| User | Post |
theclaw
Posts: 89/202 |
 It's still happening in IE (no other browser is affected). This isn't too serious, but how and why do such settings change on their own? No spyware or viruses are on the computer. It could be in my registry. The homepage problem is easy to fix, but just keeps coming back. Even upgrading to the new JVM and installing SP2 on Windows didn't help. Here's the name/path of two suspicious files.
C:\DOCUME~1\Rocket\LOCALS~1\Temp\sp.html (the page being loaded)
C:\WINDOWS\system32\jmhhmf.dll (mysterious BHO for IE, has a different name each time my homepage switches back to that one I took a picture of)
http://s1di.d8t.biz/index.php Ahha! This page is almost identical to what's causing my trouble. I found it by looking at the annoying homepage's source info. On the very bottom was an address which redirects itself to what I typed in bold. |
neotransotaku
Posts: 846/4016 |
I thought they released the a 5MB patch for their JVM? anyways, since I use sun's JVM, i won't be effected by any attacks on microsoft's VM (but my VM is updated anyways) |
Wyv
Posts: 70/87 |
All I know is that CWS exploits a bug in the XP Java Virtual Machine. |
neotransotaku
Posts: 839/4016 |
I wonder if this was a HOSTS problem. Because I recall I would get that CoolSearch page every time I try to go to angelfire, geocities, tripod, and places like that. I believe about:blank resolves to the self IP (127.0.0.1) and if 127.0.0.1 is hijacked, then it must be why it goes there. |
Ailure
Posts: 2766/11162 |
I detected this problem today, and the download Wyv provided with fixed it.
I don't use IE, my sister does thought. Something says that she wasn't careful when surfing. IE really have some security holes who needs to be fixed... or my IE using sister is just a big security hole...
It fixed it, thanks.  |
Wyv
Posts: 66/87 |
I just got rid of it on my Dad's computer. The Spyware that causes this problem is called CoolWebSearch. There's actually a utility designed to get rid of only CWS hijackings. It's listed below.
First, go to the Windows Update site and download the latest patches.
Second, go to Google and search for CWShredder. Download it.
Third, run the above program. Close all browser windows. Choose the update option first, then the fix option.
Fourth, empty your recycling bin. That's where CWShredder puts deleted crap.
Fifth, run IE. If the problem persists, repeat steps 3 and 4.
Sixth, if it still happens, I don't know what to tell you. It seemed to fix my Dad's laptop. |
Keitaro
Posts: 471/1342 |
this is the EXACT problem I have. and it keeps coming back  seriously. there needs to be a permanent solution |
Emptyeye
Posts: 283/2273 |
Chaosflare: That's because, last I knew, HijackThis did nothing to actually remove stuff unless you told it to (I know the other programs are like this too, but HijackThis is a little more crude in that there's no "delete everything found" option).
I'd recommend going to The Computer Cops board and showing them your HijackThis log, and see what they have to say about it. |
Sokarhacd
Posts: 292/1757 |
thats exactly what happened to me, I keep getting rid of it, and it comes back, as different things, hijackthis recognizes it, but it wont go away, or atleast not for very long, and adaware doesnt find it, neither does spybot... |
Spyware
Posts: 14/26 |
Blah this did happen to me a lot. its a brower hijack of somesort. The best way I found to get rid of it is download a program called AD-AWARE from lavasoft. its way better than spybot, and spyware blaster. Just run it it will find it delet it and all should be fine.
If you dont know the lavasoft site you can find the download Here in this thred |
goodall
Posts: 21/38 |
my browser does this alot, it seems to be as a result of spyware, i have no idea how to edit reg keys, is there another option? |
HyperLamer
Posts: 1057/8210 |
Well, that's officially the weirdest ad I have ever seen.  Does the URL bar actually say 'about:blank'? It could be using the non-printable character trick; look through the registry and HD for anything containing that, a strange ASCII character, an @ sign, and a URL of some sort. (Basically, in some cases it's possible to go to a site like www.site1.com[non-printable character]@www.site2.com, the URL bar will say www.site1.com but you'll be at www.site2.com instead.) |
theclaw
Posts: 83/202 |
Thanks! I guess the most popular programs can't track everything.
On second thought, it seems to come back after a while. Doesn't anybody recognize that page? There's got to be a permanent solution. |
Emptyeye
Posts: 258/2273 |
I presume your anti-spyware software is also up to date?
Hmm. I suppose the next step would be to get HijackThis! and see if it finds anything unusual. |
mvpo.geo
Posts: 37/48 |
Looks like you have some sort of hack into your comp. Its a registery key, just delete your home page registery key and it should stop the problem. If it doesn't then, ummmmm did you try to just go to internet options? |
theclaw
Posts: 82/202 |
Now this has got to be the strangest web browser-related problem I've ever seen. Here's a screenshot. http://img18.photobucket.com/albums/v54/theclaw/iehomewtf.jpg
It keeps resetting back to the above page no matter what's done. Don't go telling me to switch browsers, Firefox, Opera and a few others are installed on my computer. Scans with Spybot S&D, Norton Antivirus, and Ad-Aware reveal nothing. Windows is fully up-to-date with all it's service packs, etc. The problem started just an hour or 2 ago. Any idea on how to get rid of this bizarre issue? My next step is to try a firewall, unless WINXPPRO (what a nickname!) has one built-in.
FYI: this post is from Firefox. |
