Article, October 2004
Help! I’ve been hijacked…
by Sherry Zorzi,
Cajun Clickers Computer Club, Louisiana.
First it was viruses, worms, and spam. Then came Trojans spyware, and pop-ups. The newest scourge plaguing Internet surfers is browser hijackers, and one very nasty one is making the rounds in the Baton Rouge area causing all manner of grief for local folks, including some Clickers members.
Browser hijackers are malicious programs that change browser settings, usually altering designated default start and search pages. The newest versions are going beyond messing with your browser settings. One of the worst, called “Cool Web Search” is particularly hard to remove.
How can you tell you have a browser hijacker? If your start page is suddenly different, that’s a clue. Often the hijacker won’t let you change your start page back to your preferred page. You might also notice a new “helper” toolbar added to your browser.
Another clue can be a changed search page. If you used to get MSN as your search page when you click the “Search” button but now some other page is coming up, you’ve likely been hijacked.
Some of the hijackers will load a page that looks like Google but isn’t really Google – a particularly dastardly trick. Many will give unexpected search results. You may search for some innocent topic and get lots of results that lead to porn sites. If you search on “spyware” or the name of a hijacker program, the browser may either freeze up, or give you only benign results making it look like the hijacker program is a good thing.
Many folks who’ve been hijacked find that porn sites have been added to their favorites list. Some report pornographic files being downloaded. Some are being redirected to porn sites when mis-typing a URL (web address).
Other symptoms include pop-up ads even though you’re running a pop-up stopper program. These pop-ups can appear more rapidly than you can close them and can freeze your system quickly. You may notice drastically reduced resources or messages that your system is low on resources or virtual memory. Or you may receive dramatically increased spam. Frequent lock-ups are a common complaint as is painfully slow performance.
Some of the hijackers can even disable your firewall, your anti-virus software or your spyware killers. Or they can prevent anti-virus software and spyware detectors from being updated.
In the past, we were safe from most Internet threats so long as we kept our anti-virus software updated and ran a firewall. Running Ad-Aware or Spybot Search and Destroy once a week or so cleaned up any spyware that had crept in but we never had much trouble. If we were smart enough not to download junk and not to open attachments, we were pretty safe. But times have changed and we must change our thinking too.
This recent rash of nasty stuff came in through a security hole in Microsoft Windows. Those who did not update Windows in a timely manner were sitting ducks for the Cool Web Search hijacker. From now on you must keep Windows up to date, especially with the so-called “critical updates.”
The newest browser hijackers are particularly difficult to remove. You can try the following but be sure to follow the steps in order. If you don’t know what you’re doing, you should take the infected machine in to one of our local computer shops and let them fix it for you. It’s possible to mess your computer up really badly while trying to remove a hijacker!
1. If you’re running Windows ME, Windows 2000, or Windows XP, you must first turn off the system restore feature. Otherwise any problem you fix will just return when you reboot the computer. Search your Windows Help screens for instructions on how to disable System Restore for your version of Windows. Warning: You will lose all restore points you’ve previously made!
2. Download the Cwshredder tool from http://www.downloads.com or any of the many sites that make it available. If you’re infected with a hijacker, go to a non-infected machine to download your tools. Be sure you get the absolute latest version of Cwshredder since it is updated every few days. New variants of these hijackers appear at an amazing rate and you must have the latest Cwshredder to detect and clean them all.
3. Reboot your machine and run Cwshredder again.
4.Run Ad-aware. Be sure you update it first. If you don’t already have Ad-aware, get it at http://www.lavasoftusa.com
5. Reboot your machine and run Ad-aware again.
6. Run Spybot Search & Destroy. Be sure to update it first. If you don’t have Spybot Search & Destroy, get it at http://www.safer-networking.org
7. Reboot your machine and run Spybot again.
8. If everything seems to be clean now, be sure to turn Windows System Restore back on!
Don’t let a browser hijacker ruin your tech-life! Keep Windows updated. Install and run a firewall. Install, keep updated and run anti-virus software. Install, update and run spyware cleaners. And encourage Congress to nail these hijacking jerks!
There is no restriction against any non-profit group using this article as long as it is kept in context with proper credit given the author. The Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member, brings this article to you.Click here to return to top