Some thing hAS entered my system, (probably through the registry) and
when I go into certain websites the browser re routes to two or three
sites 85% of the time. Trend micro cannot find a virus for this and I
dont know how to get this problem away unless I format, which seems to
much drama for this yopung bloke!! Trend micro seem to point this sort
of thing to a trojan and suggests removal of certain strings of
numbers from the registry, but these suggested strings do not exist.

Can someone help me?

---

Request for Question Clarification by serenata-ga on 31 Oct 2003 02:25 PST

Hi Crackerbuzz ~

It sounds more like you may have had your browser hijacked ...

Here's a page with some helpful information, including downloading and
running
   * Spybot Search & Destroy
   * Ad-Aware
   * Aluria Spyware Eliminator

 - http://www.spywareinfo.com/articles/hijacked/

One of those (in that order) usually are able to detect a browser
hijacker, but if not, it also suggests Hijack This.

As a rule one of those should detect and help you remove any hijack
bug that may have gotten into your system.

I am posting that here instead of an answer, because it's hard to
detect exactly what is going on, but it sure sounds like some sort of
hijack scumware. See if that link helps.

Serenata

Are you behind an cable/dsl hardware router such as a Netgear or
D-Link piece of hardware? Yesterday there was an article on how at
least on some Belkin routers, they redirected you to a specific
website. You may not be having this issue, but it is a thought along
with having installed spyware/malware as suggested above. Here is the
link to the article:
http://www.theregister.co.uk/content/69/33858.html

Aaron

How to fix a hijacked homepage setting
 
http://www.cyberwalker.net/columns/oct02/241002.html


http://www.geekgirls.com/net_hijacked.htm

Browser Hijacking

http://www.spywareinfo.com/articles/hijacked/

Has something started redirecting your browser to whazit.com? We have the solution!
http://www.spywareinfo.com/

Manual remove:

http://whazit.com/manualremove.html


restore a hijacked browser, or if you want to know whether that free
software you just downloaded might have a parasite bundled into it,
you've come to the right place.
http://www.spywareinfo.com/


[langalist] LangaList Standard Edition 2002-01-24  
Date: 1/23/2002 9:18:06 PM Pacific Standard Time

Free "Anti-Parasite" Browser Check

Esther Schindler, who helps edit and produce columns and discussions for
InformationWeek.Com (including mine!), sent along a note about

http://and.doxdesk.com/parasite/
 :

     Nice utility page that automatically detects spyware in your
     Windows Explorer browser, and generates instructions for
     removing it....

Thanks, Esther. The page runs a small JavaScript that looks for
"exploitationware"  and other "parasite" add-ons that may have barnacled
themselves to your browser without your knowledge.


Lockergnome Windows Digest] Electronic Toolbar and the Lovers  
Date: 3/16/2003 1:44:12 PM Pacific Standard Time

IE Restrictions v1.0 [478k] W9x/2k/XP FREE

http://www.mywebattack.com/gnomeapp.php?id=105964

IE Restrictions allows you to disable certain modifications to
Internet Explorer. Many of them are commonly abused by invasive
Web sites that, for example, change your home page settings,
modify the toolbar, open pages in full- screen mode, and more.
Others are more of an administrative nature, allowing you to
disable the registry editor, page source viewing, and other
settings. [MWA]


MOSSBERGS'S MAILBAG  WSJ
June 6, 2002  


Software Can Prevent Porn Sites From Monopolizing Start Pages
By WALTER S. MOSSBERG

There's no other major item most of us own that is as confusing,
unpredictable and unreliable as our personal computers. Everybody has
questions about them, and we aim to help. Here are a few questions
about computers I've received recently from people like you, and my
answers. I have edited and restated the questions a bit, for
readability.

This week my mailbox contained questions about disabling malicious
porn site settings, finding a book about Windows XP and printing
directly from digital cameras.

Q: A gross porn site, apparently once visited by my teenage son, has
taken over my browser and installed itself as my start page. Every
time I launch Internet Explorer, this porn page appears, and it spawns
multiple other porn pages so fast I can't close them. Even if I go
into the settings menu and change the start page back to something I
want, the porn page overrides my choice the next time I reboot the PC.
How can I get rid of it?

A: Porn sites aren't the only ones who try and take over your browser
by changing your start page, which is the Web page that appears first
whenever you launch Internet Explorer. Some sleazy marketing sites do
this, too. These sites install malicious code on your PC, some of
which controls the browser start page setting, overriding your own
selections.

But I have found a free program to be very effective in blocking such
sabotage. It's called StartPage Guard and was developed by a
programmer named Piotr J. Walczak. The program not only kills
malicious code and allows you to restore your favorite start page, but
it can automatically check to make sure your choice isn't overridden
again. You can download StartPage Guard at

www.download.com  (search for "start page") or at http://pjwalczak.com/


Lockergnome Windows Digest] Superimposed Symphony and the Aliasing  
Date: 7/5/2003 4:37:19 PM Pacific Daylight Time

Browser Hijack Blaster v1.0 [393k] W98/2k/XP FREE


Browser Hijack Blaster protects your system from browser hijackers
and spyware that alters your Internet Explorer settings. It runs
in the system tray and silently monitors the settings for IE
Homepage, IE Default Page, IE Search Page, and BHOs (Browser
Helper Objects). If any of these settings are changed, it will
intercept and warn you, giving you the option to undo the changes.
[MWA]

 
http://www.mywebattack.com/gnomeapp.php?id=106649

http://www.wilderssecurity.net/bhblaster.html


HijackThis

HijackThis examines certain key areas of the Registry and Hard Drive
and lists their contents. These are areas which are used by both
legitimate programmers and hijackers. It's up to you to decide what
should be removed. Some items are perfectly fine. You should not
remove them. Never remove everything. Doing that could leave you with
missing items needed to run legitimate programs and add-ins. This Page
will help you work with the Experts to clean up your system. For those
of you needing instructions on how to Copy and Paste the contents of a
text file into a Forum Post, please look at the Table of Contents. A
link to the instructions is included.

http://www.tomcoyote.org/hjt/

HiJack This Tutorial

http://hjt.wizardsofwebsites.com/

I think this is a simple answer for the Tutorial:

In This Weekly Issue of ComputorEdge8-29-2003

Digital Dave

Dear Digital Dave, 
In the July 18 issue, a reader had a problem with spyware. You advised
him to download Ad-aware from Lavasoft to get rid of the problem. I
just want to add something you and your readers may want to know.
Ad-aware was unable to detect the spyware that had infested my
computer. This pesky program automatically initiated upon computer
startup and, no matter what I tried, I couldn?t get rid of it, as it
had placed hidden files in various locations on my computer that would
detect if parts were being deleted, and miraculously reinstall itself.
Here is what does the trick: Download, unzip, and install Hijack This!

   www.spywareinfo.com/downloads.php#det


This program scans the Registry. This is where some culprits nest to
prevent deletion.
Hit the Scan option. When the scan is finished, the Scan button will
change into a Save Log button. Press that, and save the log somewhere.
Copy the Registry scan and post the results on

   http://forums.techguy.org 

for someone knowledgeable to view the contents.
Most of what the log lists will be harmless, so don?t fix anything
yet. Someone will be happy to help. Next time, you will know what is
and isn?t harmless.





[Lockergnome Windows Digest] SIC 2003 Special Edition  
Date: 8/6/2003 4:01:33 PM Pacific Daylight Time

Secure IE 2003 [3.9MB] W9x/NT/2k/XP US$29.95

 The name of this software says it all (well, almost). Secure IE 
offers advanced protection from JavaScript, ActiveX controls, and 
VB Script, as well as effectively blocking malicious file 
downloads. Secure IE offers control over browser security 
settings, allowing you full access to trusted sites, while 
eliminating the potential nasties found on unknown sites. Pop-up 
blocking technology offers built-in elimination of annoying offer 
messages. Automatic configuration options let you lock down the 
most vulnerable portions of your browser in seconds. Tabbed 
browsing rounds out my favorite features of Secure IE, 
complimenting security enhancements with this required usability 
booster. This app is a must have for anyone who wants to secure 
their computer from browsing nasties or just wants to protect the 
corporate network from outside threats.
.
 http://www.secureie.com/


WinPatrol 5.2
Supports Windows 95, 98, ME, 2000, NT and XP 

·	
·	Detect if your default Home Page has been hijacked.

Message #: 291886From: J RAMSent: 8/29/2003 1:32 PM
A.	DAVY...this is the I've seen,and it does a-lot more things
including stopping worms and spyware.. it's free


  http://www.winpatrol.com/