Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Strange Ie Hijacking


  • Please log in to reply
10 replies to this topic

#1 melon88

melon88

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:55 PM

Posted 29 July 2006 - 04:43 PM

For the most part everything works fine, BUT when my wife tried to access a local school websit that has not been visited in a couple of months she was redirected to a soft porn site? It is happening to all the computers on our Home Network but only when we try to access sites that are connected to the school system and not to any other site. None of our neighbors are affected so it just seems to be on our home network. Just seems strange to hijack a site not frequently visited and no other. I have anti-virus operating and run Spy-Bot and Ad-Aware frequently and they have not detected any problem. Also tried to run some of the scan programs in the hijacking guide and they found nothing. Running Windows XP and IE6 all security updates have been installed. Any insight would be appreciated!

BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • Moderator
  • 13,515 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:55 PM

Posted 29 July 2006 - 05:04 PM

Are you using a bookmark or favorites to click on the site(s)? It would be simple for someone to play a joke on you by changing the text on the shortcut. If you are typing in a web address in the search bar for the site then that is a different problem and probably is malware related. Which is it?
“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#3 moomoo

moomoo

  • Members
  • 267 posts
  • OFFLINE
  •  
  • Local time:06:55 PM

Posted 29 July 2006 - 05:40 PM

This is kind of personal but does anyone in your house ever use the computer and maybe access porn sites? They have lots of spyware and trojans on em' and that MAY be your problem if not...no clue

Good Luck,
Moomoo

#4 Enthusiast

Enthusiast

  • Members
  • 5,898 posts
  • OFFLINE
  •  
  • Location:Florida, USA
  • Local time:05:55 PM

Posted 29 July 2006 - 06:11 PM

Run both Adaware and Spybot Search and Destroy from safe mode, updating each program’s malware definitions before you scan and allowing both to fix what they find.

If you do not already have these freeware aps installed on your computer, you can get them at the following sites:

*AdAware SE: http://www.majorgeeks.com/download506.html

*Spybot S&D: http://www.safer-networking.org/en/index.html

Following that that I suggest you post a “HijackThis” log for expert assistance with your malware infection.

Read the pinned post in our “HijackThis” forum,
here
http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/
Carefully read and follow all directions explicitly.

Following instructions create a HJT log, and POST THE HJT LOG YOU CREATED IN OUR HJT FORUM – not in this forum,
at this link.
http://www.bleepingcomputer.com/forums/posthjtlog.html
Include the specs for your computer (ie, processor, amount of RAM, brand or motherboard, etc, and briefly describe the problem you are experiencing.)

Unless you are expert at editing the registry, Do not use the Hijack This program to try to fix anything by yourself as even what may seem to be a small mistake can render your operating system inoperable.
Some files when in the correct folder for them may be fine while in another may be malware hiding.


A member of our expert HJT Team will analyze your log, make recommendations and offer assistance, walking you through the complete repair process.

It may take a period of time to get a response to the log you posted because the members of our HJT Team are kept very busy.
Please be patient as this team is manned by volunteers. They will help you in order received as soon as possible.

NOTE
Once you have posted your HJT log, please DO NOT make any additional posts in the HJT forum thread you created until you get a response from a member of our HJT expert team, and do not make any changes to your system (changes, including any attempted repairs, will make your computer to be different than displayed in the log you posted and therefore make your log inaccurate).

The first criteria the HJT Team has when looking for logs that need replies are posts showing 0 replies. If you make an additional post, it will show as having 1 reply.
A team member, looking for a new log that requires help might well assume another HJT Team member is already assisting you and might not open the thread to respond.

So, post your HJT Log in our HJT Forum (not here in this forum) and wait for a response from a HJT team member.

#5 melon88

melon88
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:55 PM

Posted 29 July 2006 - 07:19 PM

Are you using a bookmark or favorites to click on the site(s)? It would be simple for someone to play a joke on you by changing the text on the shortcut. If you are typing in a web address in the search bar for the site then that is a different problem and probably is malware related. Which is it?


No actually we access it through link from another site but have also tried to type in the address, it is not bookmarked we don't use it that often.

#6 melon88

melon88
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:55 PM

Posted 29 July 2006 - 07:22 PM

This is kind of personal but does anyone in your house ever use the computer and maybe access porn sites? They have lots of spyware and trojans on em' and that MAY be your problem if not...no clue

Good Luck,
Moomoo



No, not on purpose anyway! Makes sense to ask though.

#7 buddy215

buddy215

  • Moderator
  • 13,515 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:55 PM

Posted 29 July 2006 - 09:25 PM

Thanks for responding. Have you notified the school? Before doing that though I would use another computer-neighbor's, library--and confirm that the link on the site you use to link from is taking you to the porn site or not. If the same link takes you to the school site on another computer, then you need to do some serious searching for malware.
“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#8 moomoo

moomoo

  • Members
  • 267 posts
  • OFFLINE
  •  
  • Local time:06:55 PM

Posted 30 July 2006 - 08:44 AM

Yea thats happened to a few sites before sites get linked to each other some how, for example, my friend used msn dollies and when she typed in the adress it brought up a horror site or something...butt run those scans and see what it brings up, and do what buddy said, check it on your neighbours computer, if the same thing comes up notify the school and we'll no its not a malware problem, if it doesent come up on your neighbours, scan for malware and if THAT brings nothing up try an online scan Norton Online Scanner. NOTE: It installs a few Active X things but nothing to worry about, try that only IF the S&D and AdAware scans bring nothing up.

Good Luck,
Moomoo

Edited by moomoo, 30 July 2006 - 08:44 AM.


#9 melon88

melon88
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:55 PM

Posted 02 August 2006 - 07:39 AM

Run both Adaware and Spybot Search and Destroy from safe mode, updating each program’s malware definitions before you scan and allowing both to fix what they find.

If you do not already have these freeware aps installed on your computer, you can get them at the following sites:

*AdAware SE: http://www.majorgeeks.com/download506.html

*Spybot S&D: http://www.safer-networking.org/en/index.html

Following that that I suggest you post a “HijackThis” log for expert assistance with your malware infection.

Read the pinned post in our “HijackThis” forum,
here
http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/
Carefully read and follow all directions explicitly.

Following instructions create a HJT log, and POST THE HJT LOG YOU CREATED IN OUR HJT FORUM – not in this forum,
at this link.
http://www.bleepingcomputer.com/forums/posthjtlog.html
Include the specs for your computer (ie, processor, amount of RAM, brand or motherboard, etc, and briefly describe the problem you are experiencing.)

Unless you are expert at editing the registry, Do not use the Hijack This program to try to fix anything by yourself as even what may seem to be a small mistake can render your operating system inoperable.
Some files when in the correct folder for them may be fine while in another may be malware hiding.


A member of our expert HJT Team will analyze your log, make recommendations and offer assistance, walking you through the complete repair process.

It may take a period of time to get a response to the log you posted because the members of our HJT Team are kept very busy.
Please be patient as this team is manned by volunteers. They will help you in order received as soon as possible.

NOTE
Once you have posted your HJT log, please DO NOT make any additional posts in the HJT forum thread you created until you get a response from a member of our HJT expert team, and do not make any changes to your system (changes, including any attempted repairs, will make your computer to be different than displayed in the log you posted and therefore make your log inaccurate).

The first criteria the HJT Team has when looking for logs that need replies are posts showing 0 replies. If you make an additional post, it will show as having 1 reply.
A team member, looking for a new log that requires help might well assume another HJT Team member is already assisting you and might not open the thread to respond.

So, post your HJT Log in our HJT Forum (not here in this forum) and wait for a response from a HJT team member.

Sorry it's taken so long to reply I've been gone a few days. I have run SpyBot and ADAware and they found nothing, I will post the log. Thanks

#10 melon88

melon88
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:55 PM

Posted 02 August 2006 - 07:42 AM

Thanks for responding. Have you notified the school? Before doing that though I would use another computer-neighbor's, library--and confirm that the link on the site you use to link from is taking you to the porn site or not. If the same link takes you to the school site on another computer, then you need to do some serious searching for malware.


Yea, we talked to a friend on the school board as soon as we discovered it and check with several neighbors and they are not experiencing the same problem. So I will keep looking for the culprit on my network!

#11 melon88

melon88
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:55 PM

Posted 02 August 2006 - 07:45 AM

Yea thats happened to a few sites before sites get linked to each other some how, for example, my friend used msn dollies and when she typed in the adress it brought up a horror site or something...butt run those scans and see what it brings up, and do what buddy said, check it on your neighbours computer, if the same thing comes up notify the school and we'll no its not a malware problem, if it doesent come up on your neighbours, scan for malware and if THAT brings nothing up try an online scan Norton Online Scanner. NOTE: It installs a few Active X things but nothing to worry about, try that only IF the S&D and AdAware scans bring nothing up.

Good Luck,
Moomoo


Thanks for the reply, We are the only ones I could find that are having this occur. Ran both the scans they turned up nothing. I will try the Norton scan and keep on looking.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users