytes.org/index.php?showtopic=29681

Regards

News to me. I've found Advanced Care and IO Security one of the best applications in this area. I have used Malwarebytes in the past. The Security 360 engine is much faster.

If the Malwarebytes database was stolen in 2009, I haven't seen any postings since the one you linked in 2009.

Mike

[Rwahi1]

Mike,

I will show you more links later. Right now I am handicapping Belmont.

Raman

[jamey1977]

Wouldn't this PHP or Java code have to directly address the hijack spyware that is sitting dormant on your PC?

Or are you saying any Java code (like when I pull up a radar map on noaa.gov) or PHP code (like what generates this website) will trigger?
It happens still. I have Mc Cafee. When this occurs . I go to System Restore where it pinpoints a point in the past and it restores the entire computer to that point in the past. Now I have Mc Cafee Site Adviser. Just click green sites and restrict surfing. They all happen in surfing. Like my old co-workers would tell me . Quit The Porn. But 50 percent are not from Porn. LOL . My last virus was from frickin Facebook. Use System Restore and go to I-Drive and back up every file on your computer. I Lost 1000 Racing Forms for 2 years because of the damn virus. They're on my old computer but it is inoperable. One day I will get those files. I-Drive backs up everything and if you have to . You can do a complete Factory restore. But that is your final option. We don't go to Geek Squad and have them try to bust us. I swear those stupid weasels will turn you in if they find anything they think is improper., countless stories. Some guy had pics of girls in their 20's, they were well in their 20's and they busted him. Who is the Geek Squad? The Catholic Legion Of Decency ? . LOL He was totally cleared. But, what a hassle. Just awful. Also. you can save 500 dollars.

[Track Collector]

Go to www.prevx.com (http://www.prevx.com) and download their free program first. Scan your computer. This is a new technology ( Cloud Tech ). I use to use this software. It is a very good software. I don't use it now because I have set up my computer differently than most users. They have a forum at Wilders Security. http://www.wilderssecurity.com/forumdisplay.php?f=105

I hope your computer is fully patched up with Windows updates.
I am curious to know what this software will find ?

Raman,

The scan with prevx did not find anything. Hopefully you are not running out of ideas.

[Robert Goren]

It didn't for me either.

[Rwahi1]

Raman,

The scan with prevx did not find anything. Hopefully you are not running out of ideas.

LOL No! I am not running out of ideas. Now its getting serious. We will get to the bottom of this and solve this problem. You won't have to re-install.
In my next post I will show you how. You will have to do little bit of dirty work with your computer.

Raman

[senortout]

Well, things are better than when I originally encountered this problem, but from time to time while browsing in one window (such as the Racing Channel), a new tab opens up with a re-direct.

I have tried full scans with the following:
Cyberdefender
Norton
Malwarebytes (free version)
SuperantiSpyware (free version)
Spybot (free version)

If possible, I do not want to re-format, as I do not know how to do it, AND, I may not have all the disks to re-install the programs.

I really appreciate all the well-meaning advice I have received to date.

just as an aside, do you have any teens using your computer?

[Track Collector]

just as an aside, do you have any teens using your computer?

Nope.

I forgot to mention that the computer tech who worked on this a few weeks ago mentioned that I had an older version of Adobe Reader which he thought may have had some security issues associated with it. While we will never know if this is where the computer became infected, I had been using Adobe Reader often up to that point. The older version was since removed with no replacement yet.

I'm glad Raman is still willing to help, and I hope he can explain any future proposed actions at the beginner's level.:)

[Bobzilla]

Browser on my laptop got hit yesterday by a Trojan Fake AV. Maybe it had been there for awhile and only got its marching orders yesterday, don't know. First the false warning pop-ups appeared and I was unable to get rid of them. Then Internet Explorer was continually being brought up, not by me, and would sign onto various sites. I brought the laptop to the computer store this morning and the woman said the offenders will try to entice people to enter a credit card number, which will probably be denied so you'll continue to enter more credit card numbers. Yesterday I was able to run a Norton full system scan which identified the malware and was able to stop the crap on the screen from appearing but evidently the damage was done as my settings are all screwed up and I was unable to get an internet connection. What a p.i.t.a! Agree with the poster who called for public executions.

[PhantomOnTour]

I have been down for a few days as a result of Antivirus7 that took over my system. Luckily, I have a good friend who is an IT guy and he reformatted for me. Had to save everything to thumb drives but I know this bug is gone. It's a hassle loading everything back up, but I'll gladly do it, this Antivirus7 was a total hairball.

[Robert Goren]

I put up with getting redirected on Bing And Google for about a month. I tried a bunch of stuff. None of it worked. Then I came across something called Microsoft Security Essentials. It been 3 days without a redirect. I feel like I am in hog heaven.

[LemonDropKid]

This did the trick for me on a google re-direct virus. 30 day free trial. It's a cloud based solution.

The Kid

http://www.surfright.nl/en

[Rwahi1]

Malwarebytes is a very good program. Scan with it followed by Hitman Pro.

Delete what they find and if still a problem then create a folder..call it 'Hijackthis'......download Hijakthis.exe in it from http://free.antivirus.com/hijackthis/

Post a Hijackthis log in an appropriate forum.

Read the pinned topics first before posting a log.

http://forums.malwarebytes.org/index.php?showforum=7

http://www.bleepingcomputer.com/forums/forum103.html

If it's too badly infected then nothing like the feel of a clean fresh install.

[Robert Goren]

Malwarebytes is a very good program. Scan with it followed by Hitman Pro.

Delete what they find and if still a problem then create a folder..call it 'Hijackthis'......download Hijakthis.exe in it from http://free.antivirus.com/hijackthis/

Post a Hijackthis log in an appropriate forum.

Read the pinned topics first before posting a log.

http://forums.malwarebytes.org/index.php?showforum=7

http://www.bleepingcomputer.com/forums/forum103.html

If it's too badly infected then nothing like the feel of a clean fresh install. I had tried both Malwarebytes and Hitman Pro. Malwarebytes did nothing. Hitman Pro would work for about four clicks, then back to the redirect. Like I said the Microsoft Security Essentials has worked for 3 days now. I will say this, it is pain to download. But it is the only thing that has worked and it is free. After a ton of false leads I wait for a couple of days just to make sure it really worked.

[Rwahi1]

I had tried both Malwarebytes and Hitman Pro. Malwarebytes did nothing. Hitman Pro would work for about four clicks, then back to the redirect. Like I said the Microsoft Security Essentials has worked for 3 days now. I will say this, it is pain to download. But it is the only thing that has worked and it is free. After a ton of false leads I wait for a couple of days just to make sure it really worked.

I have only heard good things about Microsoft Security Essentials but the trouble with it is as you said,it is pain to download and also it is very heavy on the system.
Have you ever tried Emsisoft a-squared Free scanner. It is one of the best scanner in the market. I will warn you though that it has few false positives.
You can try from here.....http://www.emsisoft.com/en/software/

Always backup before you delete something!