Need Browser Hijack expert's advice

[S.Z.Craftec]

Hi there,

I have one client whose Internet Explorer has been hijacked. My company is not responsible for solving that kind of problems, but I wanna help that guy if it's possible, 'cause he seems pretty upset with that...

Problem is kinda weird... Home page is untached and it never changes. It's always like he set it to be. The problem is here - every single time when he logs into Windows, and try to browse internet, he is unable to do that. I checked LAN settings in IE, Tools / Internet Options / Connections / LAN settings - option USE A PROXY SERVER FOR YOUR LAN is always checked, and it shouldn't be checked 'cause they must not use proxies inside their domain (don't ask me why). If I uncheck that option and try to browse internet, everything goes back to normal. He can browse internet without single problem. Everything is great while he is logged in... as soon as he logs out, and log on back again, USE A PROXY... option is checked again, and he is unable to browse internet.

I checked whole system with Spybot, Ad-Aware, HijackThis, BHODemon and Browser Hijack Blaster... none of them found anything. HijackThis log is so clean that it's unbelievable...

Anyone has any idea what can cause that or knows any freeware Browser Hijack Killer out there ?

Thanks in advance !

[Lisandro]

Sorry, I don't know the solution.

Why don't you ask to Waldo, whocares and/or raman.

Maybe on Google you can find ohter Browser Hijack Killers than you mentioned here. I don't know much other applications, or better, I don't know better applications than Spybot, Ad-Aware and HijackThis.

I thought SpywareGuard (resident) and SpywareBlaster could done that job, i.e., prevent the infection  .

[techie101]

bri,

This does not sound like a browser hijack to me.
It appears to be a proxy conflict.  If the browser was hijacked, then surely it would not default to where the user has it set.  You said this is not the case.

In addition, when you remove the system from proxy configuration, it works fine.

Firstly, in the Internet Options above where you enter proxy data, if the box Automatic detection is checked, that would explain why it defaults to proxy settings on a reboot.

I think you need to check into such things as firewall settings, antivirus configuration etc.

[shgoh]

yeah...like what techie said...don't looks like a browser hijack thing...but then i never experience such thing

[rloschmann]

I don't think of a browser hijack.

Can you try changing another config setting ? and see if it is saved after a logout and login.

I think that maybe he has a problem with his windows profile not being saved. Is his profile local or remote (on a server) ?

I think your client should ask the administrator to chek his profile.

[S.Z.Craftec]

bri,

This does not sound like a browser hijack to me.
It appears to be a proxy conflict.  If the browser was hijacked, then surely it would not default to where the user has it set.  You said this is not the case.

In addition, when you remove the system from proxy configuration, it works fine.

Firstly, in the Internet Options above where you enter proxy data, if the box Automatic detection is checked, that would explain why it defaults to proxy settings on a reboot.

I think you need to check into such things as firewall settings, antivirus configuration etc.

OK, thanks guys... I told you it was weird...

Techie101... bri ? Hehe, I'm not bri...
Anyway, none of the options is checked in the LAN settings except USE PROXY is checking itself every single time he logs on...

Le Doc wrote:

Can you try changing another config setting ? and see if it is saved after a logout and login.

I think that maybe he has a problem with his windows profile not being saved. Is his profile local or remote (on a server) ?

I think your client should ask the administrator to chek his profile.

Yes, I can change any other setting and it will be saved after reboot. His profile is not local, it's on company's domain and he has all administrator rights (one of big bosses in that company)...

[whocares]

Hi,

maybe in the company there's some sort of group policy in effect ?
or some logon-script or something in HKU/default ?

can you post the HJT-Log or is it confidential ?? edit out the private/company stuff.maybe

[S.Z.Craftec]

OK, I'll try to get HijackThis log from there. I must tell, that no one else has similar problems in that particular company except him...

I found more that 200 spyware files using Ad-Aware and Spybot in his computer... I cleaned them all. He likes to use his company's computer to visit Casino sites (hm... )

But, he still has same problem...

Thanks guys... I'll try few more things to check...

[Vlk]

I'd bet on a group policy setting as well...

Try running gpedit.msc