| Forum Home | ||||
| Press F1 | ||||
| Thread ID: 43236 | 2004-03-07 23:46:00 | HIJACKED BROWSER | Kiniwe (5371) | Press F1 |
| Post ID | Timestamp | Content | User | ||
| 220984 | 2004-03-07 23:46:00 | Hi, I have a hijacked browser window and have reviewed earlier posts and FAQ#8b. I have done all the suggested remedies (including ad-aware, spybot and spysweeper) except step 5 onwards in FAQ#8b as looks too complicated and still get on booting up the hijacked browser home page. I have a screen capture in jpeg form of the browser window and wonder if I can send that or post it here in some way so that anyone who has had a similar attack can advise me how they removed it? Many thanks |
Kiniwe (5371) | ||
| 220985 | 2004-03-08 00:04:00 | Which FAQ 8b did you follow? There are two #8b FAQs. If it wasn't the Spyware one try that. You will probably have to run either HijackThis or CWShredder. To post a screenshot here upload your image to here (sal.neoburn.net) and post the link back in this thread and we will see what we can do. ;-) |
Fire-and-Ice (3910) | ||
| 220986 | 2004-03-08 00:15:00 | Once you are back to normal, go here http://www.wilderssecurity & install "browser hijack blaster" Make sure that you add it to your start-up items. Good luck. Bye |
Peter H (220) | ||
| 220987 | 2004-03-08 01:25:00 | Many thanks have uploaded the picture of the hijacked browser page for advice and I am running through some additional checks |
Kiniwe (5371) | ||
| 220988 | 2004-03-08 03:59:00 | It looks like you need CWShredder. Download from here (www.majorgeeks.com). You may also need the other tool listed on that page. Post back here with your results. | tommy (2826) | ||
| 220989 | 2004-03-08 06:17:00 | Thanks for that. Have downloaded CWshredder and CoolWWWSearch.SmartKiller and run both as suggested. Rebooted and amended default homepage details through Control Panel/internet options before opening IE. Rebooted again but the hijacker remains. Running CWShredder again I note that the following two items that were removed previously were still there and removed again. This makes me think that there is a programme that automatically loads these up again after every restart: cws.svchost32 cws.xmlmimefilter Any ideas? |
Kiniwe (5371) | ||
| 220990 | 2004-03-08 06:21:00 | Also the link to the uploaded screen shot of the hijacking browser home page is: sal.neoburn.net | Kiniwe (5371) | ||
| 220991 | 2004-03-08 06:25:00 | If you make you go to www.google.com and then make that your home-page, does it get hijacked also? Just wondering whether your about:blank is what has been hijacked. If using Xp or ME, turn off your restore. Then run CWShredder, then Spybot. Restart PC and turn on restore. |
Pheonix (280) | ||
| 220992 | 2004-03-08 06:32:00 | If you are not familiar with turning the restore function on/off, have a read here (service1.symantec.com) | Pheonix (280) | ||
| 220993 | 2004-03-08 06:34:00 | I can set a new default home page but it attempts to change it back to the hijacking page later on. I am running Spysweeper and this programme prevents it from doing this. However, whenever I restart the computer the default home page once again becomes this hijacker page. I am running Windows 2000 Pro and Internet Explorer as the browser. |
Kiniwe (5371) | ||
| 1 2 | |||||