# This ain't your average browser hijacker! **URL:** \ **Category:** Factual Questions\ **Created:** [March 21, 2006, 12:25am UTC](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223 "2006-03-21T00:25:16Z")\ **Posts on this page:** 11\ **Page:** 2
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [March 21, 2006, 1:41pm UTC](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223/21 "2006-03-21T13:41:13Z")
Note: use at your own risk. I make no guarantees. Vundofix requires some manual entries in order to work. It also has to be used properly. Just running it probably won’t clean vundo (and I’m not sure if it’s even designed to detect it – just clean it). To see if it’s vundo, look for the O20 entries in the hijackthis log. It should have something like this: O20 - Winlogon Notify: jkkli - C:\WINDOWS\system32\jkkli.dll The name of the file and the location will be random, but it will consist of five characters and a .dll extension. The file will also show up in your O2 items. Write down the name and path given for the entry. Also, write down the path and reverse the letters in the file. Use a star extension. In this example, then it’d be: C:\WINDOWS\system32\ilkkj.\* Now, go to [http://www.atribune.org/downloads/VundoFix.exe](http://www.atribune.org/downloads/VundoFix.exe) and download the file. Save it to your desktop and click on it. A new folder will appear on your desktop. Restart the computer in Safe Mode. Open the vundofix folder and click on KillVundo.bat. At the first prompt, put the path to the file you found on Hijackthis O20 entry. At the second prompt, type the path to the reverse-named file with the \*. Vundofix will remove the file. It will then run hijackthis. Put a check by the O20 and O2 entries that have the name of the file (not reversed). Next, turn off your computer by pressing the power button and holding it in (do not shutdown normally). Restart and run hijackthis. The vundo entries will probably still be there, but they should have “(file missing)” beside them. Use Hijackthis to remove these and you should be fine. ---
**Author:** ![Mithril](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mithril/32/3517_2.png) [@Mithril](https://boards.straightdope.com/u/Mithril)\ **Post date:** [March 21, 2006, 1:46pm UTC](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223/22 "2006-03-21T13:46:18Z")
Double vouch. I use it on my home PC and in the office. ---
**Author:** ![Mithril](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mithril/32/3517_2.png) [@Mithril](https://boards.straightdope.com/u/Mithril)\ **Post date:** [March 21, 2006, 1:47pm UTC](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223/23 "2006-03-21T13:47:20Z")
> [@crowmanyclouds](#): > > Ewido? Vouch! > > CMC fnord! My last reply should, of course, have quoted this. ---
**Author:** ![BubbaDog](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bubbadog/32/333_2.png) [@BubbaDog](https://boards.straightdope.com/u/BubbaDog)\ **Post date:** [March 21, 2006, 2:32pm UTC](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223/24 "2006-03-21T14:32:36Z")
I once had problem processes that I couldn’t control. I went to [Answersthatwork.com](http://www.answersthatwork.com/) and downloaded their Ultimate Troubleshooter program. Their Glossary is also helpful if you want to look up explanation of some of the tasks in your task manager. It will identify a lot of problems and sometimes gives you directions on removal options. ---
**Author:** ![rayh](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rayh](https://boards.straightdope.com/u/rayh)\ **Post date:** [March 21, 2006, 2:58pm UTC](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223/25 "2006-03-21T14:58:25Z")
> [@duffer](#): > > In addition I’m running ZoneAlarm firewall, Windows firewall, IE pop-up blocker, and Panicware’s Pop-Up blocker. On a side note, I’m kind of impressed my system can handle all this and still perform with great speed. There is no need to run both ZoneAlarm and Windows firewall it will just slow your system down and they may interfere with each other. Like running two anti-virus programs at once. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [March 21, 2006, 3:33pm UTC](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223/26 "2006-03-21T15:33:46Z")
> [@rayh](#): > > There is no need to run both ZoneAlarm and Windows firewall it will just slow your system down and they may interfere with each other. ZoneAlarm [automatically disables the Windows XP firewall](http://www.zonelabs.com/store/content/company/products/xpInfoCenter/faq.jsp?dc=12bms&ctry=US&lang=en&lid=ts_xpsp2faq#7) when it is installed, so this cannot happen: > [@](#): > > If you are running a ZoneAlarm product (version 5.1 or higher), ZoneAlarm will disable Windows Firewall upon installation of XP SP2 so that the ZoneAlarm product is the only firewall running. This process was recommended by Microsoft because of the potential negative side effects of running two firewalls at the same time. ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [March 21, 2006, 3:56pm UTC](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223/27 "2006-03-21T15:56:55Z")
> [@Fear Itself](#): > > ZoneAlarm [automatically disables the Windows XP firewall](http://www.zonelabs.com/store/content/company/products/xpInfoCenter/faq.jsp?dc=12bms&ctry=US&lang=en&lid=ts_xpsp2faq#7) when it is installed, so this cannot happen: _IF_ you’re running a version of ZoneAlarm that programmed to detect the Windows Firewall. But the advice remains valid, don’t run the Windows firewall and ZoneAlarm. And use Firefox. Use Mozilla. Use Opera. Use SOMETHING besides IE or you’ll be right back where you are again X months from now. Use IE if a page doesn’t render properly in Firefox. But 90% of the time other browsers work fine. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [March 21, 2006, 4:11pm UTC](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223/28 "2006-03-21T16:11:05Z")
> [@control-z](#): > > _IF_ you’re running a version of ZoneAlarm that programmed to detect the Windows Firewall. _IF_ you download the latest version from the ZoneLabs website, this is irrelevant. Kind of hard not to actually, as ZoneAlarm nags you whenever a new upgrade is released. Now, if you willfully ignore the upgrade notices and cling to that version you downloaded in 1999, yes it might be a problem. ---
**Author:** ![rayh](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rayh](https://boards.straightdope.com/u/rayh)\ **Post date:** [March 21, 2006, 4:22pm UTC](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223/29 "2006-03-21T16:22:23Z")
> [@Fear Itself](#): > > _IF_ you download the latest version from the ZoneLabs website, this is irrelevant. Kind of hard not to actually, as ZoneAlarm nags you whenever a new upgrade is released. Now, if you willfully ignore the upgrade notices and cling to that version you downloaded in 1999, yes it might be a problem. And nothing stops you from turning the Windows firewall back on once ZoneAlarm is installed. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [March 21, 2006, 4:34pm UTC](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223/30 "2006-03-21T16:34:55Z")
> [@rayh](#): > > And nothing stops you from turning the Windows firewall back on once ZoneAlarm is installed. All I was offering was information to those who want to learn. ---
**Author:** ![Nanoda](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nanoda](https://boards.straightdope.com/u/Nanoda)\ **Post date:** [March 21, 2006, 4:41pm UTC](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223/31 "2006-03-21T16:41:46Z")
There have already been a million software recommendations, but when we get PCs with problems in at the office here, our IT guy (who deals with hardly anything _but_ spyware these days) recommends the [http://spywareinfo.com/](http://spywareinfo.com/) online scanner. [Previous page](https://boards.straightdope.com/t/this-aint-your-average-browser-hijacker/349223.md?page=1)