olderairhead
18th Jun 2004, 07:47
If you've ever been infected with a browser hijacker, you know what an infuriating situation it is. For all intents and purposes, your $3,000 computer is converted into a source of revenue for some fly-by-night web site unable to generate legitimate web traffic. Once installed, it usually takes an expert to remove a browser hijacker effectively.
If you've gone through this before, you never, ever want it to happen again. So, how do you prevent being hijacked? This is surprisingly easy.
Dump Internet Explorer
First and most simply, stop using Internet Explorer. If you use either Mozilla (http://www.mozilla.org/), Firefox (http://www.mozilla.org/products/firefox/) or Opera (http://www.opera.com/), you are immune to all known and future browser hijackers.
You are immune for two reasons. First, most people use Internet Explorer, so most malicious code is custom built to exploit it. Second, Opera's and Mozilla's programmers take security very seriously and have made these browsers very secure. It is not possible to install software from a web site using these browsers without at least seeing a prompt of some sort asking permission.
If you have to use MSIE
Switching browsers is the easy answer. For some people, that is not an option for various reasons. Internet Explorer can be made reasonably safe without locking down every useful function, but it requires some third-party software.
The most important thing is to update your browser and operating system. Go to WindowsUpdates (http://windowsupdate.microsoft.com/) and install the latest version of Internet Explorer (currently MSIE 6 Service Pack 1), then go back and install any security patches that are available. Also install any service packs and patches for Windows itself. This one action will save you from the overwhelming majority of browser hijackers.
After you've done that, replace Microsoft Java VM with Sun Java. You can download that from HERE (http://www.java.com/). There are several hijackers that exploit flaws in Microsoft Java VM. Sun's Java is more secure and more up to date. Make certain, in Java's options, that Sun Java JRE is set to work with Internet Explorer.
Open Internet Options from the Windows control panel and click the "Security" tab. Highlight the "Internet" icon and then click "Custom Level". Choose "Medium" from the drop-down box at the bottom, then click the "Reset" button. Click ok, then click "Custom Level" again.
Set your options just as I have listed below:
.NET Framework-reliant components
Run components not signed with Authenticode (Disable)
Run components signed with Authenticode (Prompt)
ActiveX controls and plug-ins
Download signed ActiveX controls (Prompt)
Download unsigned ActiveX controls (Disable)
Initialize and script ActiveX controls not marked as safe (Disable)
Run ActiveX controls and plug-ins (Enabled) (This actually refers to Java and Flash, not ActiveX)
Script ActiveX controls marked safe for scripting (Prompt)
Miscellaneous
Access data sources across domains (Disable)
Drag and drop or copy and paste files (Prompt)
Installation of desktop items (Prompt)
Launching programs and files in an IFRAME (Prompt)
Navigate sub-frames across different domains (Prompt)
Software channel permissions (High safety)
Userdata persistance (Disable)
Scripting
Allow paste operations via script (Prompt)
Scripting of Java applets (Prompt)
Next, you need to run a registry script called IE-SPYADS (http://www.staff.uiuc.edu/~ehowes/resource.htm#IESPYAD). This script will place an enormous number of web sites known to be abusive into
Explorer's "Restricted Zone". Any site in that list will be unable to run javascripts, java applets, set or read cookies or use ActiveX scripting. You still will be able to visit those sites but they will be very limited in what they can do.
Be aware that MSIE has many security flaws that will allow a clever site designer to bypass security settings, even if their site is in the restricted zone. More must still be done.
Now you need to install SpywareBlaster (http://www.majorgeeks.com/download.php?det=2859). ActiveX programs need to use a CLSID (identifier number) before Windows will execute them. SpywareBlaster stops certain ActiveX CLSIDs from working by setting a "kill bit" in the Windows registry. This will stop ActiveX drive-by installations from programs that use those numbers, as well as preventing software already installed from running if they use that CLSID.
As a final safeguard, install a program called BrowserHijack Blaster (http://www.majorgeeks.com/download.php?det=3786) This program will watch for alterations to the home page, default page and search page as well as watching for Browser Helper Objects being installed. If it detects a change, it immediately will pop up a warning and ask if you wish to allow the change.
Be very careful about installing programs. By far the most common source of malware infection comes from third party bundles. Grokster, for instance, will install a dozen or more unwanted programs.
Finally, you also should disable the preview pane if you use Outlook or Outlook Express. Simply by highlighting an email while the preview pane is active, even to delete it, you could activate any scripting in that email. Visit TomCoyote's (http://tomcoyote.com/outlook1.php) site for instructions on doing that.
Follow the steps above and it will be very unlikely that you ever will be hijacked again. Periodically scan your system with antispyware and antivirus software. I recommend Spybot S&D (http://www.tomcoyote.com/SPYBOT/) for antispyware and use a good virus application for antivirus.
If you've gone through this before, you never, ever want it to happen again. So, how do you prevent being hijacked? This is surprisingly easy.
Dump Internet Explorer
First and most simply, stop using Internet Explorer. If you use either Mozilla (http://www.mozilla.org/), Firefox (http://www.mozilla.org/products/firefox/) or Opera (http://www.opera.com/), you are immune to all known and future browser hijackers.
You are immune for two reasons. First, most people use Internet Explorer, so most malicious code is custom built to exploit it. Second, Opera's and Mozilla's programmers take security very seriously and have made these browsers very secure. It is not possible to install software from a web site using these browsers without at least seeing a prompt of some sort asking permission.
If you have to use MSIE
Switching browsers is the easy answer. For some people, that is not an option for various reasons. Internet Explorer can be made reasonably safe without locking down every useful function, but it requires some third-party software.
The most important thing is to update your browser and operating system. Go to WindowsUpdates (http://windowsupdate.microsoft.com/) and install the latest version of Internet Explorer (currently MSIE 6 Service Pack 1), then go back and install any security patches that are available. Also install any service packs and patches for Windows itself. This one action will save you from the overwhelming majority of browser hijackers.
After you've done that, replace Microsoft Java VM with Sun Java. You can download that from HERE (http://www.java.com/). There are several hijackers that exploit flaws in Microsoft Java VM. Sun's Java is more secure and more up to date. Make certain, in Java's options, that Sun Java JRE is set to work with Internet Explorer.
Open Internet Options from the Windows control panel and click the "Security" tab. Highlight the "Internet" icon and then click "Custom Level". Choose "Medium" from the drop-down box at the bottom, then click the "Reset" button. Click ok, then click "Custom Level" again.
Set your options just as I have listed below:
.NET Framework-reliant components
Run components not signed with Authenticode (Disable)
Run components signed with Authenticode (Prompt)
ActiveX controls and plug-ins
Download signed ActiveX controls (Prompt)
Download unsigned ActiveX controls (Disable)
Initialize and script ActiveX controls not marked as safe (Disable)
Run ActiveX controls and plug-ins (Enabled) (This actually refers to Java and Flash, not ActiveX)
Script ActiveX controls marked safe for scripting (Prompt)
Miscellaneous
Access data sources across domains (Disable)
Drag and drop or copy and paste files (Prompt)
Installation of desktop items (Prompt)
Launching programs and files in an IFRAME (Prompt)
Navigate sub-frames across different domains (Prompt)
Software channel permissions (High safety)
Userdata persistance (Disable)
Scripting
Allow paste operations via script (Prompt)
Scripting of Java applets (Prompt)
Next, you need to run a registry script called IE-SPYADS (http://www.staff.uiuc.edu/~ehowes/resource.htm#IESPYAD). This script will place an enormous number of web sites known to be abusive into
Explorer's "Restricted Zone". Any site in that list will be unable to run javascripts, java applets, set or read cookies or use ActiveX scripting. You still will be able to visit those sites but they will be very limited in what they can do.
Be aware that MSIE has many security flaws that will allow a clever site designer to bypass security settings, even if their site is in the restricted zone. More must still be done.
Now you need to install SpywareBlaster (http://www.majorgeeks.com/download.php?det=2859). ActiveX programs need to use a CLSID (identifier number) before Windows will execute them. SpywareBlaster stops certain ActiveX CLSIDs from working by setting a "kill bit" in the Windows registry. This will stop ActiveX drive-by installations from programs that use those numbers, as well as preventing software already installed from running if they use that CLSID.
As a final safeguard, install a program called BrowserHijack Blaster (http://www.majorgeeks.com/download.php?det=3786) This program will watch for alterations to the home page, default page and search page as well as watching for Browser Helper Objects being installed. If it detects a change, it immediately will pop up a warning and ask if you wish to allow the change.
Be very careful about installing programs. By far the most common source of malware infection comes from third party bundles. Grokster, for instance, will install a dozen or more unwanted programs.
Finally, you also should disable the preview pane if you use Outlook or Outlook Express. Simply by highlighting an email while the preview pane is active, even to delete it, you could activate any scripting in that email. Visit TomCoyote's (http://tomcoyote.com/outlook1.php) site for instructions on doing that.
Follow the steps above and it will be very unlikely that you ever will be hijacked again. Periodically scan your system with antispyware and antivirus software. I recommend Spybot S&D (http://www.tomcoyote.com/SPYBOT/) for antispyware and use a good virus application for antivirus.