Hi everyone,

My IE got hijacked now whenever I open my IE its start page comes as shown in the picture attached. I have tried eliminating it through MS Spyware, Ad-aware, and Spybot but nothing happened... please help me... WHAT TO DO???

go to this site: http://asia.cnet.com/enterprise/apps/0,39035809,39199958,00.htm

i hope it helps

Edit: there is also some good info on this site (it has a very straight forward, "Step-by-step: Reclaiming a hijacked Internet Explorer" tutorial)

quote:

---

Originally posted by Joa
I have tried eliminating it through MS Spyware, Ad-aware, and Spybot but nothing happened

---

A really useful program for this is Hijack This

When you run it, a list of of files and keys will appear. There will probably be one like this:

HKCU\Software\Micorosft\Internet Explorer\Main,Start Page = <the site that your internet now starts at when hijacked>

Check this key and click fix checked.

Do not delete anything unless you are completely sure it is something bad

I also recommend trying CWShredder which runs a scan and is really good.

Use HijackThis:

http://www.richardthelionhearted.com/~merijn/files/hijackthis.zip

Let it scan and search google for all entries you don't trust. Then use repair to remove the entry/let it be changed to default value.

quote:

---

Originally posted by monster.rat
A really useful program for this is Hijack This

When you run it, a list of of files and keys will appear. There will probably be one like this:

HKCU\Software\Micorosft\Internet Explorer\Main,Start Page = <the site that your internet now starts at when hijacked>

Check this key and click fix checked.

Do not delete anything unless you are completely sure it is something bad

I also recommend trying CWShredder which runs a scan and is really good.

---

quote:

---

Originally posted by Markus

quote:

---

Originally posted by monster.rat
A really useful program for this is Hijack This

When you run it, a list of of files and keys will appear. There will probably be one like this:

HKCU\Software\Micorosft\Internet Explorer\Main,Start Page = <the site that your internet now starts at when hijacked>

Check this key and click fix checked.

Do not delete anything unless you are completely sure it is something bad

I also recommend trying CWShredder which runs a scan and is really good.

---

That's not enough! He has a browser hijacker that keeps changing it's homepage at startup, but it shows about:blank in the addres bar. I've had the same hijacker.

---

CWShredder only removes CoolWebSearch variants....

quote:

---

Originally posted by buzz

quote:

---

Originally posted by Joa
I have tried eliminating it through MS Spyware, Ad-aware, and Spybot but nothing happened

---

have u tried deleting ur cookies, files(online and offline) and ur history?

---

quote:

---

Originally posted by monster.rat
A really useful program for this is Hijack This

When you run it, a list of of files and keys will appear. There will probably be one like this:

HKCU\Software\Micorosft\Internet Explorer\Main,Start Page = <the site that your internet now starts at when hijacked>

Check this key and click fix checked.

Do not delete anything unless you are completely sure it is something bad

I also recommend trying CWShredder which runs a scan and is really good.

---

quote:

---

Originally posted by Markus
That's not enough! He has a browser hijacker that keeps changing it's homepage at startup, but it shows about:blank in the addres bar. I've had the same hijacker.

---

I had to same one a few months back. I think i uninstalled IE then reinstalled it. Seemed to fix it but i also kept spybot running under the net protect thingie.

Solution here

quote:

---

Originally posted by uberdosis
Solution here

---

quote:

---

Originally posted by Caboose
Firefox is not a solution to spyware. It's just as vulnerable as other browsers, it just takes time for people to find the exploits.

As for something more relevant... well, I'm not totally sure what to do . Maybe you could install CodeStuff's Starter and see what programs are running at startup, then disabling the ones you don't know.

---

Close all Internet Explorer windows then goto your Control Panel (Start > (Settings) > Control Panel

Double Click Internet Options
Click Advanced
Uncheck Enabled third-party browser extensions (requires restart).
Click Ok.

Next click Start > Run > type the following (or copy)

code:

---

ren c:\windows\system32\drivers\etc\hosts hosts2

---

http://www.d-a-l.com/help/archive/index.php/t-574.html

this guy and a few others found a way

Give Microsoft Anti-Spyware a try, It might fix it.

quote:

---

Originally posted by mwe99
I had to same one a few months back. I think i uninstalled IE then reinstalled it. Seemed to fix it but i also kept spybot running under the net protect thingie.

---

quote:

---

Originally posted by wj
Give Microsoft Anti-Spyware a try, It might fix it.

---

quote:

---

Originally posted by buzz
http://www.d-a-l.com/help/archive/index.php/t-574.html

this guy and a few others found a way

---

you need to also clear your host file in the c:\windows\system32  folder as this can store browser hijack info and prevent the system from completely getting rid of it

then use Ad-aware se to lock the host file

quote:

---

Originally posted by squall_leonhart69r
you need to also clear your host file in the c:\windows\system32  folder as this can store browser hijack info and prevent the system from completely getting rid of it

then use Ad-aware se to lock the host file

---

quote:

---

Originally posted by waqastariq

quote:

---

Originally posted by Markus
That's not enough! He has a browser hijacker that keeps changing it's homepage at startup, but it shows about:blank in the addres bar. I've had the same hijacker.

---

Yeah, Finally someone getting me... so any idea what should I be doing?

---

quote:

---

Originally posted by chris4
4. Untick any files that you do not recconise.

---

quote:

---

Originally posted by chris4
If this is the case, follow these instructions.

1. Start > Run > Type msconfig
2. A box will come up. Click on the startup tab.
3. The ticked files are the ones that run when you first startup your computer.
4. Untick any files that you do not recconise.
5. restart your computer.

Hope that helps

---

I have never seen se.dll, but I can tell you it is NOT trustworthy. Uncheck both of them and apply the settings. Anything in your Temp or LocalSettings folder usually isnt trustworthy, and any DLLs or anything beginning with Rundll also has a small chance of being untrustworthy.

I will search for more information about se.dll later, for now, remove it. Also, can you attach a screenshot of the Services tab? (make sure you select 'Hide all microsoft services' before taking the screenshot)

Also, end any tasks called 'RunDll32' in your task manager before unticking it, or it will just reenable itself. I suggest you right click System and click End Process Tree to end all processes before doing this aswell, then using the Task Manager to start msconfig.

quote:

---

Originally posted by ShawnzAlso, can you attach a screenshot of the Services tab? (make sure you select 'Hide all microsoft services' before taking the screenshot)

---

quote:

---

Originally posted by Shawnz
I have never seen se.dll, but I can tell you it is NOT trustworthy. Uncheck both of them and apply the settings. Anything in your Temp or LocalSettings folder usually isnt trustworthy, and any DLLs or anything beginning with Rundll also has a small chance of being untrustworthy.

---

Well im not sure I can help you here but heres the information on se.dll promised to you earlier. Also, try a general Search of your computer for se.dll, you could be lucky

File Name:       se.dll
Description:
    Se.dll is a IE Browser Helper Object of adware SCBar/SearchExe variant. It adds a toolbar to Internet Explorer and generates popup ads while online.

quote:

---

Originally posted by inc_haydn
Well im not sure I can help you here but heres the information on se.dll promised to you earlier. Also, try a general Search of your computer for se.dll, you could be lucky

File Name:       se.dll
Description:
    Se.dll is a IE Browser Helper Object of adware SCBar/SearchExe variant. It adds a toolbar to Internet Explorer and generates popup ads while online.

---

quote:

---

Originally posted by Markus
please do a scan with HijackThis and attach the log file here. I'll tell you which entries to select and remove/reset 

---

quote:

---

Originally posted by Markus

quote:

---

Originally posted by Markus
please do a scan with HijackThis and attach the log file here. I'll tell you which entries to select and remove/reset 

---

---

Ok... as you can see the se.dll file is in multiple entries.

Also I can't find any info regarding bogj.dll, but I'm not sure if it's a virus. I recommend you also check the bogj entries. You can always restore a backup or do a system restore.

Select the following entries and choose 'fix checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\PRIMEC~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\PRIMEC~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {977E10FC-95FE-4399-A349-C505A1DC502B} - C:\WINDOWS\system32\bogj.dll
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\PRIMEC~1\LOCALS~1\Temp\se.dll,DllInstall
O18 - Filter: text/html - {7D305B7D-30C4-4C85-9BC0-1F29990A9E6F} - C:\WINDOWS\system32\bogj.dll
O18 - Filter: text/plain - {7D305B7D-30C4-4C85-9BC0-1F29990A9E6F} - C:\WINDOWS\system32\bogj.dll

quote:

---

Originally posted by Markus
Ok... as you can see the se.dll file is in multiple entries.

Also I can't find any info regarding bogj.dll, but I'm not sure if it's a virus. I recommend you also check the bogj entries. You can always restore a backup or do a system restore.

Select the following entries and choose 'fix checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\PRIMEC~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\PRIMEC~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {977E10FC-95FE-4399-A349-C505A1DC502B} - C:\WINDOWS\system32\bogj.dll
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\PRIMEC~1\LOCALS~1\Temp\se.dll,DllInstall
O18 - Filter: text/html - {7D305B7D-30C4-4C85-9BC0-1F29990A9E6F} - C:\WINDOWS\system32\bogj.dll
O18 - Filter: text/plain - {7D305B7D-30C4-4C85-9BC0-1F29990A9E6F} - C:\WINDOWS\system32\bogj.dll

---

You could try to manually remove the two dll files in the log.
"C:\DOCUME~1\PRIMEC~1\LOCALS~1\Temp\se.dll"
"C:\WINDOWS\system32\bogj.dll"

You might need to boot in save mode to remove them. Also use the Windows search to search your hdd for more copies of se.dll/bogj.dll

quote:

---

Originally posted by Markus
You could try to manually remove the two dll files in the log.
"C:\DOCUME~1\PRIMEC~1\LOCALS~1\Temp\se.dll"
"C:\WINDOWS\system32\bogj.dll"

You might need to boot in save mode to remove them. Also use the Windows search to search your hdd for more copies of se.dll/bogj.dll

---

No problem .

To make sure you don't get any errors (for missing files) or something like that, run HijackThis and again 'fix' all the entries containing se.dll / bogj.dll.

quote:

---

Originally posted by Markus
No problem .

To make sure you don't get any errors (for missing files) or something like that, run HijackThis and again 'fix' all the entries containing se.dll / bogj.dll.

---

quote:

---

Originally posted by Caboose

quote:

---

Originally posted by uberdosis
Solution here

---

Firefox is not a solution to spyware. It's just as vulnerable as other browsers, it just takes time for people to find the exploits.

As for something more relevant... well, I'm not totally sure what to do . Maybe you could install CodeStuff's Starter and see what programs are running at startup, then disabling the ones you don't know.

---