Is this a hijacker?

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hello and thanks for any help.

Quite often when I go to a web page especially from a Google search hit I
see the page for a few seconds then it changes to another page by itself. It
seems that the new page is related to the term I just to searched on. The new
pages come from different sources but one of them just came from 'Monster
Marketplace Search Results.' Is there a way to stop this?

Thanks
 
Chirp said:
Hello and thanks for any help.

Quite often when I go to a web page especially from a Google search hit I
see the page for a few seconds then it changes to another page by itself. It
seems that the new page is related to the term I just to searched on. The new
pages come from different sources but one of them just came from 'Monster
Marketplace Search Results.' Is there a way to stop this?

Thanks
Click to expand...

Yes, your search engine Hijacked:
Try to scan for malwares by downloading these software and update their
definitions then run a scan:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Taps:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
For Malwares download both these software:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

Open the Run Command and type in:
regedit.exe click [OK]
On the Registry Editor locate this Key:
[-]HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main =
Look in the Right Pane/Window for the search Bar and Search Page if it for
this tool bar delete it.

[-]HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Toolbar =
look for the extension of the toolbar in the Right Pane/Window.

[-] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
Look in the Right Pane/Window for the search Bar and Search page if it for
this tool bar delete it

[-] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Toolbar =
The same here.

2- Download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
Please tell us about the Name of that worm next time in your message.
HTH.
Please let us know.
Regards,
nass
 
Thank you very much. I'm doing this now. Where do these come from? I'm
running Avast.

nass said:
Chirp said:
Hello and thanks for any help.

Quite often when I go to a web page especially from a Google search hit I
see the page for a few seconds then it changes to another page by itself. It
seems that the new page is related to the term I just to searched on. The new
pages come from different sources but one of them just came from 'Monster
Marketplace Search Results.' Is there a way to stop this?

Thanks
Click to expand...

Yes, your search engine Hijacked:
Try to scan for malwares by downloading these software and update their
definitions then run a scan:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Taps:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
For Malwares download both these software:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

Open the Run Command and type in:
regedit.exe click [OK]
On the Registry Editor locate this Key:
[-]HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main =
Look in the Right Pane/Window for the search Bar and Search Page if it for
this tool bar delete it.

[-]HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Toolbar =
look for the extension of the toolbar in the Right Pane/Window.

[-] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
Look in the Right Pane/Window for the search Bar and Search page if it for
this tool bar delete it

[-] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Toolbar =
The same here.

2- Download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
Please tell us about the Name of that worm next time in your message.
HTH.
Please let us know.
Regards,
nass
Click to expand...
 
It could be you selected the search by mistake or a website hooked this
BHO on your browser.
Avast is Anti-Virus not Anti-Spyware/Malware so you need an Anti-Malware
like Lavasoft or Spybot S&D , also a firewall like ZA or Comodo.
HTH.
nass
===
www.nasstec.co.uk
Chirp said:
Thank you very much. I'm doing this now. Where do these come from? I'm
running Avast.

nass said:
Chirp said:
Hello and thanks for any help.

Quite often when I go to a web page especially from a Google search hit I
see the page for a few seconds then it changes to another page by itself. It
seems that the new page is related to the term I just to searched on. The new
pages come from different sources but one of them just came from 'Monster
Marketplace Search Results.' Is there a way to stop this?

Thanks
Click to expand...

Yes, your search engine Hijacked:
Try to scan for malwares by downloading these software and update their
definitions then run a scan:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Taps:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
For Malwares download both these software:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

Open the Run Command and type in:
regedit.exe click [OK]
On the Registry Editor locate this Key:
[-]HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main =
Look in the Right Pane/Window for the search Bar and Search Page if it for
this tool bar delete it.

[-]HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Toolbar =
look for the extension of the toolbar in the Right Pane/Window.

[-] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
Look in the Right Pane/Window for the search Bar and Search page if it for
this tool bar delete it

[-] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Toolbar =
The same here.

2- Download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
Please tell us about the Name of that worm next time in your message.
HTH.
Please let us know.
Regards,
nass
Click to expand...
Click to expand...
 
OK--here we go.
First thanks for your help.

After about 8 hours of work, including waiting for scans to complete, my
system is clean. More importatly it is back in my control. Since you asked
here are the culprits.

Adware.Beginto
" .Coolwebsearch
" .Savenow
" .SearchTool
" .SmartShoppe
Downloader Age
Heuristic.Win32.Dialer

The symptoms I was having were that new desktop icons that pointed to
specific websites would appear out of nowhere and my Google searches were
being redirected, and lots of popups. Most of these things started happening
after I was searching for ringtones one night. I was told that if you choose
to have them sent to your phone just to sample them that that's one way to
get infected.





nass said:
Chirp said:
Hello and thanks for any help.

Quite often when I go to a web page especially from a Google search hit I
see the page for a few seconds then it changes to another page by itself. It
seems that the new page is related to the term I just to searched on. The new
pages come from different sources but one of them just came from 'Monster
Marketplace Search Results.' Is there a way to stop this?

Thanks
Click to expand...

Yes, your search engine Hijacked:
Try to scan for malwares by downloading these software and update their
definitions then run a scan:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Taps:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
For Malwares download both these software:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

Open the Run Command and type in:
regedit.exe click [OK]
On the Registry Editor locate this Key:
[-]HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main =
Look in the Right Pane/Window for the search Bar and Search Page if it for
this tool bar delete it.

[-]HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Toolbar =
look for the extension of the toolbar in the Right Pane/Window.

[-] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
Look in the Right Pane/Window for the search Bar and Search page if it for
this tool bar delete it

[-] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Toolbar =
The same here.

2- Download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
Please tell us about the Name of that worm next time in your message.
HTH.
Please let us know.
Regards,
nass
Click to expand...
 
Yes, those the culprits for your redirecting to other websites. Did you get
rid of them by deleting or uninstall their files/folder and plug-ins?.
If you still I recommend Sending the HijackThis log File to one of the
forums in my other post to get an expert advice and it is free, you just need
to create an account like the one you create for MS NG.
You are welcome and thanks for the feddback and letting us know.
Regards,
nass

Chirp said:
OK--here we go.
First thanks for your help.

After about 8 hours of work, including waiting for scans to complete, my
system is clean. More importatly it is back in my control. Since you asked
here are the culprits.

Adware.Beginto
" .Coolwebsearch
" .Savenow
" .SearchTool
" .SmartShoppe
Downloader Age
Heuristic.Win32.Dialer

The symptoms I was having were that new desktop icons that pointed to
specific websites would appear out of nowhere and my Google searches were
being redirected, and lots of popups. Most of these things started happening
after I was searching for ringtones one night. I was told that if you choose
to have them sent to your phone just to sample them that that's one way to
get infected.





nass said:
Chirp said:
Hello and thanks for any help.

Quite often when I go to a web page especially from a Google search hit I
see the page for a few seconds then it changes to another page by itself. It
seems that the new page is related to the term I just to searched on. The new
pages come from different sources but one of them just came from 'Monster
Marketplace Search Results.' Is there a way to stop this?

Thanks
Click to expand...

Yes, your search engine Hijacked:
Try to scan for malwares by downloading these software and update their
definitions then run a scan:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Taps:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
For Malwares download both these software:
http://www.lavasoft.com/products/ad-aware_se_personal.php
http://www.safer-networking.org ; for Spybot S&D

Open the Run Command and type in:
regedit.exe click [OK]
On the Registry Editor locate this Key:
[-]HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main =
Look in the Right Pane/Window for the search Bar and Search Page if it for
this tool bar delete it.

[-]HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Toolbar =
look for the extension of the toolbar in the Right Pane/Window.

[-] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
Look in the Right Pane/Window for the search Bar and Search page if it for
this tool bar delete it

[-] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Toolbar =
The same here.

2- Download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
Please perform one step (1,2) at a time and see if that will help your
issue.
Please tell us about the Name of that worm next time in your message.
HTH.
Please let us know.
Regards,
nass
Click to expand...
Click to expand...
 
Back
Top