Invasion of the browser snatchers

Ron Zorko was only trying to get to PC World's web site. But when he accidentally mistyped the URL (Uniform Resource Locator), a porn site popped up.

"I suppose I should learn to type better," he says. But a typo that took him to mycpworld.com was only the beginning of his troubles. He soon discovered that this porn site was now both his home and default search page. He changed the settings back in Internet Explorer. But with his next system boot, www.mycpworld.com was back.

"No matter what I did, that was my home page," he says. Zorko was one of three readers within two weeks to e-mail PC World's Answer Line address with a tale of a hijacked home page that renewed itself with every boot.

Several of these sites, including mycpworld.com, redirect you to a harder-to-trace foreign site. That one uses JavaScript to insert a new command into your Registry. This command runs at every boot, changing your home page.

PC consultant Rod Ream first saw this condition on a client's system in January. He believes it was made from the Js_exception.gen JavaScript Trojan Horse.

"It's a kit," intended for setting up such aggressive Web sites, Ream explains. "Webmasters can tailor this to do different manipulations." Whoever created the site, "picked some stuff that other people haven't chosen," Ream says.

Searching for a motive

But why would anyone do something like this? Pornographers, after all, are in the business of keeping customers happy--and their customers have an interest in discretion. Offending potential customers, and increasing the likelihood that their Web surfing habits will be detected, doesn't seem to make good business sense.

Jim Wilson, whose scumware.com site fights such Internet traffic-stealing tricks, disagrees.

"Porn sites love doing this because for them, it works. A certain percentage of this hijacked traffic will buy access."

It's also more malicious than some more common circumstances when outsiders try to crawl onto your PC. For example, a group of German hackers last fall alerted Symantec to an alleged flaw in its antivirus LiveUpdate program that could redirect the LiveUpdate connection and download damaging code instead of virus definitions. And some online ads have been poking a little closer to your PC, occasionally downloading ad-enhancing software.

Ream has found another possible, more sinister motive for the redirect operation. At least some such sites install what appears to be a dialer program onto the victim's PC. Such a program could use your modem to dial an international pay-per-call number without your knowing it.

That's scary stuff, especially for non-technical users. According to Ream, "People have been formatting their machines to get rid of it."

Preventions and cures

But you don't have to resort to a complete reformat to cleanse and protect your computer. You could turn off your browser's scripting, although that will stop legitimate JavaScripts as well as these hijackings. At least one free downloadable program, StartPage Guard, claims to block such intrusions while letting harmless scripts through.

If you get caught, here is a cure:

First, use Internet Explorer's Internet Options dialog box to reset your home and search pages back to what they were before.

Next, select Start, choose Run, type msconfig, and press Enter. Click the Startup tab. In the resulting list, look for a command with either the word 'regedit' or '.reg' in it (the command Zorko found was 'C:\Windows\regedit.exe/s C\Windows\System\radB9819.tmp'). When you find it, uncheck it, then click OK.

That's probably all you need to do, but to be safe, it wouldn't hurt to delete the file mentioned in that line. Don't delete regedit.exe--you need that--but delete the other file referenced there. And it wouldn't hurt to edit the Registry, searching for and removing all references to the offending site.

Who's responsible? The domain name mycpworld.com is registered to Joseph Wise of E-Town (short for Elizabethtown), Kentucky. There is no answer, not even a recording, at the listed number. The domain name's technical contact is VeriSign. A VeriSign spokesperson says that because the URL merely redirected surfers to the offending site, the company had no cause to terminate the account.

In the meantime, the redirection has changed; mycpworld.com now points you to a dead URL. The site is gone, but others will doubtless turn up. As Zorko says, understandably, "I'm still mad about it."

For more information about how the porn industry lures online surfers read "Born Again Porn" on page 22 of the March 2002 issue of PC World (currently on sale).

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lincoln Spector

PC World
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?