Firefox Home Page effectively hijacked by Yahoo Search

[Sebastian42]

It seems that my Firefox has been hijacked by

http://au.yhs.search.yahoo.com/avg/...oo_avg_hs2-t-web_au&p=au.yhs.search.yahoo.com

It causes disablement - maybe because there is a conflict between it and my chosen home page, which is STILL showing as the one I chose. Sometimes my chosen home page wins out for a short while, but then gets replaced by the yahoo search; sometimes my own does not even get a chance. This conflict appears to disable other browsers from accessing the internet as well. I have received notifications like "A program on your computer has suggested a new default search provider for Internet Explorer." and even a dialog box with a choice of whether I really want to change. It is to no avail, YHS remains dominant. I've even replaced 'default search provider' in the Registry with my own choice, but after rebooting Yahoo is back in that key. How can I get rid of YHS and get my own choice back ?

 

[kjv1611]

Sebastian42,

Yeah that should work.

However, you could get around the multiple hard drives by creating images files on ONE hard drive on whatever time basis you want to use. Then, when you want to restore, you just have to boot to a bootable partition manager, and delete the existing partition, restoring whichever saved image you want to use.

The easiest option for this type setup, I think, is to just pick up a copy of Acronis TrueImage, and let it do all the work for you. Yeah, it costs $30, but it'd be cheaper than multiple hard drives. And you could still keep even all your images backed up twice - use one data hard drive, and one back-up of data.

But whatever works for you. I just think this method would be much wiser, considering the multiple connections you're mentioning. Either doing multiple image files on your own, or else using Acronis TrueImage. Of course, Norton Ghost does the same, I've just not used it very much at all.

--

"If to err is human, then I must be some kind of human!" -Me

 

[Sebastian42]

kjv1611
That sounds a very up-market way of achieving my goal without the wear and tear on me and on the HDD connections.

In fact, I wouldn't even have to use images - which I do NOT understand anyway.
I could make several partitions on a large slave HDD, and use my current cloner, Casper5, to clone to one partition after another in turn. I could keep using the same HDD as my Master, and never touch the connectors again (for THIS purpose)!
For Identification purposes I might have to gradually increase the size of the partitions e.g. 40Gb, 41Gb, 42Gb etc

Back to my original problem - I have also run Microsoft Malicious Software Removal Tool - it found NO infections !

Since GMER showed me a category called Rootkit/Malware, I have used Sophos anti rootkit, but its results included all but the kitchen sink as 'unknown hidden files' and it warned
me not to delete anything 'without informed consent'.

And I am left with a system that appears to respond to network congestion by fabricating a hijacked looking URL !
I say that because 'the fault' is quite intermittent and most prevalent around 8am and 4pm. What a quandarry !

 

[goombawaho]

You have fried a lot of brain cells on this. Next steps:

1. Back up data
2. DBAN to wipe the drive
3. Reload XP
4. Restore data
5. Happiness

 

[Sebastian42]

goombawaho
Data is a valuable part of what would be lost if I reformatted
the HDD, but by NO means the only valuable part. Years of adding, updating and tweaking of programs would also be lost.
and so DBan/Fdisk/Repartitioning and re-installing would be the absolute LAST thing I would consider.
I might even prefer to live with the intermittent non-access to the internet...

 

[Turkbear]

Hi,
I did not see any response to my idea about using ComboFix...

This is the only program I found that could eliminate the overclick.cn trojan( virus/rootkit, whatever) which is known for hijacking search engine URLs .

If you haven't tried it yet, I recommend it highly..
Read the full details on its that link I posted:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

If you did use it and still have an issue, have you uninstalled/rebooted/reinstalled firefox to see if that helps?



To Paraphrase:"The Help you get is proportional to the Help you give.."

 

[Sebastian42]

Turkbear
I downloaded DDR (is it ?) but have not yet got to use it as you suggest. This is still a work in progress.

The main stumbling block at the moment is the intermittency -
just becaue I can access the internet does not mean I wouldn't encounter ask/avg/yahoo/search in the address line next time.

Thank you for 'sticking with it'.

 

[Turkbear]

Hi,
Not DDR, ComboFix.exe from a link on the site I posted - There are full instructions there on using it ( it is very powerful, so read first, then use as directed).






To Paraphrase:"The Help you get is proportional to the Help you give.."

 

[Sebastian42]

Sorry - I thought DDR was what downloaded from the ComboFix -
I'll have to re-cover that ground.

 

[Sebastian42]

I know this is getting away from the original topic, but since
kjv1611 suggested gathering all my clones into one HDD to avoid wear and tear on connectors, I want to recount what happened : I bought a new 3.5" 320Gb IDE HDD for the purpose
Fdisking from a boot floppy showed only 32Gb.
CheckDisking (to remedy that) did not seem to start.
Paragon Partition Manager on Hiren's Boot CD, could 'see' 298Gb, and divide them suitably. With Nortons Partition Magic (also on Hiren's Boot CD) I could format all 8 partitions.

However Window Explorer shows the drive but no size and 'Manage' in Properties of My Computer shows only 128Gb !

????????????????????????????

 

[kjv1611]

Hmm, that is strange. I would think it'd be your BIOS, but if so, I'd think it'd be the same accross all programs. Then again, it's worth a check. Try checking with the motherboard manufacturer's site for any BIOS updates, and see if they correct such errors. I know that many BIOS had to be updated when the large disks first started becoming available.

--

"If to err is human, then I must be some kind of human!" -Me

 

[Sebastian42]

That first 320Gb HDD was seen as 320Gb by BIOS. It was Windows Explorer that did not recognise the partitioning and it was Manage in My Computer that showed only 128Gb. The shop I bought it from kindly let me try another HDD from their stock.
Without doing any fdisking or partitioning, I went directly to
MY Computer's Manage, and it ALSO showed only 128Gb. The shop then connected it to their PC and in Manage it showed as 320Gb
That points the finger of blame at my PC or the combination of my PC and that batch of HDDs. I got a refund for that HDD and intend to get one from another shop, as a first step.
B.T.W. The original problem of address-bar hijacking by ASK/AVG/YAHOO/SEARCH is not occuring currently - on a drive that was NOT treated to all the scanning reported on above.

 

[Sebastian42]

Sure enough - when I changed the o/s with which I tried to look at the 320Gb HDD, from just raw WinXP-Pro, to WinXP-Pro/SP3, the problem went away (i.e. 320Gb was recognised).

OF COURSE there is a new problem : After using Casper5 to (very efficiently) partition the 320Gb into 6.2Gb and then incrementally increasing partitions from 40Gb up, Casper told me it couldn't clone the 5.8Gb WinXP-Pro/Sp3-plus-Casper5 to the 6.2Gb partition because there were valuable files in it !

I definitely need a bootable system in that first small partition (and it must contain the cloner, Casper5, too).

 

[Sebastian42]

Making that first partition a little bigger fixed that problem

 

[kjv1611]

I was about to say that your problem was sounding like it was missing an update for Windows. So yeah, that's why XP SP3 worked when "plain ole" XP didn't... I'm assuming your "plain ole" XP partition is running before SP1 and/or SP2. Service Pack 2 (SP2) had a TON of important updates for Windows. But it may have actually been SP1 that fixed the drive size issues - I forget. I wouldn't doubt if one of the other guys around here can tell you date and time when that fix occurred, as well as its kb number (the reference number of the update). [LOL]

--

"If to err is human, then I must be some kind of human!" -Me

 

[Sebastian42]

The post from which I got that idea did mention SP1.

For the moment, both the drive partitioning problem, and the home page hijacking no longer impede my progress.
I suspect hijacking will be back, but in some strange way it seems to be related to Network Congestion.

So adieu to all the helpfull contributors in this record-making long thread.

 

[goombawaho]

From your comment about "the last thing you would do" above, I think you have a big problem.

You have to be able to reload your computer at any time due to a hard drive or motherboard failure. That means backup of data is the number one thing.

But you're bigger problem is being "in love" with your configuration. If it's that important to you, invest in something like Ghost or Acronis and do an image of your PC periodically ONLY for the Windows installation aspect of things. Keep doing a more frequent backup of data.

I know it's easy to covet the same old, same old in terms of what you've got, but the rug can get pulled out from under you so fast, you need to be able to recover with as little data loss and mental pain as possible.

 

[kjv1611]

Sebastian42,

goombawaho makes a very good point. In reality, if you have some business purpose for needing things just so, then investing in one of the imagine programs he mentioned would be WELL worth it.

But here's another piece to this. Say it was your motherboard that failed, and you couldn't find a ready replacement of the exact same model#? At that point, you may very well be up the creek, and be forced to change - whether you've got 5 backups or 500 backups, it wouldn't matter if you couldn't get the same board... there are sometimes ways around this, but they are a headache, or so I've read, and oftentimes it's difficult to impossible to get everything back to exactly what it was.

So, all that said... if it is the case you need this for some business purpose, and the loss would be catastrophic, I'd suggest a couple of different possible approaches:

1. Make sure to check every piece of hardware on your machine, or at least the CPU/RAM/MOTHERBOARD/HARD DRIVE/GRAPHICS CARD, ETC - I'd not worry at all about optical drive, floppy, things like that... well if you also NEED a floppy, that'd be worth worrying about. Then have at least 1 if not 2 replacements for each part ready and on hand.

2. If your system is an OEM system, such as Dell or HP, then you might could scour ebay or some other site for used models, and pick up a couple to just have in case.

Using one of these methods, if any major component other than your hard drive fails, you could swap it to the back-up system, or swap in the backup hardware, and keep on rolling. Then you'd still have whatever data/system back-up plan in place, so it wouldn't matter.

If it isn't important enough to go to that extent, then I suggest it is not important enough to worry about anything but the data, aside from perhaps using Acronis or Ghost to run incremental backups for you.

--

"If to err is human, then I must be some kind of human!" -Me

 

[Sebastian42]

Neither of you have said it, but I think both of you imply that a WinXP system (i.e. NTFS, UNLIKE a FAT system) has to keep running in the same PC - or at least in PC's that are sufficiently similar.

I cracked that nut a long time ago.

The WinXP in my current system has migrated through 3 previous PCs, in which the HDD would not boot until I worked some magic on it.

I'm happy to explain/expand should you want me to.

 

[goombawaho]

No thanks - I'm emotionally spent on this thread.