Browser Hijacking

[Carbo]

Is this something new? Twice, one yesterday and again just now, my home page was automatically changed by some POS popup ad. I did a little digging around and discovered this is some BS browser hijacking.
My home page vanishes and my new home page is switched to an ad for some spyware remover. In addition, this program makes both my CD drives pop open and claims that is proof my system is not secured. WTF?
Where did this thing come from? I ran a virus scan and the PC is clean. I ran AdAware and I got this:
Started deep registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainSearch Bar.smartbotpro.net

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://server224.smartbotpro.net/7search/?hkcu"
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Main
Value : Search Bar
Data : "http://server224.smartbotpro.net/7search/?hkcu"

Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainSearch Bar.smartbotpro.net

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://server224.smartbotpro.net/7search/?hklm"
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Main
Value : Search Bar
Data : "http://server224.smartbotpro.net/7search/?hklm"

Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainStart Pagedefault-homepage-network.com

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://default-homepage-network.com/start.cgi?hkcu"
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "http://default-homepage-network.com/start.cgi?hkcu"

Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainStart Pagedefault-homepage-network.com

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://default-homepage-network.com/start.cgi?hklm"
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "http://default-homepage-network.com/start.cgi?hklm"

Mean anything to anyone?
Thanks!

 

[egale]

Both Adaware and Spybot are two good spyware removal tools. I would run them both and let them do their thing. Adaware already found problems so let it do it's thing and clean your system. Each program usually finds a few different things so be sure to run both.

 

[kursplat]

this might help. also try a popup blocker of some sort.
good luck

P.S. anyone that writes a home page hijacker script should be forced to watch the movie Gigli for a week straight.

 

[ba2486]

Look Here

h**p://www.kellys-korner-xp.com

Lots of answers

 

[Carbo]

Thanks, guys, for the input.
I have installed and I do run both AdAware and SpyBot. Yeah, both are good at cleaning up the crap that gets on the PC. I also use Google's popup blocker, (5,600 and counting :beer: ). What I'm wondering is how is this program getting onto my system in the first place? Then, what can I do to block it, versus erasing it after it has appeared?
kursplat, that StartPage Guard link looks pretty interesting. Have you tried it?

 

[ClueLis]

You may have a piece of software that is reinstalling the spyware every time it runs.

If it is a browser issue that is getting by SpyBot, you could also try Firebird.

 

[compudog]

I agree with ClueLis. Firebird is very nice. I have only found a few pages where I must use IE. Firebird is my browser of choice.

 

[kursplat]

kursplat, that StartPage Guard link looks pretty interesting. Have you tried it?

no i haven't . don't know if i'm lucky or careful. but other programs i've tryed from that site work fine. there rating system seems pretty resonable.
good luck

 

[NuTechNot]

SpyBot should/does have (in the Immunize button) something to block known browser hi-jackers.