Browser Hijacking Tutorial
Give Me Back My Browser!!!
Help the Start Page on my browser has
changed!
Has this happened to you? Have no
fear, C3r3br0 is here.
There is a little something called browser hijacking that has
pervaded the Internet. Browser Hijacking is perpetrated by unscrupulous
website owners who change their visitors'
browser start page, search page, or favorites without
permission. This tutorial will go through some steps to
recover a hijacked browser.
If you're wondering what's the big deal, think of it this way.
What if radio stations were able to change your presets
without your permission. Still don't care? What if they got
paid to do it? Still don't care? [Don't really have any other reasons].
"Joy Rides". Not with my Browser!
There are those website owners that are trying to get some
extra hits to their sites so they change your settings in hopes
of getting that extra hit which they might get paid for at the
end of the month. I put these guys in the "joy ride" category.
They're not really trying secure your browser forever, just for
the hit. However, to those that do......IT'S STILL
WRONG!!!
Recovering your browser from these guys doesn't call for any
intrusive computing, just a click of the mouse.
NOTE: If possible, make a note of the website you
visited that changed your settings. It would be wise to create a Notepad
or Writepad document and type in the URL. This will be
needed in the bonus section.
Step 1 - Return to Me Start and Search Pages
Open up Internet Explorer and go to the tools heading and
click on Internet options. A window will appear and at the
top, below the menu tabs, is a home page section with the address of the page
that gets loaded when you start your browser.
You can set this to any page on the Internet. I use
Yahoo!Mail a lot so my start page is http://mail.yahoo.com
Now let's reset the search page. Click on the Menu Tab
labeled Programs. You should now see a button labeled
Reset Settings. Clicking this button and you will be
prompted whether or not to proceed. Notice that in the
bottom right-hand corner is a check box to reset the Start
Page as well. Now you have one-stop resetting!
Step 2 - Bookmark! Be gone!
Open up Internet Explorer and click on Favorites. Just
right-click on the bookmark and select delete. If there are
more than one you can click the Organize Favorites menu
item and do the deletions form there.
Now it's Time for the Grand Theft Auto Perps
These guys not only want your browser, but they don't want
to give it back. I gave an example about the radio presets
in the beginning of this page. Well, let's take it a step further.
Think about the most annoying, headache-producing music
you can think of, or Conan O'Brien's boy band 24x7. Now,
imagine that the radio station changes your presets so that
only that type of music is heard and you can't change the
presets back.
This is more intrusive than the above and involves editing
the registry. Follow the instructions below at your own risk.
Step 1 - I can't change it back!
If you find this to be the case then you may have to edit
your registry. This can be done by clicking the start button,
and then selecting Run. Next, type regedit and hit Enter.
Step 2 - Find the Start Page
The registry editor should appear. The registry is setup
like a regular directory with folders and files. The Start Page
is located in the following path:
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Main
Now locate Start Page entry in the right panel.
Double-click
on it and enter the Start Page of your choice. You can close
the registry editor now, or continue to the next step and reset your search
pages.
Step 3 - Don't Forget the Search Pages
The search Pages are also located in the same section they
are labeled:
You can change these entries just like the you did the
Start Page above. Now just close the registry Editor and your done.
There are still two more search keys that these perps might
have changed. The first is:
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\SearchURL
This value can be set with any of your favorite engines and
allows you to use the autosearch feature of Internet Explorer. Here are
some common values:
- http://www.METAcrawler.com/crawler?general=%s
- http://www.altavista.com/cgi-bin/query?q=%s
- http://hotbot.com/?MT=%s
- http://www.infoseek.com/Titles?qt=%s
- http://search.excite.com/search.gw?search=%s
- http://www.lycos.com/cgi-bin/pursuit?query=%s
- http://www.mckinley.com/searcher.cgi?query=%s
- http://askjeeves.com/AskJeeves.asp=%s
- http://search.yahoo.com/bin/search?p=%s
- http://www.goto.com/d/search/?type=topbar&Keywords=%s
- http://www.google.com/keyword/%s
The second is the SearchAssistant and the CustomizeSearch
values. Google is the search engine I use the most so my values for these
two are: http://www.google.com/ie. These are located in the following key:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
Explorer\Search
Step 4 - Set with a Click or Two
Now let's make this a little easier so that we don't have to
go through all the steps again. Download the following file: anti-jack.reg,
and either right-click on it and select edit, or
open it in WordPad or NotePad.
Notice the file has a .reg extension. This is
because this file
edits your windows registry. Also, the entries in the file are exactly the
ones we just changed. Edit the file to reflect your start and search pages
and if you ever need to revert back to them simply double-click on this file.
Step 5 - Favorites Tip
Open up the Find window from the desktop by pressing the F3
key at the top of the keyboard. Now type in Favorites and hit Enter.
Drag the Favorites folder to your desktop while holding down
the Alt key, located next to your space bar. When you're at your desktop let it
go.
Now you have a shortcut to your Favorites and can manage them
from the desktop. You can add delete and even change the long titles.
Step 6 - Bonus
So now everything is back to normal, but how will you keep it
this way? Well, if you use Internet Explorer there is an option called
"Security Zones". This option allows the user to setup a
"Restricted Sites" list which controls what a site can and can't do
when you visit it. The Restricted Sites list prevents those unscrupulous
sites from running their spyware, scumware, jackware.
If you've been to our Spyware
- Private Eyes Tutorial then you know about the hosts file and how to prevent ads by
redirecting the site to your own computer. The restricted sites list is
based off of the same list. The following steps enable the Security Zones
feature in Internet Explorer.
- Click
here to download the necessary files.
- Double-click on the ie-ads.reg file and click OK
to merge it with the registry.
- Open Internet Explorer and click the Tools menu and
then the Internet Options... sub-menu.
- Click on the Security tab at the top. Next click on
the Restricted Sites icon.
- The Security Level bar should be set to High.
- Now click OK and you're done.
Recommended Software:
Spyware
Prevent software
SpywareBlaster
- Prevent Spyware from ever being Installed!!
Doesn't scan and clean
for spyware, it PREVENTS
it from ever being installed.
By setting a "kill
bit" for spyware ActiveX controls, SpywareBlaster can
prevent the installation of any spyware ActiveX
controls from a webpage.
- You won't get any more
annoying "Yes/No" boxes popped up, asking
you to install a spyware.
- The newest
SpywareBlaster version can even block spyware/tracking
cookies!
- SpywareBlaster also
provides the exclusive System Snapshot! - Take a
snapshot of your computer in its clean state, and use
System Snapshot later to revert many changes made by
spyware and browser hijackers!
The SpywareBlaster
database contains information on known spyware Active-X
controls. Make sure you run the Check For Updates feature
frequently to get the latest database!
Brought you by Java
Cool software
For more details on usage visit: How
to Protect Yourself from Spyware
|
