Help - Search - Members - Calendar
Full Version: Hijacked Ie
Hydrogenaudio Forums > Misc. > Off-Topic
kwanbis
Somehow, as i dont use IE 99.99% of the time, it got some type of infaction, and now it adds http://9.18.96.53/64.233.161.147/ to the urls ... any idea?
Digga
QUOTE(kwanbis @ Feb 4 2005, 04:40 PM)
Somehow, as i dont use IE 99.99% of the time, it got some type of infaction, and now it adds [*url*] to the urls ... any idea?
not really... have you tried following the link? tongue.gif
I would start with running one or two spyware-removal-tools (e.g. Ad-Aware) and see if the url is listed.
Synthetic Soul
http://64.233.161.147 is www.google.com.

http://9.18.96.53 won't resolve.

I don't really understand what you mean by "and now it adds http://9.18.96.53/64.233.161.147/ to the urls".

Try going to "Tools" > "Internet Options..." and checking what the address is of your homepage (top text box on General tab). If this is where the change is try just setting it to "Use Blank", reboot, and see if it has reverted. I believe either Spybot or Ad-Aware will let you lock the home/search page in IE so malicious programs (which usually set themselves up in your registry to run at startup) can't change it.


Andavari
I did an ARIN WHOIS search, and it shows the IP address/range as being owned by IBM Corporation.

Like the others have said run Ad-Aware, and Spybot Search & Destroy to remove the hijack. Spybot Search & Destroy has a built in tool to lock the IE homepage, and it also has an IE browser helper object to protect it against spyware/malware. Unfortunately if you lock the IE homepage with Spybot S&D other spyware detectors may see it as being hijacked.

You may need to check the Windows HOSTS file too -- Ad-Aware, and Spybot S&D should scan it if configured to do so, but it wouldn't hurt to look to see if there's something in there along with the browser hijack.

After removing it, its a good ideal to install the freeware SpywareBlaster which can block alot of things so you'll never have the spyware/malware installed in the first place.
kwanbis
for example, if i type slashdot.org, it resolves to http://9.18.96.53/66.35.250.150/slashdot.org/
kwanbis
false alarm ... was something with the proxy
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2008 Invision Power Services, Inc.