Q: I have a problem when I go on the internet via Google. I get a second tab opening which I haven’t asked for and which I have to close to get back to my original site. To be precise, if I go to my bank’s website, within seconds, a second tab will open (replacing the original on the screen), from a loan company not related to my bank at all, also I get adverts for Tesco, or even what appears to be a holiday page for Florida! My Norton 360 insists I have no virus or spyware on my machine, so what is this problem, and how do I get back to normal browsing? Any suggestions would be greatly appreciated.
A: This has all the classic signs of a browser hijack, where malware takes over your Web browser to impose a page other than the one you were asking for. Often this occurs because you’ve installed an additional toolbar in your browser – perhaps as part of installing another program.
The first step is to check if you have any third-party toolbars enabled. In Internet Explorer, open the Tools menu and go to Manage Add-ons. From here you can see what’s being loaded along with your browser. If you spot anything you’re not sure of you can choose to disable it and see what happens. If you’re running Firefox you can do the same thing via Tools, Add-ons.
You may be lucky and solve the problem in that way, however, it’s more likely that the malware is quite deeply embedded. In which case boot the machine into Safe Mode by pressing F8 at startup and run a dedicated anti-spyware tool such as Spybot – Search and Destroy to check for and remove infections. If that doesn’t solve the problem scan the system with HijackThis – using Vista’s Run as Administrator option – and look for BHO (Browser Helper Object) entries, you can Google the file names of these to find out what they are. You need to be careful using HijackThis because not everything that it identifies is bad so don’t remove anything you’re unsure of. Once you’ve got rid of the problem it’s worth installing SpywareBlaster to help prevent reinfection.
Originally featured in PCU116