Hijacking of IE6 by linkarama.net

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Initially, the homepage was set to linkarama.net and the field was greyed
out. After going through the newsgroup and changing the registry settings in
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel
that problem is solved. But sometimes it keeps changing back and I need to do
the whole regedit thing again.

Also, whenever any url is typed starting with www. the browser is redirected
e.g. When typing www.google.com it redirects to
www.linkarama.net?/www.google.com and shows a porn site.

The problem does not show itself if the url is typed simply as google.com or
as http://www.google.com The problem exists with all websites.

Would be grateful for any help.
 
Sandeep said:
Initially, the homepage was set to linkarama.net and the field was greyed
out. After going through the newsgroup and changing the registry settings in
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel
that problem is solved. But sometimes it keeps changing back and I need to do
the whole regedit thing again.

Also, whenever any url is typed starting with www. the browser is redirected
e.g. When typing www.google.com it redirects to
www.linkarama.net?/www.google.com and shows a porn site.

The problem does not show itself if the url is typed simply as google.com or
as http://www.google.com The problem exists with all websites.

Would be grateful for any help.
Click to expand...
Hi Sandeep,
Your Browser Hijacked by this evil website, try to Scan for Malware/Grayware
and for Viruses.
Do you have Anti-Virus installed with Firewall in place to protect you from
all the Internet troubles, which in fact you brought to yourself (set as
homepage what the joy!).
For Anti-Spware go here:
http://www.download.com (for Spybot SD)
http://www.lavasoftusa.com (for Lavasoft SE personal use)
http://www.pandasoftware.com/products/activescan.htm
http://www.sophos.com/virusinfo/analyses/trojswizzoraw.html
http://www.nasstec.co.uk/tools.html
http://www.avast.com/eng/vps_history.html
Then Go to the Registry and look for the Key:
HKEK_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\InternetSettings\P3P
and look for any Reference for the Linkarama.net and Delete it.

HKEK_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\InternetSettings\MapZone.
Delete all reference to the scum there.

HKEK_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\InternetSettings\Zone
[1] Delete any IP or reference created by the website there 62.83.12.182 i.e
[2] Del // // /// // //
//
[3] Del // // // //
// /
etc.
The Same apply in:
HKEY_CURRENT_USER\Microsoft\Windows\InternetSettings\Zone

HKEY_USER\Microsoft\Windows\InternetSettings\Zone
Say you have
S-1-5-11-5776-90-4-bla-bla\Microsoft\Windows\InternetSettings\Zone
Hope this this Helps
Please let us know
nass
 
Check
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes
They should read
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"


nass said:
Sandeep said:
Initially, the homepage was set to linkarama.net and the field was greyed
out. After going through the newsgroup and changing the registry settings in
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel
that problem is solved. But sometimes it keeps changing back and I need to do
the whole regedit thing again.

Also, whenever any url is typed starting with www. the browser is redirected
e.g. When typing www.google.com it redirects to
www.linkarama.net?/www.google.com and shows a porn site.

The problem does not show itself if the url is typed simply as google.com or
as http://www.google.com The problem exists with all websites.

Would be grateful for any help.
Click to expand...
Hi Sandeep,
Your Browser Hijacked by this evil website, try to Scan for Malware/Grayware
and for Viruses.
Do you have Anti-Virus installed with Firewall in place to protect you from
all the Internet troubles, which in fact you brought to yourself (set as
homepage what the joy!).
For Anti-Spware go here:
http://www.download.com (for Spybot SD)
http://www.lavasoftusa.com (for Lavasoft SE personal use)
http://www.pandasoftware.com/products/activescan.htm
http://www.sophos.com/virusinfo/analyses/trojswizzoraw.html
http://www.nasstec.co.uk/tools.html
http://www.avast.com/eng/vps_history.html
Then Go to the Registry and look for the Key:
HKEK_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\InternetSettings\P3P
and look for any Reference for the Linkarama.net and Delete it.

HKEK_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\InternetSettings\MapZone.
Delete all reference to the scum there.

HKEK_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\InternetSettings\Zone
[1] Delete any IP or reference created by the website there 62.83.12.182 i.e
[2] Del // // /// // //
//
[3] Del // // // //
// /
etc.
The Same apply in:
HKEY_CURRENT_USER\Microsoft\Windows\InternetSettings\Zone

HKEY_USER\Microsoft\Windows\InternetSettings\Zone
Say you have
S-1-5-11-5776-90-4-bla-bla\Microsoft\Windows\InternetSettings\Zone
Hope this this Helps
Please let us know
nass
Click to expand...
 
Sandeep said:
Initially, the homepage was set to linkarama.net and the field was greyed
out. After going through the newsgroup and changing the registry settings in
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel
that problem is solved. But sometimes it keeps changing back and I need to do
the whole regedit thing again.

Also, whenever any url is typed starting with www. the browser is redirected
e.g. When typing www.google.com it redirects to
www.linkarama.net?/www.google.com and shows a porn site.

The problem does not show itself if the url is typed simply as google.com or
as http://www.google.com The problem exists with all websites.

Would be grateful for any help.
Click to expand...
Sorry Sandeep, and Thanks For Doug his Post remind me.
I forget to Put Software in the KEYS here is the right one:
Hi Sandeep,
Your Browser Hijacked by this evil website, try to Scan for Malware/Grayware
and for Viruses.
Do you have Anti-Virus installed with Firewall in place to protect you from
all the Internet troubles, which in fact you brought to yourself (set as
homepage what the joy!).
For Anti-Spware go here:
http://www.download.com ; (for Spybot SD)
http://www.lavasoftusa.com ; (for Lavasoft SE personal use)
http://www.pandasoftware.com/products/activescan.htm
http://www.sophos.com/virusinfo/analyses/trojswizzoraw.html
http://www.nasstec.co.uk/tools.html
http://www.avast.com/eng/vps_history.html
Then Go to the Registry and look for the Key:

HKEK_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\InternetSettings\P3P
and look for any Reference for the Linkarama.net and Delete it.

HKEK_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\InternetSettings\MapZone.
Delete all reference to the scum there.

HKEK_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\InternetSettings\Zone
[1] Delete any IP or reference created by the website there 62.83.12.182 i.e
[2] Del // // /// // //
//
[3] Del // // // //
// /
etc.
The Same apply in:
HKEY_CURRENT_USER\Software\Microsoft\Windows\InternetSettings\Zone

HKEY_USER\Microsoft\Software\Windows\InternetSettings\Zone
Say you have
S-1-5-11-5776-90-4-bla-bla\Software\Microsoft\Windows\InternetSettings\Zone
Hope this this Helps
Please let us know
nass
 
Another option I messed,
Check the Host File and Delete the Reference created there too.
To Do that Open your Windows Explorer and Cllcik the Plus [+] beside My
Computer select your Drive Letter (C, D ) where is your Active Pertition is.
Click on the Plus beside Windows to expand nd Locate System32, Click on the
Plus [+] to expand and Locate drivers click on it and look in the Right Pane
(Window) and you will see folder named etc, Double click it and Locate the
File called HOSTS but not the one with extension (.SAM)
Double click and Open with Notepad and Locate the website reference and
delete.
Save the Hosts file as it is and close.
Reboot and hopefully you done!
Regards
nass
 
Back
Top