Hijacked Search Engine & Home Page

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Event ID 615 Event ID 615 IPSec Services: IPSec Services failed to get the complete list of network interfaces on the machine. This can be a potential security hazard to the machine since some of the network interfaces may not get the protection as desired by the applied IPSec filters. Please run IPSec monitor snap-in to further diagnose the problem. I installed the IPSEC monitor snap-in as suggested, but at a lose as how to activate it to further diagnose the problems. Thanks, Donna J. Tag: Hijacked Search Engine & Home Page Tag: 50649
  - 2
    - Error Code C00D11CD Everytime i try to play a song downloaded from MSN music club, it prompts me that I need to upgrade DRM properties. When I click on OK to do this I get unknown error code above. This is making my membership to the above useless. Please help. Tag: Hijacked Search Engine & Home Page Tag: 50645
  - 3
    - security what security guard company is the best? i have a vault that I don't want some master criminal getting inside of. maybe I've seen too many movies =( Tag: Hijacked Search Engine & Home Page Tag: 50641
  - 4
    - remove spyware Does anyone have advice on which free spyware removal is the best to download??? I don't want one just to scan. Tag: Hijacked Search Engine & Home Page Tag: 50636
  - 5
    - Someone sending e-mails with my address I have been receiving various "failure to deliver" messages stating that messages from my hotmail address have been denied because of content, etc. The problem is that I have not been sending these messages. In fact, I have never seen the addresses to which they are supposedly being sent. I don't want someone sending these in my name and with my address. What should I do? Tag: Hijacked Search Engine & Home Page Tag: 50634
  - 6
    - password for system admin forgotten i just bought a new computer with windows xp on it. i tried to set up two account users and pass protected the system admin account..i now cannot open this account. does any one know how to find out what i used as my password. Tag: Hijacked Search Engine & Home Page Tag: 50631
  - 7
    - broser highjacking my browser has been highjacked from this address mk:@MSITStore:C:\WINDOWS\start.chm::/spplain.html any ideas Tag: Hijacked Search Engine & Home Page Tag: 50628
  - 8
    - Windows XP re-activation This may not be the right newsgroup to post to but it seems the most appropriate. I added a hard disk to my PC today, now Windows XP says it needs to be activated (again). Unfortunately, when I attempt to activate on-line a message appears basically saying that local scripting needs to be enabled first, the message fails to describe how to do this. Any ideas? Thanks. Tag: Hijacked Search Engine & Home Page Tag: 50624
  - 9
    - can not get rid of program I downloaded the Hotbar onto my computer. Big mistake. Now every time I try to take it out of my programs the computer add/remove control panel locks up. I have to restart my computer just to get off my screen. I need it off. What can I do. Tag: Hijacked Search Engine & Home Page Tag: 50608
  - 10
    - help with Zone alarm kicking me off sorry I forgot to put a subject :-) I keep getting kicked off on outlook express- WIN xp & dial-up/I use ZA free version (new to Z.A).Here is the message: the tcp/ip terminated the internet connection 224 overview info:account-MSnews.Microsoft.com server:MSnews.Microsoft.com protocol:NNTB port:119 secure SSL:0 error # 224 800cccof So........then I reconnect and then its fine (sometimes) If I get off line then on line again, it happens over & over again Ive posted before but get no response. help if you can- I thank you Tag: Hijacked Search Engine & Home Page Tag: 50607
  - 11
    - Missing emails after latest security updates I noticed a post from Bill Bradley describing Remote Desktop issues after installing the MS04-011 thru MS04-014 patches. I just received an email stating that after the installtion of the MS04-011 thru MS04-014 patches, the user can no longer see any emails sent to him from the day he installed the updates (including the one I sent with the links to install them). I assume this was caused by the MS04-013 Outlook Express patch. Has anyone seen this occur? Better yet, has Microsoft released any info on issues that occur after the installtion of these patches? Tag: Hijacked Search Engine & Home Page Tag: 50604
  - 12
    - spying? 1.) I am using Windows ME. And, does creating a logon password helps protect my computer? 2.) How do i determine if someone is spying on my computer? is netstat a way? 3.) If netstat is a way. How do i use netstat and to determine whether or not i am being spied? 4.) If i am being spied or easily hacked, how do i protect myself? someone please reply . Tag: Hijacked Search Engine & Home Page Tag: 50594
  - 13
    - how are they getting into my machine? in the event viewer i see this every time i log onto the net: the user User Name successfully established a connection to The Internet (1) using the device IRDA12-1 under explanation or the click to find an answer, it says this: The user %1 successfully established a connection to %2 using the device %3. anyone understand that?? zone alarm, just put in (pro) is blocking 200 attempts a day. when i shut off za, i have norton also. it shows about 10 attempts every session. looking deep into the users, there is NO "user name" showing as an 'account' only the default names are there. what's the darn deal here? please help Tag: Hijacked Search Engine & Home Page Tag: 50589
  - 14
    - Security update is from "Windows update" page I have been trying to install the update patch (823559)for a few weeks now. Every time I get on the Microsoft website to update 98SE, I get an advisory to install this security patch which I do each time. Apparently it is not being installed. Any suggestions? Tag: Hijacked Search Engine & Home Page Tag: 50588
  - 15
    - 135 Hey all, I've been researching and am having difficulty finding out how to unbind the remote procedure call service from port 135. I'm beggining to wonder if it's possible. I messed around with my system configurations a while ago and discovered that rpc 135 was closed from netstat. I don't know what I did, but it worked at the time. Now I can't seem to find a way to do this. Please help me. Thank you. With appreciation, Terry Tag: Hijacked Search Engine & Home Page Tag: 50585
  - 16
    - Effects of Port Blocking on Apps Hi, I am considering blocking certain ports on my workstation that are well known to be used by viruses. For example I could block 2283 which the W32/Dumaru.ad virus listens on. I don't expect to be running any servers on this port However, some programs like Internet Explorer, occasionally use this port to go outbound From what I can tell, Internet Explorer, Outlook, MMC, and other apps seem to just tr ascending ports and if they can't connect on 2283, they'll connect on 2284. Is that true? Also, will blocking 2283 or other non-registered ports (i.e. i am not talking about port 80) for all communications have bad effects on any Windows/Microsoft programs Thanks Tag: Hijacked Search Engine & Home Page Tag: 50581
  - 17
    - Effects of Port-Blocking on Applications Hi, I am considering blocking certain ports on my workstation that are well known to be used by viruses. For example I could block 2283 which the W32/Dumaru.ad virus listens on. I don't expect to be running any servers on this port However, some programs like Internet Explorer, occasionally use this port to go outbound From what I can tell, Internet Explorer, Outlook, MMC, and other apps seem to just tr ascending ports and if they can't connect on 2283, they'll connect on 2284. Is that true? Also, will blocking 2283 or other non-registered ports (i.e. i am not talking about port 80) for all communications have bad effects on any Windows/Microsoft programs Thanks Tag: Hijacked Search Engine & Home Page Tag: 50580
  - 18
    - firewalls I am thinking of installing a firewall such as zonealarm ..should I switch off the in built firewall thats with XP or is XP's firewall suffienient .................. Tag: Hijacked Search Engine & Home Page Tag: 50571
  - 19
    - belgian.com removal Hi, I got some trojan from belgian.com and it pops up ads randomly. I think it also killed my Windows Media Player. I have tried Spybot Search and Destroy and it doesn't remove it. Any advice would help. Thanks in advance. -Manny Tag: Hijacked Search Engine & Home Page Tag: 50570
  - 20
    - microsoft email of patch i keep receiving an email from microsoft advising me this is an april 2004 cumulative patch for security update is this safe to open it has attachments but i'm not 100% its a valid email as i was told microsoft don't email patches. please advise Tag: Hijacked Search Engine & Home Page Tag: 50565
  - 21
    - Help with Possible Virus/Trojan? My Win98se machine has started to act very strange during the last week. I have the Microsoft Office Toolbar on the top of my Desktop which includes shortcuts to MSWord, Notepad, Windows Explorer, etc. When I try to use the MS Word shortcut icon on the Office Toolbar, Sygate Personal Firewall tell me that "Microsoft Word For Windows is trying to connect to crl.verisign.com (64.94.110.12) using remote port 80.....". I instruct Sygate not to allow the connection, then everything slows down and it takes a long time for Word to load. When it finally does load, everything has slowed down and it takes forever to Open files, Save files, etc.. I have never gotten this warning from Sygate before and why would activating Word from a shortcut on the Office Toolbar, cause it to try to connect to the internet? I get the same Sygate message when I try to launch Windows Explorer from the Tool Bar. Sounds like some kind of Virus/Trojan/Hijacker has infected my computer. Any help or ideas will be greatly appreciated. Thank you. Mike H PS: I've run Norton Antivirus, Spybot, Stinger, and CWshredder. All are current. They don't find anything on my computer. Occasionally when I'm on the internet I get the "About:Blank" window on the bottom of my screen. I don't know if that has anything to do with the current problem. Tag: Hijacked Search Engine & Home Page Tag: 50564
  - 22
    - start page.eb trogan horse can't delete this trogan horse. my computer continues to rebut. help! i start my anti-virus software, then the computer start to rebut. Tag: Hijacked Search Engine & Home Page Tag: 50560
  - 23
    - thanks to Bbonner Thanks Bill. You have alot of great stuff you share. Tag: Hijacked Search Engine & Home Page Tag: 50552
  - 24
    - securtity patch I am using Windows 98SE. I continuously receive a Windows update notice for Security update #823559. I have downloaded and installed this update many times but I continue to receive this critical update notice. Why? Tag: Hijacked Search Engine & Home Page Tag: 50551
  - 25
    - Not enough storage is available to complete this operation After installing SP2 for XP on both client & servce machine, callback registration with server failing with error "Not enough storage is available to complete this operation". Before installation of SP2 for XP, this was working properly. Can someone help me? Tag: Hijacked Search Engine & Home Page Tag: 50550
- Next
  - 1
    - MSN Been Hacked My hotmail account has been hacked and Microsoft's website is about as helpful as your average bureaucratic mess - ie: none at all. If someone can direct me to the correct place to lodge for my account to be returned to me I'd be very grateful. I cant remember the psuedonym I used to signup with so the automated response sheet is useless to me. My password and Secret Question have both been changed. Tag: Hijacked Search Engine & Home Page Tag: 50549
  - 2
    - redirected to http://searchpage.cc/ everytime i use a program such as vzones or any amazon as soon as i try to log in or listen to a music sample i get redirected to the page http://searchpage.cc/ for no reason. Not only this but also toolbars have appeared on my browser which i have not loaded. What can i do to fix the problem? Tag: Hijacked Search Engine & Home Page Tag: 50548
  - 3
    - Can visit to website endanger security? I received a spoof email asking me to update my CitiBank details. It was obviously created by an oriental English speaker, but I was curious because the link therein led to an https: site (ie, secured site). So I had a look, and was redirected to an insecure site. I looked there, thinking they would have a form for us suckers to fill in giving away passwords etc, but the page was totally blank, and even though my browser said "Done" I still had my hourglass (but this often happens anyway). Has my curiosity made me vulnerable? I don't have a firewall because when I installed ZoneAlarm I didn't understand it. (I know... but all it seemed to do was list IP numbers and I just carried on as normal. I don't normally visit dodgy sites. Obviously I won't do it again, and yes, I do know what curiosity did to the cat. Patricia Tag: Hijacked Search Engine & Home Page Tag: 50547
  - 4
    - Problems after applying MS04-011 to 014 After the installation and reboot (using WindowsUpdate or manual methods) RemoteDesktop can no longer connect to the patched computers (RemoteDesktop computer was patched previously)--all you get is a black window. All are servers, all are Win2Kw/SP4 and had all previous patches applied. DameWare works. Anything you guys at Microsoft want to tell us about these patches?? Tag: Hijacked Search Engine & Home Page Tag: 50546
  - 5
    - Spybot Search and Destroy 1.2---->Replacement for the program ? I have run Spybot since it first came out and love the way the program works. It seems to work well with Zone Alarm Pro and Ad-Aware Plus picking up the things the others miss. However...Not sure if the Spybot people are on a long vacation or too busy with Beta 1.3, but there have been no updates for almost 6 weeks (Since 4 March) and in the past, they usually have a new update about every week. Also they are not responding to email support, before they always did within a day. Does anyone know what is going on with them ? I hope Mr. Kolla did not "retire" as its a great little program, but no updates in this long a period is not a good sign to me. Anyone have an alternate to Spybot that I can use until (if..) Spybot starts updating again ? I have seen a few names tossed around in here, but never really paid attention to the comments as Spybot had been working so well for me. Looking for something that works well on Windows XP Pro (I am also using the SP2 RC1 release) Thanks ! -- Tedd Riggs PDA Square Content Developer www.pdasquare.com Redmond, WA Tag: Hijacked Search Engine & Home Page Tag: 50543
  - 6
    - activex control and internet explorer i am doing a project which contains an activex controls the problem faced is when am i trying to veiw my site on some other m/c within intranet, a messagebox for downloading the activex control is shown with message that the certificate is not in the trusted root and it ask for installation of the certificate before installing the control. how can i auto install a certificate in IE while downloading an activex control without the message for installation for the certificate. the control is signed and certified on the server and there it shows a message of a valid certificate. Tag: Hijacked Search Engine & Home Page Tag: 50538
  - 7
    - SUS Question Hello Everyone, I have searched the KB and looked for an SUS newsgroup, but there appears to be nothing available. I have a problem and I guess that this is the best place to request assistance. Here it goes: I installed SUS on a Windows Small Business Server 2003 machine and redirected SUS to work off of the "companyweb" web site. When I attempt to Synchronize the server and approve the updates, the server appears to synchronize correctly, but when I go to approve the updates, I receive this error message: "No Packages ar available to be approved. This may be a because a synchronization has never been performed of because your Software Update Services Server is not functioning correctly." The approval log appears to work fine, but the approve updates page does not... Any assistance will be greatly appreciated. Stewart Tag: Hijacked Search Engine & Home Page Tag: 50535
  - 8
    - 3rd Party Server monitoring! G/day forum, I've been asked to recommend a software that sits on a file server that montors usage activity, users, access, etc. I've enabled a high level of user monitoring through GPO but its difficult to analyse the high volume of logs generated. Is their a 3rd party application that i can use to comprehend these logs? Seperate 3rd party logging? Host intrusion protection? Your thoughts are greatly appreciated. Regards, Steve. Tag: Hijacked Search Engine & Home Page Tag: 50533
  - 9
    - MSN CRITICAL UPDATES I have a critical update, # 835732, that when downloaded, uses all of my PC's resources and I am unable to use my PC. I then have to delete this update in order to use my PC. Has anyone had this problem? Tag: Hijacked Search Engine & Home Page Tag: 50532
  - 10
    - wipe old hard drive I am selling my old pc and want to know if there is a way to encrypt or fully erase all the old data on it. I know that reformatting it won't be safe enough. Any suggestions? Tag: Hijacked Search Engine & Home Page Tag: 50529
  - 11
    - security options for embedded objects in MSWord I have recently tried desperately to set password protection on a word doc object embedded within another word document (what I'm really wanting is to keep part of a word document password protected, this is the only way I could think of doing it) but without success. I have tried the normal way, by opening the embedded doc and using Tools|Options|Security tab to set a password but as soon as I exit this dialog box and close the embedded doc the password protection settings appear to get wiped. Does anyone know if what I'm trying to do is possible, or is this a bug? Or do you have any suggestions on a better way to do what I'm attempting as described in the brackets above? Thanks in advance C Tag: Hijacked Search Engine & Home Page Tag: 50528
  - 12
    - spying on me? someone get me educated! 1.) I am using Windows ME. And, does creating a logon password helps protect my computer? 2.) How do i determine if someone is spying on my computer? is netstat a way? 3.) If netstat is a way. How do i use netstat and to determine whether or not i am being spied? 4.) If i am being spied or easily hacked, how do i protect myself? someone please reply Tag: Hijacked Search Engine & Home Page Tag: 50527
  - 13
    - Windows Failed Updates I have 2 update failures of security updates, and i attempted to reupdate a second time but the scan no longer recognizes those updates as being updates that I need. I checked the log and I am sure that those specific updates have not been installed. 2 updates that are more recent have been installed but I am not sure if these include the other updates. Does anyone know? Tag: Hijacked Search Engine & Home Page Tag: 50523
  - 14
    - Zone Labs Security Scanner I just got an e-mail from Zone Labs (makers of the firewall ZoneAlarm). In it, they are advertising the new Zone Labs Security Scanner, which is "a Web-based scanner that detects tracking cookies. It utilizes server based content and updates to assist users in blocking the latest threats." Anyone using this yet, and if so, what do you think? I'm thinking it's useless for me since I'm frequently deleting my cookies anyway, but I like ZoneAlarm firewall so far so I'm thinking I should give this scanner a try. Any thoughts or opinions? Tag: Hijacked Search Engine & Home Page Tag: 50520
  - 15
    - EZ Armor LE Just received this CD from Microsoft. To install it says I must uninstall Norton Anti Virus. Is EZ Armor better than Norton? Very new at computers. Tag: Hijacked Search Engine & Home Page Tag: 50515
  - 16
    - new start up program???? I am now getting a window that pops up asking if I want the program "Watson Subscriber for SENS Network Notifications" in my start up menu. Can someone explain what this is? It apparently comes from microsoft. Thank you. David Tag: Hijacked Search Engine & Home Page Tag: 50513
  - 17
    - Trojan Downloader Virus I have been having problems with my computer. It showed a lot of color and then it showed what looked like a lot of worms. Then I was notified that I have a Trojan Downloader:Win32/Agent. H Virus. Can anyone tell me what to do about this. Pelase help. hummingbird@compuwise.net Tag: Hijacked Search Engine & Home Page Tag: 50510
  - 18
    - locked out of computer My password isn't working and I can't get into my computer. Any one can help?????????? PLEASE!!!!!!!!!!!!!!!!!!! Tag: Hijacked Search Engine & Home Page Tag: 50502
  - 19
    - Policy change, hacker attack ? Event Type: Success Audit Event Source: Security Event Category: Policy Change Event ID: 612 Date: 4/15/2004 Time: 5:18:52 PM User: NT AUTHORITY\SYSTEM Computer: CP250405-A Description: Audit Policy Change: New Policy: Success Failure + + Logon/Logoff + + Object Access + + Privilege Use + + Account Management + + Policy Change + + System - - Detailed Tracking + + Directory Service Access + + Account Logon Changed By: User Name: CP250405-A$ Domain Name: MSHOME Logon ID: (0x0,0x3E7) For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Looks like a hacker attack that wants to prevent detection ? What do you think ? Tag: Hijacked Search Engine & Home Page Tag: 50501
  - 20
    - Internet browsing problem Whenever I start browsing the internet and I enter an internet address my search gets hijacked and this appears before my entered address:- WWW.NKVD.US/1251/Yahoo.com(example) I've tried everything and it won't stop. Please help Regards Tag: Hijacked Search Engine & Home Page Tag: 50492
  - 21
    - http://www.windows-patch.info/ is this a bogus site? i keep having this message popup that i cant stop this is one of the sites it leads to... should i download the patch? Tag: Hijacked Search Engine & Home Page Tag: 50491
  - 22
    - script (member of) I am trying to get for spesific user to what member of user belongs on a server name:test I can't see where my error is. Please hel Set objOU = GetObject ("LDAP://cn=Users,dc=NA,dc=companyname,dc=com" ObjOU.Filter= Array("user" For Each objUser in objO Response.Write & objUser.cn & " is a member of: Response.Write "Primary Group ID: " & objUser.Get("primaryGroupID" arrMemberOf = objUser.GetEx("memberOf" For Each Group in arrMemberO Response.Write & Grou Nex ' Response.Write vbTab & ; "memberOf attribute is not set Next Tag: Hijacked Search Engine & Home Page Tag: 50489
  - 23
    - How do you guys handle security in NT4 domain?? I already posted this in another NG. Sry. No1 replied thats why I posted here. I'm new at posting, I'll remember next time to post in multiple ngs the right way.... Hello, Just started looking at this ng. I was wondering in an NT4 domain , do you guys rely on group policies only for security at the workstations? about three yrs ago our company final thought it might be a good idea to implement security for the night shift users. I went through setting up group policies for the night shift. I restricted their logins to run only 3 company programs and removed all the unnecessary stuff such as regedit, run, etc. It "seemed" like group policies were enough, however i found out its easy to get to DOS prompt, other programs,network neighborhood, and local drives. In addition to group policies, i had to change NTFS permissions on various exe's and dll's to further "lockdown" the NT4 workstations. I was just wondering if any1 else does the same thing. Just in case any1 wants to know, here's our setup : NT4 Domain 90% of local workstations are NT4 SP6a (not all are patched. However, all test machines where fully patched.) 1 pdc, 2BDC SP6a patched. 95% of user profiles are mandatory. thanks for any replies --willc Tag: Hijacked Search Engine & Home Page Tag: 50478
  - 24
    - security downloads Hello, Every time I turn on my computer and access the Internet, there are more security downloads. Is there a way that I can download these without incurring Internet charges? I pay by the hour, and lately I'm using a lot of hours trying to download the security stuff (and the downloads are not always installed correctly for some reason). Also, if I'm not sitting at my computer, the Internet access logs out automatically after about 20 minutes of no use. What happens to the download information? Does it all get lost? I have logged back in a couple of times, and then after I thought everything downloaded, I got messages that the information was downloaded but not installed. What does that mean and how do I fix it? I am beginning to wonder why I got a new computer with Windows XP Home Edition. I never had any issues with my Windows 98. Thank you for your attention to this. Please let me know how to download information with correct installation, and please let me know if it can be done without constant Internet access. Tag: Hijacked Search Engine & Home Page Tag: 50467
  - 25
    - Virus included in emailed update from MS I downloaded critical updates from MS website. My system has been degraded and I am no longer able to access the internet from that PC (WIN 98 see post under 98 internet & security) Subsequently I have received 5 emails from Microsoft and Yahoo has identified them as infected with a virus. Virus "W32.Swen.A@mm" found. I still am down and I am concerned about how to fix the problem. Does anyone know about this problem? Barry Tag: Hijacked Search Engine & Home Page Tag: 50464

Something has gotten into my system that changes the Registry Settings for IE homepage and all search engines. The page that loads is " http://search-dot.com/net/ " and redircts all searches. I have tried editing the Registry, but it entries are changed again at re-boot. If anyone has encountered this, or knows the file to delete to kill it, let me know.

Top

Re: Hijacked Search Engine & Home Page by Jupiter

Jupiter
Sat Apr 17 18:25:56 CDT 2004

Follow #1, #5 & #6 on this link to get rid of viruses and spyware:
http://www3.telus.net/dandemar/slowcom.htm

--
Jupiter Jones [MVP]
http://www3.telus.net/dandemar/

"David" <dhoffert@bellsouth.net> wrote in message
news:C63B5E9F-B52F-4F6A-B7DC-2D59855400FF@microsoft.com...
> Something has gotten into my system that changes the Registry
Settings for IE homepage and all search engines. The page that loads
is " http://search-dot.com/net/ " and redircts all searches. I have
tried editing the Registry, but it entries are changed again at
re-boot. If anyone has encountered this, or knows the file to delete
to kill it, let me know.

Top