Picked up something... iffy while surfing

Thirith on 27/10/2011 at 12:25

This is rather embarrassing, because I think I'm fairly cautious when it comes to surfing - but it seems that my Internet Explorer (which I only use for work stuff, which makes it doubly weird; our office webmail works best under IE) has picked up something that shouldn't be there.

I noticed when my start page was set to game1.zj.cinfo.net, which was easy enough to undo; I just changed the URL. However, when I hover over the IE tab at the bottom of the screen, every single tab includes the game1.zj.cinfo.net address.

I've done a search for the address, but haven't found anything useful. I also ran two anti-spyware programs but they didn't solve this issue.

Any recommendations?

Renzatic on 27/10/2011 at 12:52

Best case scenario is it's probably just IE being IE, and whatever you got changed something somewhere deep inside your internet settings. Look around in there, and maybe run CCleaner to wipe out your caches. See if that helps.

Worse case...eh...I dunno. Could be a DNS hijack, maybe. I haven't seen one of those in forever, but to be on the safe side, check out your DNS settings under local area connection status/properties, then the properties under Internet Protocol Version 6 & 4 (or just 4 if you're on XP). Both of them should be set to obtain a DNS server address automatically.

What malware scanners did you run, by the way?

Thirith on 27/10/2011 at 14:22

I used Ad-Aware and Spybot Search&Destroy. Can you recommend any other ones? Will also use CCleaner.

Matthew on 27/10/2011 at 14:58

Malwarebytes Anti-Malware is a good one too.

Renzatic on 27/10/2011 at 15:42

What Matthew said. Antimalware is the go-to program for catching and removing bugs. Just make sure you've got the latest definitions, and let it do a full scan. Chances are good that if there's something to find, it'll find it.

You could also use HijackThis if you really, really, really want to make sure your computer is squeaky clean. It'll give you a log detailing each and every single thing currently running on your computer at the time of the scan. It's not the most user friendly of the bunch, and you'll probably need help deciphering the log, but if the other malware scanners don't report any bugs, and you've still got problems, then use HijackThis.

nickie on 27/10/2011 at 16:15

What Matthew and Renzatic said.

(http://www.bleepingcomputer.com/tutorials/how-to-use-hijackthis/) This will give you some information on HijackThis. But read the Warning. I really only use it up to 04 and occasional 016s. But it's very useful for keeping a check on what gets added to your computer.

A couple of things I found - one a thread from someone having problems with it back in June and the other with extra detail after the .net/ which refers to a nocd crack. Everything else found is fairly meaningless. You'd think if it was malware there'd be mention in the security forums.

Thirith on 27/10/2011 at 20:55

HijackThis just solved this - thanks a lot for everyone's help! (I feel a bit like the guy who had to go to the VD clinic...)

Vernon on 27/10/2011 at 22:06

You found something with it? Did it just change the start page or was something else there?

Thirith on 27/10/2011 at 22:11

It wasn't entirely clear what it was in HijackThis (it was one line associated with Internet Explorer giving that link, but not a particularly telling one) - the starting page was the one I defined, but the suspicious link was displayed when I hovered over the tabs at the bottom of the screen. Once I saw that game1 URL in HijackThis, I had the program remove it.

nickie on 28/10/2011 at 05:14

Glad it's fixed but I really would recommend running Malware Bytes if you haven't already done so.