Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

HIJACK! (No, not THAT kind!)
various | Today | Me

Posted on 06/05/2004 8:06:55 PM PDT by Long Cut

You may have heard of this lately, or perhaps have had it happen to you. That's right...your internet browser gets hijacked. Taken from your control, as it were.

It takes you to sites you would never have visited in a million years; your computer slows down and maybe crashes; your homepage is mysteriously changed; you now have about a dozen "favorites" that you never selected and don't want.

You've been HIJACKED!

What happened? How? You ask, as you pull your hair out in disgust.

Well, it happened to me,, and some FReepers I know, and a LOT of my friends, lately. I've been hearing scuttlebutt around the Web, and around the water cooler. People's computers are being taken over by insidious, rotten spyware and malware that effectively seizes control and can have serious reperussions for the user.

These things download some particularly nasty porn, even child porn, to a computer. People have been fired, investigated, and disgraced for something they never did.

I discovered mine one day whil, of all things, trying to access FR. I mistyped the URL, and found myself redirected to some porn search engine. Massive popups overwhelmed my Pop-up Stopper, and froze my computer.

After the reboot, I ran my McAffie antivirus, which quickly crashed the system and failed to ever work again. Ad-Aware removed some registry keys and values, and I thought all was well.

Wrong. It happened again.

Now, I got serious. I obtained Symantec Pro version, and ran it. It caught several more bugs, but some couldn't be quarantined OR removed.

I was in a fix. I was using a computer that FReeper thumperusn had graciously loaned me, and I didn't want to give it back to him all jacked up. Thus began my battle with the Internet demon known as "CoolWebSearch".

I went to sites like Spywareguide.com, Spywareinfo.com,, and Symantec's excellent site, and educated myself about CWS. It's a mean one.

With over 25 versions to date, and about 30 affiliated sites, CWS has infected millions of computers to date. It uses a "hole" in JavaScript Virtual Machine to invade your machine and make changes to IE and your registry. It also copies itself to your "restore" files, which the antivirus and anti-spyware programs DO NOT search or modify.

After educating myself, and wading through literally hundreds of pages of "geek-speak", I formed a plan of attack.

PROTECTION

First, I would fix the holes in my system. The borrowed laptop used Windows Me, from 2000. It needed updating, and MS's website had a whole bunch of them. Since I'm on a dialup, it took hours to download and install all the patches.

Next, some firewalls. At Major Geeks.com, I found and downloaded Zone Alarm and Browser Hijack Blaster, both for free. Thus protected from further invasion, I set about curing the disease.

MEDICINE FOR A SICK COMPUTER

I first updated the Symantec to the latest standards. I then did the same with Ad-Aware, and downloaded Spybot Search&Destroy from Majorgeeks. It was about then I discovered that I was not alone.

I found Merjin.org, a website set up by a computer student with the sole purpose of combatting CWS. From there, I obtained the invaluable CWShredder, a program that can remove ANY CWS bugs, and which is updated frequently. I also got HiJackTHIS!, a program which can find and display anything that is downloaded to your computer, and remove it with a command.

So effective are these programs, CWS has recently conducted Denial Of Service attacks on Merjin.org. Thankfully, it has survived...it also contains detailed information about all the CWS variants, and manual removal procedures.

I was able to sweep my system clean of many more bugs. Unfortunately, I still wasn't done.

HEALING THE PATIENT

I was still getting some spyware from CWS, and some Browser Helper Objects (BHO's) were still turning up. Fortunately, due to Zone Alarm and Hijack Blaster, I was warned well in advance. However, I was suspicious as to how it was happening on a daily basis. Thus, I went even deeper.

I went to Symantec's website and downloaded detailed instructions for THOUROUGHLY cleaning your system. I had missed something important.

CWS also writes itself to your "restore" files. These are immune from the cleaning software. The cure for that was quite new for me, a relative computer novice. However, one learns by doing, so I plowed ahead.

I disabled the "restore" function (instructions from Symantec), and rebooted into "safe" mode(also on Symantec's instructions). I then ran all my cleaning and anti-virus/anti-spyware programs, deleting everything found.

Then, I went to the C://System/Restore files and deleted them all. If it affects the "restore" function adversly, I have not seen evidence of it yet.

I rebooted, performed a scandisk and a defrag, and rebooted again. Then I enabled the "restore" function once more.

That was yesterday, and so far, so good. I'd like to think I got it all, but with these bugs, you never know. Fortunately, I'm now forewarned and forearmed.


TOPICS: Crime/Corruption; Culture/Society; Miscellaneous; News/Current Events; Your Opinion/Questions
KEYWORDS: computers; coolwebsearch; hijack; hijackers; spyware; trojanhorses; virus; viruses; worm
Navigation: use the links below to view more comments.
first previous 1-2021-4041-6061-80 ... 181-192 next last
To: Long Cut

Just go to Mozilla.org and download Firebird (which might be Firefox now).

Great browser.


41 posted on 06/05/2004 8:38:08 PM PDT by freebilly (Vote Kerry-- 1 Billion Muslims Can't Be Wrong....)
[ Post Reply | Private Reply | To 33 | View Replies]

To: MTR

You took the word out of my mouth.


42 posted on 06/05/2004 8:38:09 PM PDT by Talking_Mouse (Indeed I tremble for my country when I reflect that God is just... Thomas Jefferson)
[ Post Reply | Private Reply | To 16 | View Replies]

To: mylife

How do you disable JavaScript? Will the computer continue to work correctly without it?


43 posted on 06/05/2004 8:38:17 PM PDT by Long Cut (Certainty of Death, small chance of Success...What are we waiting for?...Gimli the Dwarf)
[ Post Reply | Private Reply | To 19 | View Replies]

To: Long Cut
Spybot Search & Destroy is great. You can "Immunize" your system against known adware/spyware threats.

You can also have Spybot block registry changes. If a program tries to write to the registry, you're notified and can deny the action.

44 posted on 06/05/2004 8:40:31 PM PDT by FReepaholic (War On Terror: If not us, who? If not now, when?)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Long Cut

Im not sure how to do it yet(disable Javascript)

But I plan on finding out


45 posted on 06/05/2004 8:41:03 PM PDT by mylife (The roar of the masses could be farts)
[ Post Reply | Private Reply | To 43 | View Replies]

To: Fraulein; All
You're welcome. CoolWebSearch appeared last Summer in its nascent form, and has steadily increased in cleverness and deviousness. It now has infected millions of machines.

It is probably incalculable how many man-hours and $$$ are spent battling it, and the wreckage it can leave in lives is priceless.

46 posted on 06/05/2004 8:41:28 PM PDT by Long Cut (Certainty of Death, small chance of Success...What are we waiting for?...Gimli the Dwarf)
[ Post Reply | Private Reply | To 32 | View Replies]

To: Long Cut

AVG-Zone Alarm-Norton AV- Ad Aware are all free, get em , use em !.....:o)

http://www.jv16.org/

Get the reg cleaner at the link above and then go to google site and download the google tool bar w/ their pop up killer.

My Norton AV finds things that AVG doesn't and vis vis... also AVG and Ad-Aware have free updates.

Stay safe !


47 posted on 06/05/2004 8:43:32 PM PDT by Squantos (Be polite. Be professional. But, have a plan to kill everyone you meet.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Luis Gonzalez
No problem. I figured that LOTS of people on FR have had these issues, and that some might have even more info and advice.

Like I said, it's simply amazing that this hasn't broken in the media. They usually report any new virus long before it gets this far.

48 posted on 06/05/2004 8:45:24 PM PDT by Long Cut (Certainty of Death, small chance of Success...What are we waiting for?...Gimli the Dwarf)
[ Post Reply | Private Reply | To 38 | View Replies]

To: Long Cut
This is interesting... I haven't had known crashing kind of problems you have had, no ~known~ infection, but I always have several entries in my DNS cache (which I understand to be contacts from my computer to the internet) that are ~not~ places I have been to and have very insidious names. I can flush my DNS cache, but all these re-appear immediately without ~me~ doing anything. Note below that I flushed the cache and then immediately displayed again. I did nothing else, and refreshed no pages in between.

Copied from command line:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Default>ipconfig /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Documents and Settings\Default>ipconfig /displaydns

Windows IP Configuration

www.radiate.com


Record Name . . . . . : www.radiate.com
Record Type . . . . . : 1
Time To Live . . . . : 69418
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1


www.adserver.com


Record Name . . . . . : www.adserver.com
Record Type . . . . . : 1
Time To Live . . . . : 69418
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1


s12.sitemeter.com


Record Name . . . . . : s12.sitemeter.com
Record Type . . . . . : 1
Time To Live . . . . : 69418
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1


ads.x10.com


Record Name . . . . . : ads.x10.com
Record Type . . . . . : 1
Time To Live . . . . : 69418
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1


adres.internet.com


Record Name . . . . . : adres.internet.com
Record Type . . . . . : 1
Time To Live . . . . : 69418
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1


z0.extreme-dm.com


Record Name . . . . . : z0.extreme-dm.com
Record Type . . . . . : 1
Time To Live . . . . : 69418
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1


www.valuesponsor.com


Record Name . . . . . : www.valuesponsor.com
Record Type . . . . . : 1
Time To Live . . . . : 69418
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1


www.cash2002.de


Record Name . . . . . : www.cash2002.de
Record Type . . . . . : 1
Time To Live . . . . : 69418
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1


ads.tripod.com


Record Name . . . . . : ads.tripod.com
Record Type . . . . . : 1
Time To Live . . . . : 69418
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1


www.hit-parade.com


Record Name . . . . . : www.hit-parade.com
Record Type . . . . . : 1
Time To Live . . . . : 69418
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1


s0.bluestreak.com


Record Name . . . . . : s0.bluestreak.com
Record Type . . . . . : 1
Time To Live . . . . : 69418
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1


www.adultclicks.com


Record Name . . . . . : www.adultclicks.com
Record Type . . . . . : 1
Time To Live . . . . : 69418
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1


sextracker.com



C:\Documents and Settings\Default>

49 posted on 06/05/2004 8:46:16 PM PDT by HairOfTheDog (farewell to a great president.)
[ Post Reply | Private Reply | To 4 | View Replies]

To: Long Cut

I have this hijacker called ShopNav, can't get rid of the SOB.

That's my new project.


50 posted on 06/05/2004 8:46:53 PM PDT by Luis Gonzalez (Sin Pátria, pero sin amo.)
[ Post Reply | Private Reply | To 48 | View Replies]

To: mylife
How To Disable Javascript no matter what you're running. Beware, though - some sites require it.
51 posted on 06/05/2004 8:47:20 PM PDT by Billthedrill
[ Post Reply | Private Reply | To 45 | View Replies]

To: Long Cut

Ugh. I've been bit by one of these bugs. I ran CWS shredder and tracked down an executable that installed itself in the root directory. I deleted the executable, ran spybot, adaware and cleaned my system. I went through and reset some of the java options to prompt before performing a download and then downloaded Mozilla and Mozilla Firebird. I usually use Firebird except when a page uses a funky Java feature. Firebird doesn't allow much fancy Java stuff to work,but that's a good thing. I haven't had a single problem since.


52 posted on 06/05/2004 8:47:50 PM PDT by Brett66
[ Post Reply | Private Reply | To 1 | View Replies]

To: Squantos
Got and used 'em all, Squantos. They STILL didn't get everything.

These bugs are designed by people who know how we fight them in detail, and they are paid big $$$ to circumvent the defenses.

53 posted on 06/05/2004 8:47:50 PM PDT by Long Cut (Certainty of Death, small chance of Success...What are we waiting for?...Gimli the Dwarf)
[ Post Reply | Private Reply | To 47 | View Replies]

To: Long Cut


Here's my thought on replacing IE.

Download http://www.mozilla.org/products/firefox/

It's not a perfect replacement. If something doesn't format properly or doesn't play right using firefox, just open IE and do it.

Yes, I understand it's a pain in the ass.

It is however how us folks who wish to avoid nonsense do it.

My next suggestion is to get admuncher. Admuncher is a layer 3 program. What's a layer 3? Well, that's a program that essentially filters everything laying over the tcpip stack.

Firefox will remove just about everything, but if you get admuncher, you're going to get all the ads removed as well.

It's like surfing the net was 7 years ago. Pleasant :)

-Mal


54 posted on 06/05/2004 8:48:19 PM PDT by Malsua
[ Post Reply | Private Reply | To 33 | View Replies]

To: Long Cut

Zone alarm will walk ya through that process of turning off javascript etc if you want. After yer done scroll down on this site and use "shields up" and "leak test" to check yer system.......trust me .......:o)

Also look at blocking Windows media access to the net and windows messenger crap. " Kill the messenger" is also at the link below.

http://grc.com/default.htm

Stay safe !


55 posted on 06/05/2004 8:49:53 PM PDT by Squantos (Be polite. Be professional. But, have a plan to kill everyone you meet.)
[ Post Reply | Private Reply | To 43 | View Replies]

To: Long Cut

Thank you, Sir!
Great thread!
Thanks also, to all who posted!
Ms.B


56 posted on 06/05/2004 8:50:06 PM PDT by MS.BEHAVIN ("Great spirits have always encountered violent opposition from mediocre minds" Re-elct George W.Bush)
[ Post Reply | Private Reply | To 2 | View Replies]

To: Long Cut

Some great free products against spyware:

Spybot Search and Destroy
http://www.spybot.info


and

Spyware Blaster
http://www.javacoolsoftware.com/products.html

Spyware Guard
http://www.javacoolsoftware.com/spywareguard.html


57 posted on 06/05/2004 8:50:26 PM PDT by FairOpinion (If you are not voting for Bush, you are voting for the terrorists.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Billthedrill

Thanks Bill.

I have this bookmarked. I think I will just continiue to run firefox if it prevents a lot of the java problems as brett66 says


58 posted on 06/05/2004 8:51:30 PM PDT by mylife (The roar of the masses could be farts)
[ Post Reply | Private Reply | To 51 | View Replies]

To: Long Cut

See my post here:
http://www.freerepublic.com/focus/f-news/1080006/posts?page=84#84

Once your system is clean, this program will go along way towards keeping this junk off your computer. It will work on all Windows systems and with any browser. It will not work with Linux.


59 posted on 06/05/2004 8:51:32 PM PDT by No One Special
[ Post Reply | Private Reply | To 1 | View Replies]

To: Long Cut

Thanks! My problem was not nearly as serious as yours. about three months ago, I noticed that my homepage had changed and that my search engine had changed. Then, I saw that two new entries were entered in my favourites (nasty stuff that bucked my efforts to delete it). The home page and search page were not naughty, but they were not MY choice of pages. I would reset my preferences only to have them changed when I restarted my machine. Thanks for the info on CWShredder - it has cleaned the horrid CWS from my machine. CWS must have been made by a liberal - it forces you to endure something that you never wanted and makes a nuisance of itself.


60 posted on 06/05/2004 8:51:47 PM PDT by Army Air Corps (Ronald Reagan - The first anti-terror President.)
[ Post Reply | Private Reply | To 1 | View Replies]


Navigation: use the links below to view more comments.
first previous 1-2021-4041-6061-80 ... 181-192 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson