My IE search page got jacked...how do I fix it?

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Yo Adrian
    Confirmed User
    • Apr 2002
    • 6326

    #1

    My IE search page got jacked...how do I fix it?

    Are there any scripts floating around to correct this? I've tried ad aware, norton and have adjusted the settings in IE...nothing works..

    how do I set my search page back to default?
    Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.
  • lil2rich4u2
    ICQ: 175171926
    • Oct 2002
    • 11046

    #2
    tools>>internet options

    ?
    HEY!!

    Unbeatable hosting! Customer service is top notch!

    --> ISPrime <-- Do a search on any board, their reputation is rock solid .. for years!!

    Comment

    • Ross
      Ik ben een aap
      • Sep 2002
      • 18874

      #3
      Mines fucked up earlier. I turned on my home pc and the fucking browser was just going crazy! It was going through lots of error pages fast as fuck and wouldn't stop!

      Comment

      • Yo Adrian
        Confirmed User
        • Apr 2002
        • 6326

        #4
        naw, that's setting your homepage..

        this is my search page.. fx if I type in a url that doesn't exist..

        what my pc has on it is bad though.. if I leave out the 'www.' it goes to this affiliate directory.. same if I leave off the 'http://'
        Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.

        Comment

        • Hue G. Pness
          Confirmed User
          • Jun 2003
          • 1237

          #5
          I had one a few weeks ago that Adaware and that Spybot thing would not get rid of. My home page was stuck on some really shitty search page. It was really pissing me off. I can't remember the domain that it was set to but anyway I did a search on google for removing what ever the domain was and found a download some dude made just to get rid of this specific problem and it worked like a champ. So maybe try doing a search like that.
          GFY Voice of Reason

          Comment

          • Yo Adrian
            Confirmed User
            • Apr 2002
            • 6326

            #6
            I'm always sent to http://www.gandi.net/error.html?url=gandi.net
            Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.

            Comment

            • gaymale
              Confirmed User
              • Sep 2003
              • 234

              #7
              If this is the script that also modifies your homepage to use global-finder.com all you can do is run your virus scan and manually remove all the values with the default page settings in your registry. I had this last week and had to modify every occurance of http: //%in my registry to get rid of it.
              Submit your website at: and

              Comment

              • msg
                Confirmed User
                • Mar 2002
                • 293

                #8
                http://www.lavasoftusa.com/software/adaware

                easily fixable -- download the free version, you will be amazed how much spybot crap it finds on your pc

                Comment

                • bigdog
                  Confirmed User
                  • Jul 2001
                  • 6964

                  #9
                  don't use IE when surfring only on sites you trust

                  Comment

                  • Yo Adrian
                    Confirmed User
                    • Apr 2002
                    • 6326

                    #10
                    Originally posted by msg
                    http://www.lavasoftusa.com/software/adaware

                    easily fixable -- download the free version, you will be amazed how much spybot crap it finds on your pc
                    Already tried that
                    Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.

                    Comment

                    • Yo Adrian
                      Confirmed User
                      • Apr 2002
                      • 6326

                      #11
                      Originally posted by bigdog
                      don't use IE when surfring only on sites you trust
                      sure, NOW you tell me ;)
                      Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.

                      Comment

                      • GrimShawn
                        Confirmed User
                        • Oct 2002
                        • 8120

                        #12
                        You're going to need a new computer

                        Comment

                        • Yo Adrian
                          Confirmed User
                          • Apr 2002
                          • 6326

                          #13
                          Originally posted by GrimShawn
                          You're going to need a new computer
                          I knew it..
                          Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.

                          Comment

                          • (¤¤)»»»»»»Þ
                            So Fucking Banned
                            • Sep 2003
                            • 237

                            #14
                            get a program called CWSHREDDER that should change the registry settings i think , if not just do a search on google for the registry keys needed to change the search page.

                            Comment

                            • (¤¤)»»»»»»Þ
                              So Fucking Banned
                              • Sep 2003
                              • 237

                              #15
                              I found a good link for you ..

                              http://www.pcworld.com/howto/article/0,aid,18222,00.asp

                              this will tell you the registry keys to change

                              Its a little old but should be in the same places

                              System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
                              Value Name: Search Bar
                              Data Type: REG_SZ (String Value)
                              Value Data: Search URL

                              HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

                              HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main



                              In both of these keys, you should find two value entries like this:

                              Search Bar = http://home.microsoft.com/search/search.asp

                              Search Page = http://home.microsoft.com/access/allinone.asp
                              Last edited by (¤¤)»»»»»»Þ; 09-24-2003, 01:16 PM.

                              Comment

                              • Yo Adrian
                                Confirmed User
                                • Apr 2002
                                • 6326

                                #16
                                Originally posted by (¤¤)»»»»»»Þ
                                I found a good link for you ..

                                http://www.pcworld.com/howto/article/0,aid,18222,00.asp

                                this will tell you the registry keys to change

                                Its a little old but should be in the same places

                                System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
                                Value Name: Search Bar
                                Data Type: REG_SZ (String Value)
                                Value Data: Search URL

                                HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

                                HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main



                                In both of these keys, you should find two value entries like this:

                                Search Bar = http://home.microsoft.com/search/search.asp

                                Search Page = http://home.microsoft.com/access/allinone.asp

                                Thanks (¤¤)»»»»»»Þ

                                ...however I already tried this
                                Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.

                                Comment

                                • (¤¤)»»»»»»Þ
                                  So Fucking Banned
                                  • Sep 2003
                                  • 237

                                  #17
                                  Yes i just checked its all in the same place still , and theres alot of other goodies in there to change as well , dont get to carried away unless you backup your registry first

                                  Comment

                                  • (¤¤)»»»»»»Þ
                                    So Fucking Banned
                                    • Sep 2003
                                    • 237

                                    #18
                                    What does it say under your registry search page ?? Or does it keep changing everytime you restart. ?

                                    And did you change the values under BOTH registry sections ..?

                                    Comment

                                    • (¤¤)»»»»»»Þ
                                      So Fucking Banned
                                      • Sep 2003
                                      • 237

                                      #19
                                      Originally posted by Yo Adrian
                                      naw, that's setting your homepage..

                                      this is my search page.. fx if I type in a url that doesn't exist..

                                      what my pc has on it is bad though.. if I leave out the 'www.' it goes to this affiliate directory.. same if I leave off the 'http://'
                                      You have one of the CWS trojans go download CWSHREDDER and get rid of it ..

                                      BTW verisign has now taken all the unowned domains and forward them to their own search page . So when you type in www.thisdoesntexistverisignsucks.com it will display verisign's search engine

                                      Comment

                                      • Yo Adrian
                                        Confirmed User
                                        • Apr 2002
                                        • 6326

                                        #20
                                        It shows

                                        http://auto.search.msn.com:3128@%61%...%6D/search.htm

                                        but doesn't go to that.. always goes to gandi.net
                                        Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.

                                        Comment

                                        • (¤¤)»»»»»»Þ
                                          So Fucking Banned
                                          • Sep 2003
                                          • 237

                                          #21
                                          Originally posted by Yo Adrian
                                          It shows

                                          http://auto.search.msn.com:3128@%61%...%6D/search.htm

                                          but doesn't go to that.. always goes to gandi.net
                                          Yes actually it does look closely at that url

                                          Its a trick url the username is auto.search.msn.com
                                          the password is 3128 @ the hidden url

                                          Its a common trick , you cant have an @ symbol in a domain url , like i can make the same url go to your website

                                          http://auto.search.msn.com:[email protected] and it will go to your site if it isnt password protected

                                          Its actually sending you to ARHEO.com wich send you to gandi.net
                                          Last edited by (¤¤)»»»»»»Þ; 09-24-2003, 01:30 PM.

                                          Comment

                                          • TheJimmy
                                            ICQ- five seven 0 2 5 5 0
                                            • Jan 2001
                                            • 10747

                                            #22
                                            Originally posted by bigdog
                                            don't use IE when surfring only on sites you trust

                                            http://channels.netscape.com/ns/browsers/download.jsp



                                            Investor with 5m - 15m USD to invest. Do you have a site or network of sites earning 50k - 200k a month income? Email your contact and preliminary data to: domain.cashventures (at) gmail.com....Please...no tire kickers...serious offers and inquiries only.

                                            Comment

                                            • (¤¤)»»»»»»Þ
                                              So Fucking Banned
                                              • Sep 2003
                                              • 237

                                              #23
                                              Scroll your mouse over the link you posted adrian above and look in the bottom of the browser to see what it says ..

                                              Just replace the url in your registry with the real search url

                                              http://auto.search.msn.com:3128@%61%72%68%65%6f%2e%63%6f% 6d/search.htm

                                              Is the same thing as

                                              http://auto.search.msn.com:[email protected]/search.htm

                                              wich is the same thing as

                                              http://arheo.com/search.htm

                                              wich is the same thing as

                                              gandi.net i presume



                                              they just use the symbols to trick you ..



                                              Just replace that url you posted in your registry with the following url

                                              http://auto.search.msn.com ( it think )
                                              Last edited by (¤¤)»»»»»»Þ; 09-24-2003, 01:35 PM.

                                              Comment

                                              • (¤¤)»»»»»»Þ
                                                So Fucking Banned
                                                • Sep 2003
                                                • 237

                                                #24
                                                JS.Fornight i think is the virus / trojan you have ..

                                                You may have got it from

                                                http://www.pixpox.com/

                                                or

                                                http://www.mursemania.com/

                                                or you may have noticed those urls in your favourites ..

                                                Comment

                                                • (¤¤)»»»»»»Þ
                                                  So Fucking Banned
                                                  • Sep 2003
                                                  • 237

                                                  #25
                                                  I wouldnt send out any emails for a while from what i read about what you have it looks like it attaches itself to your sig file in your emails even if you dont have a sig file. So make sure your clean before you send out any emails

                                                  Comment

                                                  • Thrawn$
                                                    Confirmed User
                                                    • Apr 2002
                                                    • 4596

                                                    #26
                                                    mine got highjacked by this http://search-itnow.com/index.php?nr=1

                                                    Tracking 202 | Start Tracking PPC Campaigns Like A Pro

                                                    Comment

                                                    • SixNine
                                                      Confirmed User
                                                      • Jan 2001
                                                      • 1357

                                                      #27
                                                      Some one hacked your PC and modified your host file to point to their IP's to fix it go to c:\windows\system32\etc\host and delete all the IP's with web search domains after them.

                                                      You owe me a drink some day.

                                                      SixNine

                                                      Comment

                                                      • (¤¤)»»»»»»Þ
                                                        So Fucking Banned
                                                        • Sep 2003
                                                        • 237

                                                        #28
                                                        Originally posted by SixNine
                                                        Some one hacked your PC and modified your host file to point to their IP's to fix it go to c:\windows\system32\etc\host and delete all the IP's with web search domains after them.

                                                        You owe me a drink some day.

                                                        SixNine
                                                        Maybe if you were right but your ALL WRONG thats not whats happening here he posted the url its a TRICK url in his registry that is ACTUALLY going to ARHEO.com and that is going to gandi.net go look for yourself ... Go look at the url that he posted that he found in his registry , its a TRICK url put your mouse over it , it looks like msn search but look in the browser bar on the bottom , its ARHEO.COM !!!

                                                        Nobody hacked your pc , chances are its a simple js trick no worries just change the url in your registry like i said and get yourself clean..


                                                        This is the url he found in his registry

                                                        http://auto.search.msn.com:3128@%61%...%6d/search.htm

                                                        put your mouse over it , its ARHEO.COM not msn , theres no HOSTS editing going on here just a simple trick url in his registry that looks like msn
                                                        Last edited by (¤¤)»»»»»»Þ; 09-24-2003, 01:53 PM.

                                                        Comment

                                                        • Yo Adrian
                                                          Confirmed User
                                                          • Apr 2002
                                                          • 6326

                                                          #29
                                                          Originally posted by (¤¤)»»»»»»Þ
                                                          Scroll your mouse over the link you posted adrian above and look in the bottom of the browser to see what it says ..

                                                          Just replace the url in your registry with the real search url

                                                          http://auto.search.msn.com:3128@%61%...%6d/search.htm

                                                          Is the same thing as

                                                          http://auto.search.msn.com:[email protected]/search.htm

                                                          wich is the same thing as

                                                          http://arheo.com/search.htm

                                                          wich is the same thing as

                                                          gandi.net i presume



                                                          they just use the symbols to trick you ..



                                                          Just replace that url you posted in your registry with the following url

                                                          http://auto.search.msn.com ( it think )
                                                          Thanks for the info on the @ trick.. I notice that now

                                                          I went ahead and changed all instances of that to google, rebooted.. still getting redirectd to gandi.net

                                                          I searched the registry for arheo.com but it couldn't find it
                                                          Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.

                                                          Comment

                                                          • Yo Adrian
                                                            Confirmed User
                                                            • Apr 2002
                                                            • 6326

                                                            #30
                                                            Originally posted by Thrawn$
                                                            mine got highjacked by this http://search-itnow.com/index.php?nr=1

                                                            Yep, my home pc got hijacked by that same domain
                                                            Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.

                                                            Comment

                                                            • Yo Adrian
                                                              Confirmed User
                                                              • Apr 2002
                                                              • 6326

                                                              #31
                                                              Originally posted by (¤¤)»»»»»»Þ
                                                              JS.Fornight i think is the virus / trojan you have ..

                                                              You may have got it from

                                                              http://www.pixpox.com/

                                                              or

                                                              http://www.mursemania.com/

                                                              or you may have noticed those urls in your favourites ..
                                                              I've heard about fortnight..

                                                              I've updated my virus defs and ran a full scan but it didn't find anything

                                                              How would I check for this and get rid of it?
                                                              Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.

                                                              Comment

                                                              • (¤¤)»»»»»»Þ
                                                                So Fucking Banned
                                                                • Sep 2003
                                                                • 237

                                                                #32
                                                                Originally posted by Yo Adrian


                                                                Thanks for the info on the @ trick.. I notice that now

                                                                I went ahead and changed all instances of that to google, rebooted.. still getting redirectd to gandi.net

                                                                I searched the registry for arheo.com but it couldn't find it
                                                                It wont be under arheo.com it will be under

                                                                61%72%68%65%6f%2e%63%6f%6d < that basically means arheo.com.

                                                                or just search for msn maybe in your registry, OR you may have a hook that is rewriting your registry everytime , but usually when they do that you cant open your registry because they hide it on you.

                                                                Just make sure you change all the search things with @ symbols like that.

                                                                Ill look into finding a solution for you.

                                                                Comment

                                                                • Yo Adrian
                                                                  Confirmed User
                                                                  • Apr 2002
                                                                  • 6326

                                                                  #33
                                                                  Thanks, I'll try that now
                                                                  Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.

                                                                  Comment

                                                                  • (¤¤)»»»»»»Þ
                                                                    So Fucking Banned
                                                                    • Sep 2003
                                                                    • 237

                                                                    #34
                                                                    I looked around and couldnt find much more to help you so far , but ill keep looking and post anything i find in here ..

                                                                    BTW its always good to look in your hosts file and make sure there isnt any redirecting going on at the same time , because sometimes you get hit with one thing you also get ht with something else..

                                                                    Also do the obvious checks to make sure there isnt any Programs or processes that are running in the background

                                                                    and do a free online scan at www.antivirus.com just to make sure . Dont askl me why but i have seen computers with FULL PAID NORTONS with FULL UPGRADED def files STILL miss lots of virii, not only that , but miss obvious old virii like pe spaces or klez

                                                                    Comment

                                                                    • Yo Adrian
                                                                      Confirmed User
                                                                      • Apr 2002
                                                                      • 6326

                                                                      #35
                                                                      Originally posted by (¤¤)»»»»»»Þ
                                                                      I looked around and couldnt find much more to help you so far , but ill keep looking and post anything i find in here ..

                                                                      BTW its always good to look in your hosts file and make sure there isnt any redirecting going on at the same time , because sometimes you get hit with one thing you also get ht with something else..

                                                                      Also do the obvious checks to make sure there isnt any Programs or processes that are running in the background

                                                                      and do a free online scan at www.antivirus.com just to make sure . Dont askl me why but i have seen computers with FULL PAID NORTONS with FULL UPGRADED def files STILL miss lots of virii, not only that , but miss obvious old virii like pe spaces or klez
                                                                      IT WORKED!!!!

                                                                      You're a genius bro, thanks!!

                                                                      I searched for 61%72%68%65%6f%2e%63%6f%6d several times throughout my registry and changed every one to google except for one to www., which was my Default Prefix... it also had been altered to go to arheo..

                                                                      Adult SEO Partners - Full service Adult SEO Agency serving some of the biggest names in the industry.

                                                                      Comment

                                                                      • AllisonWonderland
                                                                        Confirmed User
                                                                        • Mar 2002
                                                                        • 248

                                                                        #36
                                                                        I was hoping you were talking about the new "feature" on MSN.com that makes anything you type in the address bar, or in the Google toolbar jump to the assinine MSN "search the web" bar. Then it gives you some dumbass MSN search results page with pop-ups. You have to click 2-3 times in the box you want to use to keep your input from jumping. I emailed MSN and got an auto-reply thanking me for using MSN

                                                                        Comment

                                                                        • (¤¤)»»»»»»Þ
                                                                          So Fucking Banned
                                                                          • Sep 2003
                                                                          • 237

                                                                          #37
                                                                          Originally posted by AllisonWonderland
                                                                          I was hoping you were talking about the new "feature" on MSN.com that makes anything you type in the address bar, or in the Google toolbar jump to the assinine MSN "search the web" bar. Then it gives you some dumbass MSN search results page with pop-ups. You have to click 2-3 times in the box you want to use to keep your input from jumping. I emailed MSN and got an auto-reply thanking me for using MSN
                                                                          That doesnt sound like msn to me that sounds like a TRICK msn maybe , you might have something in your HOSTS file, check windows | system32 | drivers | hosts file for anything strange ..

                                                                          And yo adrian .. good to hear your fixed

                                                                          Comment

                                                                          • bigdog
                                                                            Confirmed User
                                                                            • Jul 2001
                                                                            • 6964

                                                                            #38
                                                                            Originally posted by Thrawn$
                                                                            mine got highjacked by this http://search-itnow.com/index.php?nr=1

                                                                            that is cecash's site. I think they only way you get that is if you download their toolbar

                                                                            Comment

                                                                            • cold_ice
                                                                              Confirmed User
                                                                              • Jun 2002
                                                                              • 3027

                                                                              #39
                                                                              I used search and destroy when it happened to me

                                                                              Comment

                                                                              • SixNine
                                                                                Confirmed User
                                                                                • Jan 2001
                                                                                • 1357

                                                                                #40
                                                                                Originally posted by (¤¤)»»»»»»Þ


                                                                                It wont be under arheo.com it will be under

                                                                                61%72%68%65%6f%2e%63%6f%6d < that basically means arheo.com.

                                                                                or just search for msn maybe in your registry, OR you may have a hook that is rewriting your registry everytime , but usually when they do that you cant open your registry because they hide it on you.

                                                                                Just make sure you change all the search things with @ symbols like that.

                                                                                Ill look into finding a solution for you.
                                                                                I hate when I'm cocky and wrong Maybe my post will help someone searching GFY some day since the scenario I described the fix for did happen to me.

                                                                                Comment

                                                                                • (¤¤)»»»»»»Þ
                                                                                  So Fucking Banned
                                                                                  • Sep 2003
                                                                                  • 237

                                                                                  #41
                                                                                  Originally posted by SixNine


                                                                                  I hate when I'm cocky and wrong Maybe my post will help someone searching GFY some day since the scenario I described the fix for did happen to me.
                                                                                  heh , yah dont worry the same thing you described has happened to me also ( the hosts file being changed ) and thats what i originally thought was the problem but then i noticed the trick url

                                                                                  Its a good thing he pasted the url from the registry or it would have been confusing figuring out the problem because he would have assumed his registry was fine and that it must be something else doing the switcheroo..

                                                                                  Comment

                                                                                  • GeorgeTH
                                                                                    Confirmed User
                                                                                    • Jul 2002
                                                                                    • 367

                                                                                    #42
                                                                                    I battled the problem for almost 2 weeks: start up re-directed to global-finder or other search pages, and a pop-up on all pages with sextracker counter! AdAware and SpyBot removed it for a session, and then it was back - I finally found this little tool and everythings's clean:
                                                                                    http://www.spywareinfo.com/~merijn/cwschronicles.html
                                                                                    Spam me with design ideas for my signature - LOL!

                                                                                    Comment

                                                                                    • (¤¤)»»»»»»Þ
                                                                                      So Fucking Banned
                                                                                      • Sep 2003
                                                                                      • 237

                                                                                      #43
                                                                                      Those search pages coming up is different than what he was talking about , and he already got it fixed.

                                                                                      He was reffering to the actual search button or your default search device not the home page..

                                                                                      Sometimes you have BOTH problems at the same time , for that you would want to use the link mentioned above.

                                                                                      Its nice to let a program do the fixing for you , but its even nicer , when you know A ) what you are fixing B ) how to fix it yourself.

                                                                                      When these types of problems popup in the future you can eliminate them by hand yourself.

                                                                                      You obviously cant always do all of it , but its nice to know what your doing

                                                                                      Comment

                                                                                      • swami
                                                                                        Confirmed User
                                                                                        • Aug 2003
                                                                                        • 1989

                                                                                        #44
                                                                                        (¤¤)»»»»»»Þ
                                                                                        That was a nice piece of work. Your a genius for sure and I hope you are making good money out of this game.This thread was more exciting than most of the spammers paysites thats for sure.

                                                                                        Comment

                                                                                        • AlienQ - BANNED FOR LIFE
                                                                                          best designer on GFY
                                                                                          • Mar 2003
                                                                                          • 30307

                                                                                          #45
                                                                                          Get a glass of water. Put your face close to the monitor.

                                                                                          Pour the water over the top your monitor.

                                                                                          Wait 10 minutes.

                                                                                          Comment

                                                                                          Working...