Attempted Browser Hijack?

[Easy Mac]

Ad-aware keeps coming up with a registry key that it says is an attempted browser hijack. It says something is attempting to hijack IE and change my startup page, and after I remove it I get sent to the MSN homepage.

The thing is, the only site I visited in the meantime (its come up twice) was FOFC, and I used mozilla. I have no idea how this is happening, especially since I don't use IE, but its pretty annoying. Anyone have an idea, because it doesn't give me much of a desciption of the spyware.

I've also run a virus check and it turned up nothing, and Zone Alarm doesn't tell me anything is taking control of my computer remotely.

[Easy Mac]

OK, it found it again. I visited the FOFC, chud.com, fatwallet.com and baseballprimer. I only have had mozilla open. Zone Alarm came up with nothing.

Here is what it says.

<table class="default" cellspacing="0" cellpadding="4" bgcolor="#ecf5ff"> <tbody> <tr class="header" style="padding-right: 4px; padding-left: 4px;"><th align="left" width="80" bgcolor="#b6cce7" height="18">Vendor</th> <th align="left" width="80" bgcolor="#b6cce7" height="18">Type</th> <th align="left" width="80" bgcolor="#b6cce7" height="18">Category</th> <th align="left" width="165" bgcolor="#b6cce7" height="18">Object</th> <th align="left" width="53" bgcolor="#b6cce7" height="18">Comment</th></tr> <tr class="default"> <td class="normalborder" style="font-family: Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 8pt; line-height: normal; font-size-adjust: none; font-stretch: normal; color: rgb(51, 84, 123);" align="left" bgcolor="#f4faff" height="16">
</td> <td class="normalborder" style="font-family: Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 8pt; line-height: normal; font-size-adjust: none; font-stretch: normal; color: rgb(51, 84, 123);" align="left" bgcolor="#eaf5ff" height="16">Possible Browser Hijack attempt</td> <td class="normalborder" style="font-family: Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 8pt; line-height: normal; font-size-adjust: none; font-stretch: normal; color: rgb(51, 84, 123);" align="left" bgcolor="#f4faff" height="16">RegData</td> <td class="normalborder" style="font-family: Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 8pt; line-height: normal; font-size-adjust: none; font-stretch: normal; color: rgb(51, 84, 123);" align="left" bgcolor="#eaf5ff" height="16">Malware</td> <td class="normalborder" style="font-family: Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 8pt; line-height: normal; font-size-adjust: none; font-stretch: normal; color: rgb(51, 84, 123);" align="left" bgcolor="#f4faff" height="16">HKEY_CURRENT_USER:Software\Microsoft\Internet Explorer\Main"Start Page" ("about:blank")</td> <td class="normalborder" style="font-family: Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 8pt; line-height: normal; font-size-adjust: none; font-stretch: normal; color: rgb(51, 84, 123);" align="left" height="16">Possible browser hijack attempt</td></tr></tbody> </table>

[Easy Mac]

ok update...

if i delete the quarantined registry file, then it reverts to msn.com.
if i leave it, it stays at about:blank... where I want it.

So is ad-aware just screwing up and finding something that really isn't spyware? Should I just leave it, because it keeps coming back whenever I delete it.

[SackAttack]

I know sometimes IE will pull me to the Windows Update page when I fire IE up, if I haven't updated my computer in a while.

I wonder if that's what Ad-Aware is detecting.

[Easy Mac]

nah, everything is up to date. It just doesn't seem to like me using "about:blank" as my start page all of a sudden. I've ran like 5 different spyware, hi-jack tools, and ad-aware is the only one who has a problem with this. It just started today.

[sachmo71]

Did you check the Lavasoft FAQ to see if there is a specifc spy program that gives it trouble?

[fantastic flying froggies]

FWIW, I 've got a couple as well.

[Cuckoo]

Check on ZoneAlarm for the specific programs that are trying to access the internet. If you see something that doesn't look familiar, you may have a problem. I've just come down with one as well which wasn't detected by any of the spyware/adware programs. It was coming up on ZoneAlarm as Kern32 with various file names. I used a program called 2xexporer to finally eliminate it.

[FBPro]

Crap like this SUX!!!! One of our PC's is being attacked.

[Easy Mac]

Check on ZoneAlarm for the specific programs that are trying to access the internet. If you see something that doesn't look familiar, you may have a problem. I've just come down with one as well which wasn't detected by any of the spyware/adware programs. It was coming up on ZoneAlarm as Kern32 with various file names. I used a program called 2xexporer to finally eliminate it.
nope, none. It just seems that ad-aware doesn't like me to use about:blank as my IE homepage. Whenever I remove the supposed spyware, it reverts to msn.com. Then I scan and there is no hijack. Then I manually change the homepage to about:blank, and ad-aware says I have spyware. I think it may just be a malfunction or something.

[fantastic flying froggies]

EM, Same exact thing for me. The one worrying fact is that I have always had a blank page as my IE homepage, and ad-aware did not care about it before.
So something must have happened to the registry codes...

[Easy Mac]

Did you download the latest update also? It might have something to do with that (reference file 01R303 08.05.2004).

[fantastic flying froggies]

As a matter of fact, I just did today... I think you're on to something there...

[Easy Mac]

yeah, I downloaded it like Sunday, and its been doing it since then.