Browser Tab got Hijacked(gg.blogpear.com)

Hi All,

Today morning when I have logged into my computer I have found that when click the tab on internet explorer

its going to some gg.blogpear.com/vscript…

The computer is also not behaving the same way as I would have expected.

I have scanned the computer as boot time.. & also scanned the computer for malware..

To remove this hijacking issue what I have did is removed the registry entries from the below path

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
 & then imported the registry entries from the uninfected computer.

below are the entries that have been imported (you can just paste them in notepad & change the extension to .reg.

After that merge it into your computer…. or export the entries from uninfected computer..

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
“blank”=”res://mshtml.dll/blank.htm”
“NoAdd-onsInfo”=”res://ieframe.dll/noaddoninfo.htm”
“InPrivate”=”res://ieframe.dll/inprivate.htm”
“NavigationFailure”=”res://ieframe.dll/navcancl.htm”
“NoAdd-ons”=”res://ieframe.dll/noaddon.htm”
“Home”=dword:0000010e
“PostNotCached”=”res://ieframe.dll/repost.htm”
“DesktopItemNavigationFailure”=”res://ieframe.dll/navcancl.htm”
“NavigationCanceled”=”res://ieframe.dll/navcancl.htm”
“Tabs”=”res://ieframe.dll/tabswelcome.htm”
“OfflineInformation”=”res://ieframe.dll/offcancl.htm”
“SecurityRisk”=”res://ieframe.dll/securityatrisk.htm”

Advertisements

8 thoughts on “Browser Tab got Hijacked(gg.blogpear.com)

  1. I have the same problem with my tab being hijacked….can you give a step by step solution for a non-expert computer person like myself?

    Mary

  2. 1. Go to start
    2. On run type regedt32
    3. Registry editor will open
    4. expand Hkey_Local_Machine
    5. expand software –> Microsoft —>expand —>Internet Explorer—>AboutURLs
    6. remove every entry inside AboutURLs.
    7. Now close regedt32
    8. Again go to start
    9. In the run type notepad
    10. paste the below lines in notepad

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
    “blank”=”res://mshtml.dll/blank.htm”
    “NoAdd-onsInfo”=”res://ieframe.dll/noaddoninfo.htm”
    “InPrivate”=”res://ieframe.dll/inprivate.htm”
    “NavigationFailure”=”res://ieframe.dll/navcancl.htm”
    “NoAdd-ons”=”res://ieframe.dll/noaddon.htm”
    “Home”=dword:0000010e
    “PostNotCached”=”res://ieframe.dll/repost.htm”
    “DesktopItemNavigationFailure”=”res://ieframe.dll/navcancl.htm”
    “NavigationCanceled”=”res://ieframe.dll/navcancl.htm”
    “Tabs”=”res://ieframe.dll/tabswelcome.htm”
    “OfflineInformation”=”res://ieframe.dll/offcancl.htm”
    “SecurityRisk”=”res://ieframe.dll/securityatrisk.htm”

    11. Save the file with tany name for example:- abouturl on desktop.
    12. right click the saved file & change its extension to .reg
    (you will only be able to change extension if extension are not hidden)–if you want to know that process as well then reply back.

    12. Double click the saved file to merge it.

    your issue is solved now 🙂

  3. ok thanks for the step by step walkthrough i mananged to save the file as a reg file I think, I have like an icon with fragmented blue squares for the file on my desktop, however how do I merge it and where to? i thought regedt32 so I opened that and tried draging it into the About URL folder on the right, but nothing happens and I still have this annoying blogspear thing on my tab

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s