MAC-NET

How to

Network Security

Do more with Firefox^NEW

Hijacked Browser Analysis

4-counter.com 3721

C2.lop browser hijacker

CWShredder

Edmond.exe

Intercom.exe Spyware

MWSOEMON.EXE - MyWebSearch

SearchPage CC Spyware

Spin4Dough Spyware

Sqwire.com home page hijack

Home » Spyware Protection »

Oh my gosh, my browser was hijacked !

It's a sad truth is there is no standard hijacking technique and there is no standard repair technique. If your browser has been hijacked, a significant chance exists that the repairs that worked for one might will not work for you. Here is one of the repair technique which you can use:

Download Stinger and scan your computer. The stinger software would be able to identify and remove newer common viruses. Restart the computer.
Use Control Panel > Add or remove programs, to remove any application software that you no longer use or those that you don't recognized.
Download CWShredder and proceed to fixing the typical components that might have stopped the computer from operating properly due to ad-wares or Trojans.
Download and run Microsoft Anti Spyware Software.
Download HijackThis and perform your scan and analysis. Click the save Log. Perform you analysis. Highlight the key and click "Info on select item..." button and study the prompt. Check the box to remove the offending key, click it and click the "Fix checked" button.

Here are examples of some of the approach used to fix broken browsers. You can use them to compare with your log.

[Hello,] 8-Sep-2005

Logfile of HijackThis v1.99.1 - mgolab 17-Jun-2005

Logfile of HijackThis v1.99.1 - jbmac 6-Jun-2005

Logfile of HijackThis v1.97.7 - cjtf 6-Jun-2005

Logfile of HijackThis v1.99.1 - Sealy 6-Jun-2005

Logfile of HijackThis v1.97.7 - yaffar 6-Jun-2005

Logfile of HijackThis v1.99.1 - walter-j 4-Jun-2005

Logfile of HijackThis v1.99.1 - sumit 25-Apr-2005
... se.dll webdlg32.dll

Logfile of HijackThis v1.97.7 - cjoseph 19-Apr-2005

Logfile of HijackThis v1.99.1 - djadhd 19-Apr-2005

Logfile of HijackThis v1.99.1 - drcpr 12-Apr-2005

Logfile of HijackThis v1.99.0 - tiago 12-Apr-2005
... farmmext.exe

Logfile of HijackThis v1.99.1 - saidb 12-Apr-2005
... cassl.exe Removeme.exe

Logfile of HijackThis v1.99.0 - alan 12-Apr-2005
... dskrfuoui.dll

Logfile of HijackThis v1.99.0 - DurangoJazz 11-Mar-2005
... CitiVAN.exe

Logfile of HijackThis v1.99.0 - sphinx_76 11-Mar-2005

Logfile of HijackThis v1.97.7 - Anonymous 16-Jan-2005

Logfile of HijackThis v1.99.0 - Yubot 14-Jan-2005

Logfile of HijackThis v1.99.0 - mirahmadi 12-Jan-2005

Logfile of HijackThis v1.97.7 - Bird47 5-Jan-2005

Logfile of HijackThis v1.98.2 - Hrndg 5-Jan-2005

Logfile of HijackThis v1.98.2 - Rasandy 15-Dec-2004

Logfile of HijackThis v1.98.2 - Anonymous 27-Nov-2004

Logfile of HijackThis v1.97.7 - wandmdad 22-Nov-2004
... vvsn.exe WToolsA.exe dp-him.exe

Logfile of HijackThis v1.98.2 - rtmanuel 22-Nov-2004
... systemse.exe sync.exe msbb.exe mmod.exe

Re: HijackThisLog Analysis - Deluxe 22-Nov-2004
... CxtPls.dll amee.exe ??plorer.exe

Re: HijackThisLog Analysis - Ansteph 14-Nov-2004
... msserv32.exe lserv.exe

Re: HijackThisLog Analysis - Ashbing 12-Nov-2004
... WToolsS.exe

Re: HijackThisLog Analysis - Filmfreak 10-Nov-2004
... mwsoemon.exe

Re: HijackThisLog Analysis - Luxin 10-Nov-2004
... wingo.exe winshost.exe

Re: HijackThisLog Analysis - PS25 9-Nov-2004
... winupdt.exe

Re: HijackThisLog Analysis - Japlok 2-Nov-2004
... femjye.exe Web_Rebates bridge.dll

Re: HijackThisLog Analysis - ycspring 21-Oct-2004
... gbn283.exe 1018835.exe ukgolwla1x.exe

Re: HijackThisLog Analysis - Lime 17-Oct-2004
... vzazo.dll CRJA32.EXE

Re: HijackThisLog Analysis - Barny 17-Oct-2004
... Gnqsbusa.dll sisntprf.exe

Re: HijackThisLog Analysis - John 17-Oct-2004
... EXPLORERZ.EXE wintcp.exe

Re: HijackThisLog Analysis - Pinkcookie 10-Oct-2004
... Ares.exe Hello.exe DNLCertificate.ocx

Re: HijackThisLog Analysis - Firecadman 10-Oct-2004
... one2oneSvc.cab videox.cab

Re: HijackThisLog Analysis - Lin 7-Oct-2004
... ERAAAZ.EXE BJAKMIXV.EXE PXCK.EXE

Re: HijackThisLog Analysis - Jay 7-Oct-2004
... WinSync.exe tgcmd.exe wo.exe

Re: HijackThisLog Analysis - L33t 27-Sep-2004
... dktime.exe Syslaunch.exe

Re: HijackThisLog Analysis - LuxTour 26-Sep-2004
... DRVDDLL.EXE

Re: HijackThisLog Analysis - RadPCB 25-Sep-2004
... MWS32OEMON.EXE

Re: HijackThisLog Analysis - Jonkirk 25-Sep-2004
... sysxu.exe addoi.exe

Re: HijackThisLog Analysis - Costexx 25-Sep-2004
... flashget.exe

Re: HijackThisLog Analysis - Scott 20-Sep-2004
... windupdates.com WEATHER.EXE

Re: HijackThisLog Analysis - Toncake 18-Sep-2004
... try-this-search.biz eplrr9.dll

Re: HijackThisLog Analysis - Alex 18-Sep-2004
... Winad.exe WinClt.exe optimize.exe

Re: HijackThisLog Analysis - Rahul 18-Sep-2004
... IEHost.exe pcsvc.exe

Re: HijackThisLog Analysis - Richard 18-Sep-2004

Page1 2 3

Post your comment

I think the seaWDurlIE.exe may be the source of the annoying fasterhomepage.com web page. Remove this file with HiJackThis. More info:

http://www.kephyr.com/spywarescanner/pus-practices
/index.phtml#fasterxp-2005-06-08

In reply to Larry:
I´m getting nowhere trying to remove the "www.fasterhomepage.com" browser hijacking. It keeps coming back. I can´t find any information on it. Can anyone give me a hand with this one. Thanks. Larry

Roger
2/5/2008 7:04:04 PM - SG |

I had the same problem, i waited ower 44 days and my computer needed to format.
This is really bad so try getting the virus of.
It is a virus that comes in 7 days after making another home page.
Its a trojan that hacks the NAV data of internet and replaces the Windows NAV to www.fasterhomepage.com and makes pop ups when internet starts
If im wrong your computer is safe, if im right:
Get the ***** ( automatically deleted ) trojan out of your computer or it will make more viruses.
And what i mean in format;
All of your computer files, Games, Jpg,s.etc will need to be deleted Inculding all files like msn, skype . This is a bad virus.
I dont know how to delete it but i finded a keylogger on my "Own computer" C:Program Files/Valve/Steam/SteamApps/****/Keylogger/
It will go to all folders and destroy the main
RAW D.A.T.A of your computer and it will delete all of your files in that folder.
How i deleted it:
I used C++ to edit the keylogger from my broswer, !!!!WARNING!!!! THIS MAY CAUSE A PROBLEM: YOUR INTERNET WILL NOT ANYMORE OPEN.
So i used C++ to edit the Keylogger, Deletd 55 words of the keyloggers main txt. and deleted all Dlls of keylogger:
Here is a site for C++ virus free,They got their own department:
http://www.bloodshed.net/dev/devcpp.html
Download.
This is the only way i know how to edit keyloggers and trojan folders,Files,JPGS.
They can hide anywhere.
Like that happened to you they can go to internet and get the www.fasterhomepage.com

Daniel, USA
10/17/2005 6:19:09 PM - FI | reply

DIDN´T HAVE FILE SEAWDURLIE.EXE. FASTERXP COMES BACK EVER 7 DAYS. WHAT WINDOWS PROGAM RUNS ANY FILE/PROGRAM ON A RECURRING BASES I.E. EVERY 7 DAYS?

In reply to Roger:
I think the seaWDurlIE.exe may be the source of the annoying fasterhomepage.com web page. Remove this file with HiJackThis. More info: http://www.kephyr.com/spywarescanner/pus-practices /index.phtml#fasterxp-2005-06-08

CLIFF
6/13/2005 9:46:02 AM - US |

also check unused desktop shortcuts and at last check your config (win.ini) this is, i think where it starts. then run hijackthis and to see if any thing is stil out there.

In reply to CLIFF:
GOT AHEAD OF MY SELF. ALL DOS HAS DONE IS REMOVE THE HOME PAGE. BUT DOSE NOT REMOVE WHAT EVER STARTS THE PROCESS. YOU ALSO NEED TO LOOK INTO YOUR PROGRAM FILES AND I386 FILE FOR SOME OF THE HOMEPAGE FILES. THESE NEED TO BE REMOVED. SORRY FOR NOT HAVING ALL THE INFORMATION YET. STILL WORKING THIS PROBLEM.

Anonymous
5/20/2005 4:12:55 PM - US |

GOT AHEAD OF MY SELF. ALL DOS HAS DONE IS REMOVE THE HOME PAGE. BUT DOSE NOT REMOVE WHAT EVER STARTS THE PROCESS. YOU ALSO NEED TO LOOK INTO YOUR PROGRAM FILES AND I386 FILE FOR SOME OF THE HOMEPAGE FILES. THESE NEED TO BE REMOVED. SORRY FOR NOT HAVING ALL THE INFORMATION YET. STILL WORKING THIS PROBLEM.

In reply to Larry:
Thank you very very much. I found the FasterXP "Dir" and am now in the process of removing it. Thanks again for the help. Larry

CLIFF
5/16/2005 6:26:36 AM - US |

Thank you very very much. I found the FasterXP "Dir" and am now in the process
of removing it.

Thanks again for the help.

Larry

In reply to :
if you know dos. look in program files for fasterxp sud dir. delete files then remove the sud dir. so far this has worked for me.

Larry
5/9/2005 1:55:14 AM - US |

if you know dos. look in program files for fasterxp sud dir. delete files then remove the sud dir. so far this has worked for me.

In reply to Larry:
I´m getting nowhere trying to remove the "www.fasterhomepage.com" browser hijacking. It keeps coming back. I can´t find any information on it. Can anyone give me a hand with this one. Thanks. Larry

Anonymous
5/4/2005 4:31:25 PM - US |

if you know dos. look in program files. find the sub dir fasterxp. delete the files then remove the sub dir. it may be named different. so far this has worked for me.
Anonymous
5/4/2005 4:28:22 PM - US | reply

I´m getting nowhere trying to remove the "www.fasterhomepage.com" browser hijacking.
It keeps coming back.

I can´t find any information on it. Can anyone
give me a hand with this one.

Thanks.

Larry

Larry
4/26/2005 2:52:42 AM - US | reply

This link is no good.
http://www.spywareinfo.com/~merijn/files/hijackthis.exe
D.H. Cesare
11/1/2004 11:36:27 PM - US | reply

Mail this page