# Gah!  #$%&@# Browser Hijacker

**URL:** <https://boards.straightdope.com/t/gah-browser-hijacker/487924>\
**Category:** Factual Questions\
**Created:** [March 1, 2009, 10:13pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924 "2009-03-01T22:13:38Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![mnemosyne](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@mnemosyne](https://boards.straightdope.com/u/mnemosyne)\
**Post date:** [March 3, 2009, 11:59pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/21 "2009-03-03T23:59:59Z")

</div>

I’m having the same problem, and I think whatever it was might have come in as something appearing to be a Firefox update, but I’m not sure. A friend of mine had her hotmail account hijacked a couple of weeks ago, and the messages were coming in with topics similar to what she’d actually write, so I may have gotten something from that, but I’ve only had the redirect problems since Sunday or so. It’s driving me crazy; I’ve used ClamWin Antivirus, Ad-aware, Search and Destroy and Malware Bytes to no avail. I’m scared to do a system restore on my own, but when my husband gets home, I’ll put him on it! I’ll try GooRedFix and SuperAntiSpyware, though this thread isn’t making me feel too confident. I don’t understand HijackThis. Will it actually get rid of the malware, or just somehow tell me it’s there?

I am so sick of seeing that stupid cow survey page! Any of you getting that one?

---

<div class="post-metadata">

**Author:** ![zut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zut/32/2875_2.png) [@zut](https://boards.straightdope.com/u/zut)\
**Post date:** [March 4, 2009, 12:09am UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/22 "2009-03-04T00:09:20Z")

</div>

> [@zut](#):
>
> …And that (knock on wood) seems to have worked. We’ll see, but meanwhile thanks to y’all in this thread.

…Or not.

Now if I type, say, “lavasoft” into google and follow the link to [www.lavasoft.com](http://www.lavasoft.com), the screen just grinds to a halt. Hum, says I, let’s look at the page source.

> [@](#):
>
> \<html\>\<script\> // \</script\>\<noscript\>\<meta HTTP-EQUIV=Refresh CONTENT=“0;[http://209.85.171.9/x/?i=g14b2562abcc5926c6db1db45e11dece16d3d3LmxhdmFzb2Z0LmNvbS8=&m=1](http://209.85.171.9/x/?i=g14b2562abcc5926c6db1db45e11dece16d3d3LmxhdmFzb2Z0LmNvbS8=&m=1)”\>\</noscript\>\<body\>\<form action=[http://209.85.171.9/x/&gt;&lt;input](http://209.85.171.9/x/&gt;&lt;input) name=i value=“g14b2562abcc5926c6db1db45e11dece16d3d3LmxhdmFzb2Z0LmNvbS8=” type=hidden\>\<noscript\>—| Anti DDOS filter |—\<br\>\<br\>\<input type=submit value=“Click here to start this site”\>\<input name=c value=1 type=hidden\>\</noscript\>\</form\>\</body\>\<script\>document.forms[0].submit();\</script\>\</html\>

Doesn’t look lavasoft-y to me. On the upside, simply clicking on the “[http://www.lavasoft.com](http://www.lavasoft.com)” in the browser command line sends me to the right place. On the downside, something’s still not right.

Sigh. Let me try everything one more time. Other suggestions are still appreciated, though.

---

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [March 4, 2009, 12:14am UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/23 "2009-03-04T00:14:50Z")

</div>

> [@mnemosyne](#):
>
> I don’t understand HijackThis. Will it actually get rid of the malware, or just somehow tell me it’s there?

HJT will not remove spyware, nor will it tell you what is or isn’t spyware. It only reveals common locations that spyware frequently uses, but that are also used by legitimate programs. If you have no experience in determining what is or is not spyware, HJT will not do you any good, and could cause damage that will render your computer unbootable.

---

<div class="post-metadata">

**Author:** ![mnemosyne](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@mnemosyne](https://boards.straightdope.com/u/mnemosyne)\
**Post date:** [March 4, 2009, 2:37am UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/24 "2009-03-04T02:37:14Z")

</div>

> [@Fear\_Itself](#):
>
> HJT will not remove spyware, nor will it tell you what is or isn’t spyware. It only reveals common locations that spyware frequently uses, but that are also used by legitimate programs. If you have no experience in determining what is or is not spyware, HJT will not do you any good, and could cause damage that will render your computer unbootable.

See, that’s the feeling I was getting from all the HJT references I’ve seen! I’m just going to ignore the problem for now, and hope my husband can fix it when he gets back from his business trip. It is so frustrating, though!

---

<div class="post-metadata">

**Author:** ![zut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zut/32/2875_2.png) [@zut](https://boards.straightdope.com/u/zut)\
**Post date:** [March 4, 2009, 12:02pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/25 "2009-03-04T12:02:54Z")

</div>

[QUOTE=zut;10900567Sigh. Let me try everything one more time. Other suggestions are still appreciated, though.[/QUOTE]

Can someone tell me what one _should_ see after running System Restore? Because when I ran it, it just sort of pooped out and quit, leaving me with no indication it had done anything at all other than an icon-free desktop.

Apparently running System Restore did _something_, though, because:  
a) it looks like my browser now won’t run any scripts, and  
b) now I can’t run System Restore.

Hoh boy. I’m afraid I’ve just made things worse. ☹

---

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [March 4, 2009, 12:38pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/26 "2009-03-04T12:38:31Z")

</div>

> [@zut](#):
>
> Can someone tell me what one _should_ see after running System Restore? (

When your system restarts, you should get a window saying, “Windows has been succesfully restored to an earlier point.” or something to that effect

[Previous page](https://boards.straightdope.com/t/gah-browser-hijacker/487924.md?page=1)