Thursday, February 24, 2011

Browser Tab got Hijacked(gg.blogpear.com)

Hi All,

Today morning when I have logged into my computer I have found that when click the tab on internet explorer

its going to some gg.blogpear.com/vscript...

The computer is also not behaving the same way as I would have expected.

I have scanned the computer as boot time.. & also scanned the computer for malware..

To remove this hijacking issue what I have did is removed the registry entries from the below path

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
 & then imported the registry entries from the uninfected computer.

below are the entries that have been imported (you can just paste them in notepad & change the extension to .reg.

After that merge it into your computer.... or export the entries from uninfected computer..

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"blank"="res://mshtml.dll/blank.htm"
"NoAdd-onsInfo"="res://ieframe.dll/noaddoninfo.htm"
"InPrivate"="res://ieframe.dll/inprivate.htm"
"NavigationFailure"="res://ieframe.dll/navcancl.htm"
"NoAdd-ons"="res://ieframe.dll/noaddon.htm"
"Home"=dword:0000010e
"PostNotCached"="res://ieframe.dll/repost.htm"
"DesktopItemNavigationFailure"="res://ieframe.dll/navcancl.htm"
"NavigationCanceled"="res://ieframe.dll/navcancl.htm"
"Tabs"="res://ieframe.dll/tabswelcome.htm"
"OfflineInformation"="res://ieframe.dll/offcancl.htm"
"SecurityRisk"="res://ieframe.dll/securityatrisk.htm"

8 comments:

  1. I have the same problem with my tab being hijacked....can you give a step by step solution for a non-expert computer person like myself?

    Mary

    ReplyDelete
  2. 1. Go to start
    2. On run type regedt32
    3. Registry editor will open
    4. expand Hkey_Local_Machine
    5. expand software --> Microsoft --->expand --->Internet Explorer--->AboutURLs
    6. remove every entry inside AboutURLs.
    7. Now close regedt32
    8. Again go to start
    9. In the run type notepad
    10. paste the below lines in notepad

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
    “blank”=”res://mshtml.dll/blank.htm”
    “NoAdd-onsInfo”=”res://ieframe.dll/noaddoninfo.htm”
    “InPrivate”=”res://ieframe.dll/inprivate.htm”
    “NavigationFailure”=”res://ieframe.dll/navcancl.htm”
    “NoAdd-ons”=”res://ieframe.dll/noaddon.htm”
    “Home”=dword:0000010e
    “PostNotCached”=”res://ieframe.dll/repost.htm”
    “DesktopItemNavigationFailure”=”res://ieframe.dll/navcancl.htm”
    “NavigationCanceled”=”res://ieframe.dll/navcancl.htm”
    “Tabs”=”res://ieframe.dll/tabswelcome.htm”
    “OfflineInformation”=”res://ieframe.dll/offcancl.htm”
    “SecurityRisk”=”res://ieframe.dll/securityatrisk.htm”

    11. Save the file with tany name for example:- abouturl on desktop.
    12. right click the saved file & change its extension to .reg
    (you will only be able to change extension if extension are not hidden)--if you want to know that process as well then reply back.

    12. Double click the saved file to merge it.

    your issue is solved now :)

    ReplyDelete
  3. Thank you for you prompt response to my problem.

    I will try this.

    Mary

    ReplyDelete
  4. ok thanks for the step by step walkthrough i mananged to save the file as a reg file I think, I have like an icon with fragmented blue squares for the file on my desktop, however how do I merge it and where to? i thought regedt32 so I opened that and tried draging it into the About URL folder on the right, but nothing happens and I still have this annoying blogspear thing on my tab

    ReplyDelete
  5. um nevermind, blank mind moment zi realised zi just had to double click the file not right click oops. thanks.

    ReplyDelete
  6. damn tab is still bogpear. might have to reboot

    ReplyDelete
  7. Thanks this worked!!

    ReplyDelete