Antivirus Software

  1. Home
  2. Computing & Technology
  3. Antivirus Software

Browser Hijacking

"Help objects" help themselves to your PC

By Mary Landesman, About.com

Often accused of being drive-by downloads, these pesky Internet parasites can quickly take advantage of an improperly secured system, embedding themselves as a "browser help object" and redirecting you to a host of unsavory sites.

It's generally pretty easy to tell when your browser has been hijacked. Not only may your homepage be changed to visit a porn or advertising-filled site, quite often you'll be deluged with pop-ups and several new Internet shortcuts will appear on your Favorites menu. These pests usually include some form of spyware or adware, programs that monitor your Internet use and build a profile of your habits designed to shoot even more advertising your way.

This is not to say that all browser help objects (BHO) are bad. For example, Google Toolbar includes a BHO as part of its installation. While certain features of the Google Toolbar can send information back to Google, this is clearly explained prior to installation and it can be easily disabled without affecting its search capabilities.

An example of a bad BHO is Surfbar. This BHO is installed without permission by exploiting a vulnerability in Microsoft Internet Explorer. The Surfbar BHO, also known as Junkbar and Pornbar, changes the Internet Explorer start page to http://www.surferbar.com, then drops  hundreds of porn site shortcuts to the desktop and Favorites folder, and installs a "toolbar" pointing to dozens more.

Improperly removing these browser hijackers can have unexpected results that range from certain programs no longer functioning to a complete loss of Internet connectivity. Therefore, caution should be exercising when attempting to clean a system affected by a miscreant BHO.

BHODemon will allow you to temporarily disable a browser help object. With the BHO disabled, you can continue using your PC normally for a day or so to ensure all programs and your Internet  connection function normally without it. Assuming no ill-effects were found, use a reputable spyware scanner to safely remove the BHO and all associated spyware that likely accompanied it.

An ounce of prevention

  • Spybot Search & Destroy comes with a handy utility known as TeaTimer. You can switch to Advanced mode to enable TeaTimer, after which it will guard against the types of unauthorized registry changes required for a BHO installation. (Click here for instructions).
  • Internet Explorer has highly configurable security options that prevent unauthorized BHO installations. See "Securing Internet Explorer" for an overview of these features.
  • Antispyware scanners generally provide some form of realtime protection to detect and prevent unwanted adware and spyware installations. Check the recommended antispyware list for options.
  • Explore Antivirus Software

    About.com Special Features

    Build Your Own Website

    Step-by-step advice on how to do everything from choosing a Web host to promoting your content. More >

    Connect Your Home Computers

    Easy ways to connect two computers for networking purposes. More >

    Antivirus Software

    1. Home
    2. Computing & Technology
    3. Antivirus Software
    4. Spyware / Adware
    5. Browser Hijacking

    ©2009 About.com, a part of The New York Times Company.

    All rights reserved.