# Help, undetectable browser hijacker **URL:** \ **Category:** Factual Questions\ **Created:** [November 22, 2003, 6:01am UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632 "2003-11-22T06:01:55Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Nobody](https://avatars.discourse-cdn.com/v4/letter/n/94ad74/32.png) [@Nobody](https://boards.straightdope.com/u/Nobody)\ **Post date:** [November 22, 2003, 6:01am UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/1 "2003-11-22T06:01:55Z")
Under AOL itself, I can bring up [www.google.com](http://www.google.com) and everything is fine. Under IE or, my new favorite browser, Avant Browser, doing this will redirect me to searchboxxx. Actually, the title of the page will still say Google, but the contents of the page will be searchboxxx. This hijacker isn’t detectable by Spybot, Adaware, or Bazooka spyware/adware dectectors/removers. I’m downloading PestPatrol to see if that helps, but if it doesn’t, does anybody have any suggestions? Thanks. ---
**Author:** ![Happy\_Fun\_Ball](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/happy_fun_ball/32/17664_2.png) [@Happy\_Fun\_Ball](https://boards.straightdope.com/u/Happy_Fun_Ball)\ **Post date:** [November 22, 2003, 7:25am UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/2 "2003-11-22T07:25:29Z")
I had a couple of redirects that **HijackThis** was able to find and remove, while spybot balked… I don’t know where I picked up HijackThis and I can’t find any information for it now, but I bet Google would find it. ---
**Author:** ![Valgard](https://avatars.discourse-cdn.com/v4/letter/v/7feea3/32.png) [@Valgard](https://boards.straightdope.com/u/Valgard)\ **Post date:** [November 22, 2003, 8:10am UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/3 "2003-11-22T08:10:07Z")
Start by checking the system Registry (assuming you are comfortable poking around there). I’d begin under: HKEYLocalMachine-Software-Microsoft-Internet Explorer Check the Search key. Also check under HKEYLocalMachine-Software-Microsoft-Windows-CurrentVersion-Run and see if there’s anything related to that bit of nastiness set to start up automatically. ---
**Author:** ![Earthling](https://avatars.discourse-cdn.com/v4/letter/e/90db22/32.png) [@Earthling](https://boards.straightdope.com/u/Earthling)\ **Post date:** [November 22, 2003, 8:23am UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/4 "2003-11-22T08:23:00Z")
See [this](http://boards.straightdope.com/sdmb/showthread.php?s=&threadid=223568&highlight=hijackthis) thread for where to get HijackThis (and other related info). ---
**Author:** ![neutron\_star](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@neutron\_star](https://boards.straightdope.com/u/neutron_star)\ **Post date:** [November 22, 2003, 9:00am UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/5 "2003-11-22T09:00:15Z")
Does HijackThis check the HOSTS file? I found a rather clever little “enhancement” on a computer at my last job that could cause the problems the OP describes (that is, if the AOL browser ignores the HOSTS file). Spybot and AdAware didn’t catch it. In my case, you’d click the search button on IE6’s menu bar and be redirected to a Russian porn site. I traced the problem to a bunch of code in the HOSTS file. For anyone unfamiliar, HOSTS is/was used for name resolution. When you type a URL into your web browser, the computer first checks the HOSTS file to see if the URL you typed corresponds to an IP address defined in that file, which is empty by default. If it doesn’t find it there, it then queries a DNS server for the correct IP address. The problem is that the HOSTS file gets checked first, thus overrides a DNS entry. If I go into my HOSTS file right now and type the line: _127.0.0.1 [google.com](http://google.com)_ I will not be able to access Google, because all requests for that site will be directed back to my local machine (127.0.0.1 is a loopback address that refers to your own computer). In a similar way, someone could redirect Google to any IP address on the Internet. That’s what the Russian porn people had done to my client’s computer, albeit in a more sophisticated way that changed the function of the search button. I had no idea you could do that in a HOSTS file. Deleting every single line of the file and saving it as an empty file (no extension) solved the problem. Incidentally, the same file can also be used to block ad banners on web pages by pointing the domains of the ad servers to 127.0.0.1 (you), where they obviously won’t find the image they’re looking for and you won’t see the ad. The HOSTS file can be found in _System Root_\System32\drivers\etc System Root is C:\Windows or C:\WINNT, depending on your OS version. ---
**Author:** ![Nobody](https://avatars.discourse-cdn.com/v4/letter/n/94ad74/32.png) [@Nobody](https://boards.straightdope.com/u/Nobody)\ **Post date:** [November 22, 2003, 9:08am UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/6 "2003-11-22T09:08:52Z")
Well, the Hosts.sam file only had 127.0.0.1 so that’s not it. I do remember a hijacker problem in the past where the problem was in the Hosts file, so I’m surprised that I didn’t think of checking that myself. Anyway, thanks though. ---
**Author:** ![Nobody](https://avatars.discourse-cdn.com/v4/letter/n/94ad74/32.png) [@Nobody](https://boards.straightdope.com/u/Nobody)\ **Post date:** [November 22, 2003, 9:15am UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/7 "2003-11-22T09:15:32Z")
> [@](#): > > \*Originally posted by Valgard \* > \*\*Start by checking the system Registry (assuming you are comfortable poking around there). I’d begin under: > > HKEYLocalMachine-Software-Microsoft-Internet Explorer > > Check the Search key. > > Also check under HKEYLocalMachine-Software-Microsoft-Windows-CurrentVersion-Run and see if there’s anything related to that bit of nastiness set to start up automatically. \*\* I found something in the local registry I thought that maybe deleting it would help, a couple of entries for IEAK but, nope, that wasn’t it. Anyway, I’m trying your suggestion right now. Thanks. Hmmm, a lot of references to [http://search.microgirls.com/index.html](http://search.microgirls.com/index.html) Never heard of it before, the but name alone obviously seems to be porn and may be contributing to my problems. ---
**Author:** ![Nobody](https://avatars.discourse-cdn.com/v4/letter/n/94ad74/32.png) [@Nobody](https://boards.straightdope.com/u/Nobody)\ **Post date:** [November 22, 2003, 9:19am UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/8 "2003-11-22T09:19:20Z")
Oops, I forgot that posting a link would make it active. If a mod could edit my last post and, I guess you would say, deactivate it please, thank you. ---
**Author:** ![JRootabega](https://avatars.discourse-cdn.com/v4/letter/j/8e7dd6/32.png) [@JRootabega](https://boards.straightdope.com/u/JRootabega)\ **Post date:** [November 22, 2003, 11:53am UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/9 "2003-11-22T11:53:17Z")
The file is actually just called hosts. hosts.sam is the sample file. I’d say search for the file on your entire hard drive, because on Windows98 at least, it’s \Windows\hosts ---
**Author:** ![Nobody](https://avatars.discourse-cdn.com/v4/letter/n/94ad74/32.png) [@Nobody](https://boards.straightdope.com/u/Nobody)\ **Post date:** [November 22, 2003, 4:09pm UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/10 "2003-11-22T16:09:55Z")
Actually, I found the **real** problem last night finally. I was using Askar web accellerator and when I turned it off, everything went back to normal. So I uninstalled it and I’m now looking around for different web accelerators, freeware accelerators to be specific. Ones other than Askar, NetSonic (no way), or NetAccelerator (which turned out to be shareware anyway). ---
**Author:** ![Valgard](https://avatars.discourse-cdn.com/v4/letter/v/7feea3/32.png) [@Valgard](https://boards.straightdope.com/u/Valgard)\ **Post date:** [November 22, 2003, 5:50pm UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/11 "2003-11-22T17:50:55Z")
Neutron Star - Spybot will protect against spyware hijacking your HOSTS file. On the “Immunize” screen down at the bottom there’s a box you can check to lock your HOSTS file. You can also prevent changes to your home page and lock down access to the IE control panel from within IE. Very handy app! ---
**Author:** ![Wheel](https://avatars.discourse-cdn.com/v4/letter/w/4da419/32.png) [@Wheel](https://boards.straightdope.com/u/Wheel)\ **Post date:** [November 22, 2003, 6:50pm UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/12 "2003-11-22T18:50:49Z")
take a look at these 2 sites: [http://www.spywareinfo.com/articles/hijacked/#removal](http://www.spywareinfo.com/articles/hijacked/#removal) [http://mjc1.com/mirror/hjt/](http://mjc1.com/mirror/hjt/) ---
**Author:** ![Nobody](https://avatars.discourse-cdn.com/v4/letter/n/94ad74/32.png) [@Nobody](https://boards.straightdope.com/u/Nobody)\ **Post date:** [November 22, 2003, 7:38pm UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/13 "2003-11-22T19:38:23Z")
> [@](#): > > \*Originally posted by Valgard \* > \*\*Neutron Star - > > Spybot will protect against spyware hijacking your HOSTS file. On the “Immunize” screen down at the bottom there’s a box you can check to lock your HOSTS file. You can also prevent changes to your home page and lock down access to the IE control panel from within IE. > > Very handy app! \*\* I’ve tried locking my homepage before. Only problem is, if **I** want to change the homepage myself, I have to bring up Spybot, remove the lock, change the homepage, then lock it again. But then again, if you change your homepage as infreqently as I do, which is pretty much never, then it’s a pretty good feature I guess. ---
**Author:** ![handy](https://avatars.discourse-cdn.com/v4/letter/h/b5a626/32.png) [@handy](https://boards.straightdope.com/u/handy)\ **Post date:** [November 22, 2003, 10:38pm UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/14 "2003-11-22T22:38:25Z")
Could it be: Trojan.Qhosts is a Trojan Horse that will modify the TCP/IP settings to point to a different DNS server. When the Trojan.Qhosts HTML file is opened, it performs the following actions: 1. Creates the file, %System%\Aolfix.exe. 2. Executes the Aolfix.exe file, which then performs the following actions: ---
**Author:** ![handy](https://avatars.discourse-cdn.com/v4/letter/h/b5a626/32.png) [@handy](https://boards.straightdope.com/u/handy)\ **Post date:** [November 22, 2003, 10:42pm UTC](https://boards.straightdope.com/t/help-undetectable-browser-hijacker/214632/15 "2003-11-22T22:42:20Z")
ah URL for above: > **[Symantec Security Center](https://www.broadcom.com/support/security-center)** > > Symantec security research centers around the world provide unparalleled analysis of and protection from IT security threats that include malware, security risks, vulnerabilities, and spam.