Browser Hijacking

This is a trend that is becoming more and more common. The browser settings of web surfers are being forcibly hijacked by malicious web sites and software (see Adware and Spyware), which modifies your default start and search pages. Sometimes Internet shortcuts will be added to your favorites folder without asking you. The purpose of this is to force you to visit a web site of the hijacker's choice so that they can artificially inflate their website's traffic for higher advertising revenues.

In some cases, these changes are reversible simply by going into Internet Options and switching them back. Not always, however. Sometimes it becomes necessary to edit Windows  "behind the scenes" to undo the changes made. Sometimes there are settings and files clandestinely placed on your hard drive that redo the hijacker's settings every time you reboot the computer.

Often accused of being drive-by downloads, these pesky Internet parasites can quickly take advantage of an improperly secured system, embedding themselves as a "browser help object" and redirecting you to a host of unsavory sites.

How To Tell

It's generally pretty easy to tell when your browser has been hijacked. Not only will your homepage be changed to visit a porn or advertising-filled site, but also  quite often you'll be deluged with pop-ups and several new Internet shortcuts will appear on your Favorites menu. These pests usually include some form of spyware or adware, programs that monitor your Internet use and build a profile of your habits designed to send even more advertising your way.

Some of this software purports to be useful, and many are in the form of a "Search Bar" – search facilities added to your browsing software. These are called Browser Helper Objects (BHO). An example of a bad BHO is Surfbar. This BHO is installed without permission by exploiting a vulnerability in Microsoft Internet Explorer. The Surfbar BHO, also known as Junkbar and Pornbar, changes the Internet Explorer start page to http://www.surferbar.com, then drops hundreds of porn site shortcuts to the desktop and Favorites folder, and installs a "toolbar" pointing to dozens more.

Improperly removing these browser hijackers can have unexpected results that range from certain programs no longer functioning to a complete loss of Internet connectivity. These attacks differ from "spyware" invasions, which can have similar effects, in that victims never took the conscious step of downloading a program and then running its installer.

How Did I Get It?

In some cases, the only mistake a user made was to click an "OK" button to allow what they thought was a change in home-page settings or an addition of a Web toolbar -- not knowing that the site would do much more than that.

This can be an understandable error when you look at the ways sites attempt to fool users; the sleaziest sites won't include a "no thanks" button in their pop-up alerts and will prevent users from closing these windows.

Keeping your version of Windows up to date and knowing what to avoid are excellent first steps in the avoidance of these annoying problems.