Re: Help, my browser has been hijacked!

Crossposted to the IE7 newsgroup for convenience

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

"Nut that holds the wheel" <kraskamess@dakotacomm.net> wrote in message news:Z9SdnXCQifCf-F3VnZ2dnUVZ_gmdnZ2d@posted.dakotacomip...
>I am running Internet Explorer 7 (7.0.5730.13) under Windows XP Service Pack
> 3.
> Recently, when I do a search from Google or Yahoo, I get back the expected
> listing of hits. For example, I did a search on "Internet Explorer Beta 2".
> I got a page full of references, one of which was a link to the Windows
> Internet Explorer 8 Home Page at
> www.microsoft.com/windows/internet-explorer/beta. When I click on this link,
> a new page opens with the following in the address bar:
> http://www.findstuff.com/search.php?...gwO_j2Xw%2A%2A
> This is obviously not the Microsoft web site. Something has hijacked my
> search engine and is redirecting my searches.
>
> If I click on the back arrow from here, I momentarily see a URL that starts
> with www.topdir2.com/feed/click... but I end up back at the findstuff.com
> page.
>
> Sometimes I am redirected to the lowpriceshopper.com page or some other
> page, and some times I am not redirected at all.
>
> How can I find out what is causing this redirection and who/what I have to
> kill to fix this problem? Any help would be appreciated.
> Thanks
> Jim
>
>
>

Hi,
See these sites for help, including the posting of a HijackThis log to one
of the forums where HJT logs are analyzed:

The Parasite Fight http://www.aumha.org/a/quickfix.htm

Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm

Bugs, Glitches & Stuffups: http://www.mvps.org/inetexplorer/Darnit.html

Removing Malware:
http://www.elephantboycomputers.com/...moving_Malware

Partial list of forums- there are others:
http://forum.aumha.org/viewforum.php?f=30
http://spywarehammer.com/simplemachinesforum/index.php
http://www.spywarewarrior.com/index.php
http://forums.whatthetech.com/forums.html
http://www.thespykiller.co.uk/index.php?board=3.0
http://www.bleepingcomputer.com/forums/
http://forums.spywareinfo.com/

You will have to register to post to any of these forums and should look for
one or more "Important- Read this first" type messages, at whatever forum
you choose, for specific instructions.

Hope this helps,
Don
[MS MVP- IE]

"Peter Foldes" <okf22@hotmail.com> wrote in message
news:eha8FawDJHA.3908@TK2MSFTNGP04.phx.gbl...
Crossposted to the IE7 newsgroup for convenience

Peter
- - - -

"Nut that holds the wheel" <kraskamess@dakotacomm.net> wrote in message
news:Z9SdnXCQifCf-F3VnZ2dnUVZ_gmdnZ2d@posted.dakotacomip...
>I am running Internet Explorer 7 (7.0.5730.13) under Windows XP Service
Pack
> 3.
> Recently, when I do a search from Google or Yahoo, I get back the expected
> listing of hits. For example, I did a search on "Internet Explorer Beta
2".
> I got a page full of references, one of which was a link to the Windows
> Internet Explorer 8 Home Page at
> www.microsoft.com/windows/internet-explorer/beta. When I click on this
link,
> a new page opens with the following in the address bar:
>
http://www.findstuff.com/search.php?...gwO_j2Xw%2A%2A
> This is obviously not the Microsoft web site. Something has hijacked my
> search engine and is redirecting my searches.
>
> If I click on the back arrow from here, I momentarily see a URL that
starts
> with www.topdir2.com/feed/click... but I end up back at the findstuff.com
> page.
>
> Sometimes I am redirected to the lowpriceshopper.com page or some other
> page, and some times I am not redirected at all.
>
> How can I find out what is causing this redirection and who/what I have to
> kill to fix this problem? Any help would be appreciated.
> Thanks
> Jim

Lots of very useful information here. Thank you very much.
Jim

"Don Varnau" <don_04[at]varnau[dot]org> wrote in message
news:uTyCvczDJHA.3396@TK2MSFTNGP03.phx.gbl...
>
> Hi,
> See these sites for help, including the posting of a HijackThis log to one
> of the forums where HJT logs are analyzed:
>
> The Parasite Fight http://www.aumha.org/a/quickfix.htm
>
> Dealing with Unwanted Spyware and Parasites:
> http://mvps.org/winhelp2002/unwanted.htm
>
> Bugs, Glitches & Stuffups: http://www.mvps.org/inetexplorer/Darnit.html
>
> Removing Malware:
> http://www.elephantboycomputers.com/...moving_Malware
>
> Partial list of forums- there are others:
> http://forum.aumha.org/viewforum.php?f=30
> http://spywarehammer.com/simplemachinesforum/index.php
> http://www.spywarewarrior.com/index.php
> http://forums.whatthetech.com/forums.html
> http://www.thespykiller.co.uk/index.php?board=3.0
> http://www.bleepingcomputer.com/forums/
> http://forums.spywareinfo.com/
>
> You will have to register to post to any of these forums and should look
> for
> one or more "Important- Read this first" type messages, at whatever forum
> you choose, for specific instructions.
>
> Hope this helps,
> Don
> [MS MVP- IE]
>
> "Peter Foldes" <okf22@hotmail.com> wrote in message
> news:eha8FawDJHA.3908@TK2MSFTNGP04.phx.gbl...
> Crossposted to the IE7 newsgroup for convenience
>
> Peter
> - - - -
>
> "Nut that holds the wheel" <kraskamess@dakotacomm.net> wrote in message
> news:Z9SdnXCQifCf-F3VnZ2dnUVZ_gmdnZ2d@posted.dakotacomip...
>>I am running Internet Explorer 7 (7.0.5730.13) under Windows XP Service
> Pack
>> 3.
>> Recently, when I do a search from Google or Yahoo, I get back the
>> expected
>> listing of hits. For example, I did a search on "Internet Explorer Beta
> 2".
>> I got a page full of references, one of which was a link to the Windows
>> Internet Explorer 8 Home Page at
>> www.microsoft.com/windows/internet-explorer/beta. When I click on this
> link,
>> a new page opens with the following in the address bar:
>>
> http://www.findstuff.com/search.php?...gwO_j2Xw%2A%2A
>> This is obviously not the Microsoft web site. Something has hijacked my
>> search engine and is redirecting my searches.
>>
>> If I click on the back arrow from here, I momentarily see a URL that
> starts
>> with www.topdir2.com/feed/click... but I end up back at the findstuff.com
>> page.
>>
>> Sometimes I am redirected to the lowpriceshopper.com page or some other
>> page, and some times I am not redirected at all.
>>
>> How can I find out what is causing this redirection and who/what I have
>> to
>> kill to fix this problem? Any help would be appreciated.
>> Thanks
>> Jim
>

Lots of very useful information here. Thank you very much. Sorry about the
initial mis-posting, I got my tools mixed up
Jim

"Nut that holds the wheel" <kraskamess@dakotacomm.net> wrote in message
news:QvKdnbpXPagT9lzVnZ2dnUVZ_hOdnZ2d@posted.dakot acomip...
> Lots of very useful information here. Thank you very much.
> Jim
>
> "Don Varnau" <don_04[at]varnau[dot]org> wrote in message
> news:uTyCvczDJHA.3396@TK2MSFTNGP03.phx.gbl...
>>
>> Hi,
>> See these sites for help, including the posting of a HijackThis log to
>> one
>> of the forums where HJT logs are analyzed:
>>
>> The Parasite Fight http://www.aumha.org/a/quickfix.htm
>>
>> Dealing with Unwanted Spyware and Parasites:
>> http://mvps.org/winhelp2002/unwanted.htm
>>
>> Bugs, Glitches & Stuffups: http://www.mvps.org/inetexplorer/Darnit.html
>>
>> Removing Malware:
>> http://www.elephantboycomputers.com/...moving_Malware
>>
>> Partial list of forums- there are others:
>> http://forum.aumha.org/viewforum.php?f=30
>> http://spywarehammer.com/simplemachinesforum/index.php
>> http://www.spywarewarrior.com/index.php
>> http://forums.whatthetech.com/forums.html
>> http://www.thespykiller.co.uk/index.php?board=3.0
>> http://www.bleepingcomputer.com/forums/
>> http://forums.spywareinfo.com/
>>
>> You will have to register to post to any of these forums and should look
>> for
>> one or more "Important- Read this first" type messages, at whatever forum
>> you choose, for specific instructions.
>>
>> Hope this helps,
>> Don
>> [MS MVP- IE]
>>
>> "Peter Foldes" <okf22@hotmail.com> wrote in message
>> news:eha8FawDJHA.3908@TK2MSFTNGP04.phx.gbl...
>> Crossposted to the IE7 newsgroup for convenience
>>
>> Peter
>> - - - -
>>
>> "Nut that holds the wheel" <kraskamess@dakotacomm.net> wrote in message
>> news:Z9SdnXCQifCf-F3VnZ2dnUVZ_gmdnZ2d@posted.dakotacomip...
>>>I am running Internet Explorer 7 (7.0.5730.13) under Windows XP Service
>> Pack
>>> 3.
>>> Recently, when I do a search from Google or Yahoo, I get back the
>>> expected
>>> listing of hits. For example, I did a search on "Internet Explorer Beta
>> 2".
>>> I got a page full of references, one of which was a link to the Windows
>>> Internet Explorer 8 Home Page at
>>> www.microsoft.com/windows/internet-explorer/beta. When I click on this
>> link,
>>> a new page opens with the following in the address bar:
>>>
>> http://www.findstuff.com/search.php?...gwO_j2Xw%2A%2A
>>> This is obviously not the Microsoft web site. Something has hijacked my
>>> search engine and is redirecting my searches.
>>>
>>> If I click on the back arrow from here, I momentarily see a URL that
>> starts
>>> with www.topdir2.com/feed/click... but I end up back at the
>>> findstuff.com
>>> page.
>>>
>>> Sometimes I am redirected to the lowpriceshopper.com page or some other
>>> page, and some times I am not redirected at all.
>>>
>>> How can I find out what is causing this redirection and who/what I have
>>> to
>>> kill to fix this problem? Any help would be appreciated.
>>> Thanks
>>> Jim
>>
>
>

You're welcome.

Don

"Nut that holds the wheel" <kraskamess@dakotacomm.net> wrote in message
news:e_idnaOP2q3u8FzVnZ2dnUVZ_tbinZ2d@posted.dakot acomip...
> Lots of very useful information here. Thank you very much. Sorry about the
> initial mis-posting, I got my tools mixed up
> Jim

> "Nut that holds the wheel" <kraskamess@dakotacomm.net> wrote in message
> news:QvKdnbpXPagT9lzVnZ2dnUVZ_hOdnZ2d@posted.dakot acomip...
> > Lots of very useful information here. Thank you very much.
> > Jim

> > "Don Varnau" <don_04[at]varnau[dot]org> wrote in message
> > news:uTyCvczDJHA.3396@TK2MSFTNGP03.phx.gbl...
> >>
> >> Hi,
> >> See these sites for help, including the posting of a HijackThis log to
> >> one
> >> of the forums where HJT logs are analyzed:
> >>
> >> The Parasite Fight http://www.aumha.org/a/quickfix.htm
> >>
> >> Dealing with Unwanted Spyware and Parasites:
> >> http://mvps.org/winhelp2002/unwanted.htm
> >>
> >> Bugs, Glitches & Stuffups: http://www.mvps.org/inetexplorer/Darnit.html
> >>
> >> Removing Malware:
> >> http://www.elephantboycomputers.com/...moving_Malware
> >>
> >> Partial list of forums- there are others:
> >> http://forum.aumha.org/viewforum.php?f=30
> >> http://spywarehammer.com/simplemachinesforum/index.php
> >> http://www.spywarewarrior.com/index.php
> >> http://forums.whatthetech.com/forums.html
> >> http://www.thespykiller.co.uk/index.php?board=3.0
> >> http://www.bleepingcomputer.com/forums/
> >> http://forums.spywareinfo.com/
> >>
> >> You will have to register to post to any of these forums and should
look
> >> for
> >> one or more "Important- Read this first" type messages, at whatever
forum
> >> you choose, for specific instructions.

> >> "Peter Foldes" <okf22@hotmail.com> wrote in message
> >> news:eha8FawDJHA.3908@TK2MSFTNGP04.phx.gbl...
> >> Crossposted to the IE7 newsgroup for convenience
> >>
> >> Peter
> >> - - - -
> >>
> >> "Nut that holds the wheel" <kraskamess@dakotacomm.net> wrote in message
> >> news:Z9SdnXCQifCf-F3VnZ2dnUVZ_gmdnZ2d@posted.dakotacomip...
> >>>I am running Internet Explorer 7 (7.0.5730.13) under Windows XP Service
> >> Pack
> >>> 3.
> >>> Recently, when I do a search from Google or Yahoo, I get back the
> >>> expected
> >>> listing of hits. For example, I did a search on "Internet Explorer
Beta
> >> 2".
> >>> I got a page full of references, one of which was a link to the
Windows
> >>> Internet Explorer 8 Home Page at
> >>> www.microsoft.com/windows/internet-explorer/beta. When I click on this
> >> link,
> >>> a new page opens with the following in the address bar:
> >>>
> >>
http://www.findstuff.com/search.php?...gwO_j2Xw%2A%2A
> >>> This is obviously not the Microsoft web site. Something has hijacked
my
> >>> search engine and is redirecting my searches.
> >>>
> >>> If I click on the back arrow from here, I momentarily see a URL that
> >> starts
> >>> with www.topdir2.com/feed/click... but I end up back at the
> >>> findstuff.com
> >>> page.
> >>>
> >>> Sometimes I am redirected to the lowpriceshopper.com page or some
other
> >>> page, and some times I am not redirected at all.
> >>>
> >>> How can I find out what is causing this redirection and who/what I
have
> >>> to
> >>> kill to fix this problem? Any help would be appreciated.
> >>> Thanks
> >>> Jim