My IE search page got jacked...how do I fix it?
 

Are there any scripts floating around to correct this? I've tried ad aware, norton and have adjusted the settings in IE...nothing works..

how do I set my search page back to default?

tools>>internet options

?

Mines fucked up earlier. I turned on my home pc and the fucking browser was just going crazy! It was going through lots of error pages fast as fuck and wouldn't stop!

naw, that's setting your homepage..

this is my search page.. fx if I type in a url that doesn't exist..

what my pc has on it is bad though.. if I leave out the 'www.' it goes to this affiliate directory.. same if I leave off the 'http://'

I had one a few weeks ago that Adaware and that Spybot thing would not get rid of. My home page was stuck on some really shitty search page. It was really pissing me off. I can't remember the domain that it was set to but anyway I did a search on google for removing what ever the domain was and found a download some dude made just to get rid of this specific problem and it worked like a champ. So maybe try doing a search like that.

I'm always sent to http://www.gandi.net/error.html?url=gandi.net

If this is the script that also modifies your homepage to use global-finder.com all you can do is run your virus scan and manually remove all the values with the default page settings in your registry. I had this last week and had to modify every occurance of http: //%in my registry to get rid of it.

http://www.lavasoftusa.com/software/adaware

easily fixable -- download the free version, you will be amazed how much spybot crap it finds on your pc

don't use IE when surfring only on sites you trust

Already tried that

sure, NOW you tell me ;)

You're going to need a new computer

:( I knew it..

get a program called CWSHREDDER that should change the registry settings i think , if not just do a search on google for the registry keys needed to change the search page.

I found a good link for you ..

http://www.pcworld.com/howto/article/0,aid,18222,00.asp

this will tell you the registry keys to change

Its a little old but should be in the same places

System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
Value Name: Search Bar
Data Type: REG_SZ (String Value)
Value Data: Search URL

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main



In both of these keys, you should find two value entries like this:

Search Bar = http://home.microsoft.com/search/search.asp

Search Page = http://home.microsoft.com/access/allinone.asp

Thanks (¤¤)»»»»»»Þ :thumbsup

...however I already tried this :(

Yes i just checked its all in the same place still , and theres alot of other goodies in there to change as well , dont get to carried away unless you backup your registry first :)

What does it say under your registry search page ?? Or does it keep changing everytime you restart. ?

And did you change the values under BOTH registry sections ..?

You have one of the CWS trojans go download CWSHREDDER and get rid of it ..

BTW verisign has now taken all the unowned domains and forward them to their own search page . So when you type in www.thisdoesntexistverisignsucks.com it will display verisign's search engine :)

It shows

http://auto.search.msn.com:3128@%61%... 6D/search.htm

but doesn't go to that.. always goes to gandi.net

Yes actually it does look closely at that url

Its a trick url the username is auto.search.msn.com
the password is 3128 @ the hidden url

Its a common trick , you cant have an @ symbol in a domain url :) , like i can make the same url go to your website

http://auto.search.msn.com:[email protected] and it will go to your site if it isnt password protected :)

Its actually sending you to ARHEO.com wich send you to gandi.net

http://channels.netscape.com/ns/browsers/download.jsp



:thumbsup :thumbsup

Scroll your mouse over the link you posted adrian above and look in the bottom of the browser to see what it says :)..

Just replace the url in your registry with the real search url

http://auto.search.msn.com:3128@%61%72%68%65%6f%2e%63%6f% 6d/search.htm

Is the same thing as

http://auto.search.msn.com:[email protected]/search.htm

wich is the same thing as

http://arheo.com/search.htm

wich is the same thing as

gandi.net i presume :)



they just use the symbols to trick you ..



Just replace that url you posted in your registry with the following url

http://auto.search.msn.com ( it think )

JS.Fornight i think is the virus / trojan you have ..

You may have got it from

http://www.pixpox.com/

or

http://www.mursemania.com/

or you may have noticed those urls in your favourites ..

I wouldnt send out any emails for a while from what i read about what you have it looks like it attaches itself to your sig file in your emails even if you dont have a sig file. So make sure your clean before you send out any emails :)

mine got highjacked by this http://search-itnow.com/index.php?nr=1

:(

Some one hacked your PC and modified your host file to point to their IP's to fix it go to c:\windows\system32\etc\host and delete all the IP's with web search domains after them.

You owe me a drink some day.

SixNine

Maybe if you were right but your ALL WRONG thats not whats happening here he posted the url its a TRICK url in his registry that is ACTUALLY going to ARHEO.com and that is going to gandi.net go look for yourself ... Go look at the url that he posted that he found in his registry , its a TRICK url put your mouse over it , it looks like msn search but look in the browser bar on the bottom , its ARHEO.COM !!!

Nobody hacked your pc , chances are its a simple js trick no worries just change the url in your registry like i said and get yourself clean..


This is the url he found in his registry

http://auto.search.msn.com:3128@%61%... 6d/search.htm

put your mouse over it , its ARHEO.COM not msn , theres no HOSTS editing going on here just a simple trick url in his registry that looks like msn

Thanks for the info on the @ trick.. I notice that now :)

I went ahead and changed all instances of that to google, rebooted.. still getting redirectd to gandi.net

I searched the registry for arheo.com but it couldn't find it

Yep, my home pc got hijacked by that same domain

I've heard about fortnight..

I've updated my virus defs and ran a full scan but it didn't find anything

How would I check for this and get rid of it?

It wont be under arheo.com it will be under

61%72%68%65%6f%2e%63%6f%6d < that basically means arheo.com.

or just search for msn maybe in your registry, OR you may have a hook that is rewriting your registry everytime , but usually when they do that you cant open your registry because they hide it on you.

Just make sure you change all the search things with @ symbols like that.

Ill look into finding a solution for you.

Thanks, I'll try that now :thumbsup

I looked around and couldnt find much more to help you so far , but ill keep looking and post anything i find in here ..

BTW its always good to look in your hosts file and make sure there isnt any redirecting going on at the same time , because sometimes you get hit with one thing you also get ht with something else..

Also do the obvious checks to make sure there isnt any Programs or processes that are running in the background

and do a free online scan at www.antivirus.com just to make sure . Dont askl me why but i have seen computers with FULL PAID NORTONS with FULL UPGRADED def files STILL miss lots of virii, not only that , but miss obvious old virii like pe spaces or klez

IT WORKED!!!!

You're a genius bro, thanks!!

I searched for 61%72%68%65%6f%2e%63%6f%6d several times throughout my registry and changed every one to google except for one to www., which was my Default Prefix... it also had been altered to go to arheo..

:thumbsup

I was hoping you were talking about the new "feature" on MSN.com that makes anything you type in the address bar, or in the Google toolbar jump to the assinine MSN "search the web" bar. Then it gives you some dumbass MSN search results page with pop-ups. You have to click 2-3 times in the box you want to use to keep your input from jumping. I emailed MSN and got an auto-reply thanking me for using MSN :feels-hot

That doesnt sound like msn to me that sounds like a TRICK msn maybe , you might have something in your HOSTS file, check windows | system32 | drivers | hosts file for anything strange ..

And yo adrian .. good to hear your fixed

that is cecash's site. I think they only way you get that is if you download their toolbar

I used search and destroy when it happened to me:2 cents:

I hate when I'm cocky and wrong :) Maybe my post will help someone searching GFY some day since the scenario I described the fix for did happen to me.

heh , yah dont worry the same thing you described has happened to me also ( the hosts file being changed ) and thats what i originally thought was the problem :) but then i noticed the trick url :)

Its a good thing he pasted the url from the registry or it would have been confusing figuring out the problem because he would have assumed his registry was fine :) and that it must be something else doing the switcheroo..

I battled the problem for almost 2 weeks: start up re-directed to global-finder or other search pages, and a pop-up on all pages with sextracker counter! AdAware and SpyBot removed it for a session, and then it was back - I finally found this little tool and everythings's clean:
http://www.spywareinfo.com/~merijn/cwschronicles.html :thumbsup

Those search pages coming up is different than what he was talking about , and he already got it fixed.

He was reffering to the actual search button or your default search device not the home page..

Sometimes you have BOTH problems at the same time , for that you would want to use the link mentioned above.

Its nice to let a program do the fixing for you , but its even nicer , when you know A ) what you are fixing B ) how to fix it yourself.

When these types of problems popup in the future you can eliminate them by hand yourself.

You obviously cant always do all of it , but its nice to know what your doing :)

(¤¤)»»»»»»Þ
That was a nice piece of work.:thumbsup Your a genius for sure and I hope you are making good money out of this game.This thread was more exciting than most of the spammers paysites thats for sure.

Get a glass of water. Put your face close to the monitor.

Pour the water over the top your monitor.

Wait 10 minutes.