Browser Highjacking Story

[seracca]

I have a story to tell. :) Might help someone to hear it.

Suddenly my browser home page began changing to a piece of crap called " www.thebestse.com" My google search was changed as well, and every time I re-set all of it, it would change back.

I did a TraceRoute and found the puke that was responsible and sent him the following e-mail

-----

Your sh--it has taken over my browser, without my consent, and I have
been unable to rid myself of it.
I am referring to this url that keeps replacing my homepage.

"www thebestse.com"

I have done a trace route and have the pertinent information about you
and your hosting company.

Tell me how to rid myself of your garbage at once or I will take
further action!

-----

Within a half hour I get this

-----

Hello Loris,

We receive many letters that our search system
is established as a homepage each time when
computer restart. We have no attitude to this,
our search system is advertised by hundreds of
webmasters and we cannot follow
everyone. At present we use the best
efforts to find out who in it is guilty.
We shall be grateful to You if You inform us
page on which the harmfull program has been
installed.
We suppose You can fix this problem with
HijackThis software(free)
(http://www.spywareinfo.com/~merijn/)
Try to search registry(Start->Run->regedit) and change all keys
containing "thebestse.com". Then look in
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
and
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
and delete suspicious files there. If You are not sure, email us
contents of
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
and
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
of Your registry and we will try to help You.
Thanks for understanding.
--
Best regards,
TheBestSE
mailto:support@thebestse.com

----

What a load of crap! But the HighjackThis program did rid me of it. I figured, correctly, that they would know how to get rid of their own garbage :)

[Soritong]

Usually with those hijacking sites comes a bunch of crap adware and sometimes virii.

Might be a good idea to run a virus checker and AdAware too.

[noyfb™]

i just had a hijacking thing called "ncase"

It was everywhere on my pc.

took hours to get rid of it.

pestpatrol sorted most of it.

http://www.pestpatrol.com/pestinfo/n/ncase.asp

theres some info on the one i had.

dl pestpatrol though m8.

[MamaKin]

I used to have LOP. I never managed to get rid of it. It changed my search page to www.lop.com (http://www.lop.com) What a load of ****! I ended up formatting.


was wondering if when you install the google toolbar it would overide a possible changed search page in a hijacked browser(hope you understande that/not very clear,soz)

thanks,
craig

[seracca]

I used to have LOP. I never managed to get rid of it. It changed my search page to www.lop.com (http://www.lop.com/) What a load of ****! I ended up formatting.


was wondering if when you install the google toolbar it would overide a possible changed search page in a hijacked browser(hope you understande that/not very clear,soz)

thanks,
craigYes, it would change the search back to Google, until I re-booted ... then the crap was back. Same as with the homepage.
To be clear, I wasn't using the Google toolbar, but the registry hack to make google the default search in IE. This thing was obviously changing the registry whenever I booted.

One thing that bugs me is the load of crap the perps tried to hand me that

"We have no attitude to this, our search system is advertised by hundreds of
webmasters and we cannot follow everyone."

as if they aren't fully aware of what happens. The more I stew about it, I think I'll inform their hosting company. Can't hurt, and it might give thebestse.com a bit of a headache for a while. :)

[xdeity]

i had that problem a while ago, just ran adaware and it sorted it out. its a good idea these days to make sure your virus scanner is well uptodate as my scanner (avg) is constantly picking up trojans from web sites, usually the popups that google doesn't manage to catch:yell1:

[gooner]

Adaware/Spybot etc etc doesn't always resolve these hijacking issues. If you do have issues that appear to be Hijack related or wierd browsing issues, go to www.spywareinfo.com (http://www.spywareinfo.com) download Hijackthis and cwshredder and look at the info page and run them both. Then post your next hijack log and then someone should be able to help you out.

[seracca]

Adaware/Spybot etc etc doesn't always resolve these hijacking issues. If you do have issues that appear to be Hijack related or wierd browsing issues, go to www.spywareinfo.com (http://www.spywareinfo.com/) download Hijackthis and cwshredder and look at the info page and run them both. Then post your next hijack log and then someone should be able to help you out.
It is sorted for me .... the first post in this thread .. I ran exactly what you said. I was just posting for info for others.

Thanks

[Elaine]

To prevent this sort of trouble in the future, everyone should be running some sort of preventative software such as Spybot - Search & Destroy (http://www.safer-networking.org/index.php?page=spybotsd), and SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html) and SpywareGuard (http://www.wilderssecurity.net/spywareguard.html). Also be sure to update them regularly.

[Nuttapper]

I had a similar problem with a programme called Bridge.exe, aint got a clue where it came from, it tried to access the internet each time the PC was started, Zone Alarm stopped it, I found the programme and deleted it, then I kept getting a error message "bridge.exe was not found" I ran Adaware it found most of the crap, but kept geting the error message, I looked up Bridge.exe on google and found its a hack into the PC, the remainder of the programme was in the system registry and needed to be manually deleted... wonderful place the net eh !!

[Neo]

When a company recomends to use "HijackThis" to get rid of their software, thats when you know their guilty.

[seracca]

When a company recomends to use "HijackThis" to get rid of their software, thats when you know their guilty.
My thoughts exactly!:mad: