Tech: Home page changes on its own!

Subject: Tech: Home page changes on its own!
From: katlaughing
Date: 23 Sep 03 - 05:31 PM

For the past two weeks or so, several times when we've shut down our browser (IE5.something,) it comes back up, the next time, having reset itself to this as a homepage: http://globe-finder.com/. Neither of us has manually changed it. I always reset it to google, through File>Tools>Internet Options>Apply>Okay and that works for a bit, then voila! it gets reset to the above.

I have AdAware and run it frequently and also have Proximotron (thanks BillD!. I am sure this is some kind of obnoxious spyware, but how is it doing this and how do I stop it? I am sure it came about, the first time, from some site Rog was at because it started after he was online one evening. I am wondering if it was one of the about.com sites as when I go into Internet Options to change it, the "current" homepage addy does not show up as I've linked, even though that is the page which comes up. The addy just says "about blank."

Thanks, folks!

kat

Subject: RE: Tech: Home page changes on its own!
From: Mr Red
Date: 23 Sep 03 - 05:45 PM

I use Xtech - it is a resource that can do quite a bit of tinkering - have a look at http://www.xteq.com/ and get as many plug-ins as you sensibly can. But I think you are right about it being spyware. You could try cntrl alt del and look at what progs might be running but some can hide from that I am told and it may have hijacked the launching of IE. Try a copy of Netscape - particularly now it is not being updated. For spyware to run I would have thought you have to run an executable and there are a lot of them, eg extensions like com pif lnk scn (or is it scr for screen saver) as well as exe and a few I can't remember. then there are the macros in excel word and access (& Outlook) that look innocent, but not to Norton.

Subject: RE: Tech: Home page changes on its own!
From: Geoff the Duck
Date: 23 Sep 03 - 05:47 PM

Spybot Search and Destroy is also worth running Click for website & download details. It is FREE to download and covers some problem areas not already addressed by Ad-Aware. Like Ad-Aware, the definitions files are updated at regular intervals.
Quack!
Geoff.

Subject: RE: Tech: Home page changes on its own!
From: katlaughing
Date: 23 Sep 03 - 06:01 PM

Thanks! Just heard about SpyBot in a PM, too, so that;s what I will do. Thanks very much, guys!

kat

Subject: RE: Tech: Home page changes on its own!
From: wysiwyg
Date: 23 Sep 03 - 06:38 PM

Pene recommended spybot for much the same thing I had.   I think several of us picked up this critter visiting a pic of Spaw all buffed from working out, that Amos had in his birthday thread. I had to delete a lot of cookies too.

~S~

Subject: RE: Tech: Home page changes on its own!
From: Geoff the Duck
Date: 23 Sep 03 - 06:38 PM

I've been using Spybot for a while now, and combined with Ad-Aware it has cleaned out a very large number of dodgy items which had installed or hidden on my computer, including traces of stuff I thought I had got rid of months previously, but which had left loose files and registry entries behind.
Since my previous posting, I've been looking at some of the extra features it contains. If you install it - click on the section called "Tools", then select "Browser Pages" - this MAY help you to check or deal with your current problem, kat.
The section called "Hosts File" also allows you to block a massive list of problem websites/cookies sent from advertising popups.
Quack!
GtD.

Subject: RE: Tech: Home page changes on its own!
From: McGrath of Harlow
Date: 23 Sep 03 - 06:40 PM

spawbot did you say?

Subject: RE: Tech: Home page changes on its own!
From: Geoff the Duck
Date: 23 Sep 03 - 06:46 PM

Spaw's "Bot"?
Be afraid - be VERY afraid...

Subject: RE: Tech: Home page changes on its own!
From: JohnInKansas
Date: 23 Sep 03 - 09:48 PM

Kat

There was a fairly widely circulating virus about a year or two ago, called Troj/JetHome, that attempted to change your home page. The "original" version(s) would send you either to a "travel service" or to a porn site every time you booted.

Quite a number of less than upright sites have also been known to include something similar in some "free downloads" - and since you "approve" the download, your AV may let the kernel slip through, assuming it's part of something you asked for.

There is most likely a ".dll" somewhere on your machine that's calling for the change in home page, quite likely in your START or STARTUP folder(s); but it may be quite difficult to find 'mongst all the other claptrap there. In the instances I've seen, there has always also been an entry in the registry, where the actual name of the site is recorded. If you're confident enough about your ability to back up, search, and "correct" the registry, you can use regedit.exe to "search" the registry for the site address, and remove the line that asks for it. If you're not pretty confident about mucking around in the registry, I'd suggest getting a local expert to help.

Search for "Troj/JetHome" on any AV site for an idea of how it may be working - even if it's not a 'real' virus thing. It's not the only one around that does this, but it's a "model" for the method.

John

Subject: RE: Tech: Home page changes on its own!
From: GUEST,.gargoyle
Date: 23 Sep 03 - 10:46 PM

You shouldn't be going places... you shouldn't be going
You shouldn't be doing the things.... you are doing
You shouldn't pretend to be a goddess of old

Sincerely,
Gargoyle

Kill your java-scripting for a day - restart and note the date, time, directory, clean from there.

Subject: RE: Tech: Home page changes on its own!
From: katlaughing
Date: 24 Sep 03 - 12:07 AM

GtD, quack-a-back atcha...thanks!

John, I've done regular virus scans, but I will also have alook as you suggest. Thanks very much.

Greg...I turned off my javascript long ago...that's a Mudcat Tech 101!

kat

Subject: RE: Tech: Home page changes on its own!
From: Mark Clark
Date: 24 Sep 03 - 12:36 AM

I use and recommend SpyBot S&D as well. Ad-Aware may be okay if you have the latest commercial version. If you're using the free version, it isn't keeping you safe any more.

When your browser gets hijacked, though, you may want to try a great little program called HijackThis. It's written especially to fix and prevent browser hijacking. It also incorporates a function that lists your complete startup configuration so you can share it with knowledgeable techs when asking for help.

      - Mark