Re: MSN hijacking

From: Jan Il (abuse_at_localhost.com)
Date: 02/16/05


Date: Wed, 16 Feb 2005 16:43:20 -0500

Hi Lizred :-)

> Jan Il,
> Thank you for your reply. I was able to change the homepage back to my
> choice but the change wouldn't stick. Then I did another full system scan
> with Norton AV (after my daily check for updates), ran Spybot, Adaware SE
> and
> also ran the additional little program CW Shredder. None of the scans
> indicated a problem except DSO exploit showed up as a problem on Spybot
> and
> the explanation blames Microsoft for the hole. Deleting this problem
> sometimes causes difficulty booting, but sometimes doesn't cause it. DSO
> Exploit did show in Spybot and I did allow the progam to "fix" the
> problem.

> After running CW Shredder and the other scans, I changed the homepage to
> my
> preference applied the change and rebooted and am now back where I wanted
> to
> be.

> My curiosity is peaked because the scans all showed no problems except in
> Spybot, but now my MSIE ver 6 is behaving itself.
>
> Appreciate your assistance. I am very reluctant to visit many websites
> and
> really watch my system even with updates from other software companies.
> Surfing isn't the fun it used to be! I mainly visit academic sites,
> government sites and a few cartoonist's personal homepages. I tend to
> avoid
> most sites if they require cookies...even had to change my settings to get
> to
> post on this page.

You're very welcome! Glad to hear you were able to resolve your problem.
Good job!

I agree that 'surfing the net' is not as much fun as it used to be, but, it
can still be livable if your system is fully updated and you pracitce Safe
Hex while on the Internet. Here is some further information on how to
protrect your machine while on the Internet that you might like to review.

In order to protect yourself a bit more form the various perils of the
Internet, you might like to install the IESpyad. You can read more about it
here and decided if it might help:
https://netfiles.uiuc.edu/ehowes/www/main.htm
and also good information for safer Internet use:
Defending Your Machine

http://defendingyourmachine.blogspot.com/

> Is DSO Exploit a spyware program? Could this have caused the change?

I doubt that you actually had the spyware, it is more likely a hijacker,
which your AV, spyware (SpyBot)or adware (AdAware) scan programs can not
detect, as they are not programmed with definitions to detect or remove
hijackers. A program such as HiJackThis is good to seek them out. But, even
then, with some types, they can only be detected while in Safe Mode.

Here is an explanation for the DSO Exploit
http://www.dso-exploit.com/
and here is a fix for the SpyBot S&D DSO Exploit bug,
http://www.majorgeeks.com/download4392.html
>
> This board is invaluable!
>
> Liz

If you need further assistance on this issue, or further information, just
post back here :-)

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

>
> "Jan Il" wrote:
>
>> Hi Lizred :-)
>>
>> In what way is the MSN.com taking over your homepage? Are you changing it
>> to
>> your real homepage and it is changing back each time you open IE? Have
>> you
>> tried troubleshooting why it won't stay? Just so that we know that it is
>> being hijacked, and not just a problem with the change not holding. This
>> can
>> happen without being hijacked. You might check out the following and see
>> if
>> it will help, if it not truly hijacked.
>>
>> Home Page Setting Changes Unexpectedly,
>> or You Cannot Change Your Home Page Setting
>> http://support.microsoft.com/default.aspx?kbid=320159&product=ie
>>
>> And also work through the information here:
>>
>> Dealing with Unwanted Spyware and Parasites:
>> http://mvps.org/winhelp2002/unwanted.htm
>> What You Should Know About Spyware
>> http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx
>>
>> Hope this helps
>>
>> Jan :)
>> Smiles are meant to be shared,
>> that's why they're so contagious.
>>
>> Replies are posted only to the newsgroup for the benefit or other
>> readers.
>> How to make a good newsgroup post:
>> http://www.dts-l.org/goodpost.htm
>>
>>
>>
>> >I downloaded the shredder mentioned in the other posts about getting
>> > hijacked. I will run it shortly. I would like to report that my
>> > homepage
>> > is
>> > getting hijacked by MSN.COM is this a similar spyware program? I run
>> > WinXP
>> > Pro service pack 2 with Adaware (paid version) and Spybot to check for
>> > spyware as well as Norton Utilities. I just downloaded a new
>> > definition
>> > for
>> > the Spybot program and had to restart my system because of an AV
>> > update,
>> > when
>> > I went back online MSN had taken over the IE. I am not happy, but
>> > would
>> > like
>> > to know if this problem is related to the others. I am getting
>> > increasingly
>> > frustrated with simple research online because of this problem and the
>> > change
>> > that also occured to the way I search. I am ready to back to a library
>> > and
>> > search open stacks versus fighting with a computer. I know how to
>> > change
>> > settings and even build computers. I am reluctant to change my
>> > registry,
>> > but
>> > will should I need to.
>> >
>> > Thanks. Wonder if MS knows of this hijack?
>> > --
>> > Lizred
>>
>>
>>



Relevant Pages

  • Re: DSO EXPLOITS - HELP! WHAT THE HECK ARE THEY?
    ... the URLs on that page will definitely test the Exploit as shown by McAfee Enterprise ... | checking for Internet zone settings in the registry that could be used ... the makers of Spybot will soon fix this bug. ... | Ignore Products> Security> DSO Exploit, to turn off the false alarm. ...
    (microsoft.public.security.virus)
  • Re: DSO Exploit
    ... > When I disconnect from the internet I run Spybot. ... > I tell it to fix the problem and it removes the DSO ...
    (microsoft.public.windowsxp.general)
  • Re: SearchMeUP PC Hijacker
    ... > I have recently been hit with a new PC Hijacker. ... Google Toolbar advice section for these.) ... to have something running like antivirus software - and it prevents browser ... Empty your Temporary Internet Files and shrink the size it stores to about ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Clean System
    ... already on there when I installed it such as the about:blank hijacker. ... norton, use the adaware, spybot, & spysweeper to no avail. ... can install everything the second I do my first boot-up. ... >> course a firewall you will be as protected as your computer store tech. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Crude Popups and Un-Changeable Homepage Can Someone Help? Could This Be A Virus?
    ... It is a browser hijacker. ... Spybot S&D: http://www.safer-networking.org/en/index.html ... Then post your report to their forum. ... where the logs get posted; but you should be able to find a link on the ...
    (microsoft.public.security.virus)