Browser hijackers take over your browser, change the home page and attempt to funnel you into their own sites whenever you surf. Learn how to fight back.
Web surfing isn’t the pleasure it once was. The dot.com bust has reduced the number of interesting, freely accessible sites. Pop-up, -under and -over advertisements make it almost impossible to view the page you’re after. And security holes in the major browsers make it necessary to bump up the security features to an annoyingly invasive level.
In addition to these daily irritations, there’s an unpleasant technique called browser hijacking which has become increasingly common. Browser hijacking is the use of scripting tools to modify your browser’s default settings. This may be as trivial as adding a new link to your Links or Favorites or as unconscionable as changing your home page persistently via a combination of scripting, registry changes and auto-running programs.
What’s the point of hijacking? To bring you back, over and over, to a site or a site’s sponsor, in the hope of boosting business. Hijackers also use the technique to track the sites you visit and analyse your browsing habits. Let’s face it, anyone who is prepared to kidnap you in this fashion has little regard for your privacy.
Who’s responsible for hijacking? Not surprisingly, the technique was pioneered by porn sites. Owners of porn sites have traditionally been on the cutting edge of designing techniques to keep users trapped on their sites. They were first with multiple windows which would pop up as you tried to leave the site, and they’ve used all sorts of techniques – windows half off screen so they’re hard to close, windows without any controls whatsoever – to chain visitors to their sites.
Where porn site owners venture others soon follow. Many sites offering ‘freebies’ have taken browser hijacking to their bosom.
But it’s not merely the Internet’s out-and-out lowlifes who engage in this sort of activity. For years, companies such as Microsoft, Netscape and many others have been adding links and changing browser settings without permission. One example: When you install AOL or any of its affiliated programs, such as ICQ or AOL Instant Messenger, without asking it adds http://free.aol.com to Internet Explorer’s Trusted Sites zone. Any site in the Trusted Site list is treated as a ‘safe site’ and by default all of IE’s security options are set at their least restrictive for these sites. This means if you visit the AOL site, AOL can run any script, download items to your desktop and perform a variety of functions without requesting your permission.
AOL/Netscape -- in most untrustworthy fashion -- automatically adds itself to Internet Explorer's Trusted Sites zone. To eliminate it: Select Internet Options from the Tools Menu, click the Security tab, click Trusted Sites and then the Sites button, locate http://free.aol.com in the list of sites, select it, then click Remove.
It’s easy enough to undo such changes. Indeed, most browser hijackings require little more than a resetting of options.
Some browser hijackings, though, are more pernicious. Take, for example, home page hijacking. In its simplest form, home page hijacking is very easy to recover from: Select Internet Options from the Tools Menu, on the General tab type your desired home page’s address into the Home Page box, and click OK.
That’s easy enough. But some home page hijackings go further. Three techniques used include:
How do you fall prey to a browser hijacking? There are numerous ways. Here are some common ones:
Fortunately, most hijacking attempts can be prevented by using a few commonsense measures:
Note: These instructions involve editing the registry and other advanced techniques. Do not attempt these procedures without making proper backups (read Backing Up and Restoring the Windows Registry to learn how) and don’t attempt them at all if you’re not familiar with registry editing.
If your Control Panel’s Internet Options have been disabled, get them back by locating the file control.ini (use Start -> Find/Search to locate it). Open control.ini in Notepad and look for the lines:
[don’t load]
inetcpl.cpl=yesDelete the second of these two lines, close and save the file and reboot your computer. (Click the image below to see a full-sized image.)
a. Click Start -> Run, type regedit and click OK to open the Registry Editor.
b. Navigate to:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
If you find sub-folders called restricted or control panel, delete them. Check for the same sub-folders in:
HKEY_LOCAL_MACHINE\ Software\Policies\Microsoft\Internet Explorer
and delete them, too, if they exist. Then close Regedit.
a. Open the Registry Editor and navigate to:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Change the Search Page value to:
http://home.microsoft.com/access/allinone.asp
and, if it exists, change the Search Bar value to:
http://search.msn.com/spbasic.htm
b. Navigate to:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL
and change the default value to:
http://home.microsoft.com/access/autosearch.asp?p=%s
c. Navigate to:
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search
Change the SearchAssistant value to:
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
and change the CustomizeSearch value to:
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
b. Still in msconfig, click the System.Ini tab and click the + beside [boot] to expand the section. Look for a line reading shell=explorer.exe. The line should read exactly that; delete any following commands, but make sure you leave shell=explorer.exe intact.
Note: If you’re using Windows NT, 2000 or XP, this information is contained in the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
which should contain the value explorer.exe.
c. Click OK to exit from msconfig and reboot your system.
© 2002 Rose Vines, www.geekgirls.com
