DNS Hijack SearchAtHand.com Browser Result Removal this is a browser hijack and method of removing

[BuffaloHelp 24]

Recently, I don't know when, I realized that my browser was opening some weird pages. It would either open to what it seemed to be a valid webpage but it always looked the same. But the contents will be text only but always with adult related links... so I was curious but never paid any attention since these pages were coming up only when I mistyped an URL address.

But the pages popped up were always the same and it got me curious. So I started to click on refersh and see how far it will lead. At the end, it led to a site called "SearchAtHand.com" After few minutes of internet searching, this is what I came to know:

SearchAtHand is a Ukrainian company that hi-jacks your DNS server settings. Once they have control of your browser, they can re-direct you to whatever website they want. When you type in an incorrect web address, their search box appears. They want you to try your search again with them. When you do search, they make money by brokering your search result to pay-per click advertisers.

Freakin' clever Ukrainians!
The full method of how to remove this DNS hijacker can be found here http://forums.xisto.com/no_longer_exists/ and the direction is very simple. Thank god! But the nutshell of it all is to check your TCP/IP setting for your network, make sure it's set to "Obtain DNS server address automatically"

This DNS hijack seems to be fairly new and thus I recommend to all that you check your settings. My Spybot S&D did not catch this issue, nor any of my anti-browser hijack programs.

[Albus Dumbledore 0]

good catch buffaloHELP! although ive never had any prooblems with this before.... i think i will still check my settings, as well as the 5 other computers in my house thanx for letting us know

[alexviii 0]

BUFALO: You are an angel!!I had problems with this, and now everything is ok. 10x a lot... PS: What knid of anti-browser hijack programs do you use?

[Plenoptic 0]

lol Who would have thought that Ukranians would be so smart. You should never underestimate them. You know you gotta watch out for those Brazilians too. But seriously that has happened to me before and lucily Spy Sweeper fixed it for me. The funny thing is it only attacked Internet Explorer and Not Firefox so I was ok because I don't use Internet Explorer unless necessary. I use IE tabs in Firefox if I need to I only use IE for hotmail because that is what it opens up to in MSN. Thanks for the tip Buffalo I'll have to watch out for it.

[FirefoxRocks 0]

So far a lot of browsers are not common targets for hijacking.Internet Explorer 6 and older are prime targets for attack.IE 7, Firefox, Netscape, Opera, Mozilla, Avant Browser, Maxthon, SeaMonkey and other less common browsers are not targets for attack, even though Internet Explorer 7 BETA is more common for a target.By the way, can you manually change your DNS server?

[khan11 0]

oh my goodness!! see how the world is earning money lolz hehehe, im really shocked to hear this,i think after some time every internet user in the world will be browsing each others pc without telling them lolz, im afraid of these type of technologies,its not good way to earn money,see how much people work to make browser and the hijackers just hack em,alas!anyways thanks for sharing the solution buffalohelp.Cheers.

[iGuest 3]

URL update

DNS Hijack SearchAtHand.com Browser Result Removal

 

Just thought I'd let you know: freesecuritytools.Com website has moved.

 

Their search@hand removal page is now located at http://forums.xisto.com/no_longer_exists/

 

 

-reply by Darren

[iGuest 3]

For those who cant remove itDNS Hijack SearchAtHand.com Browser Result Removal

Hi! I had the same problem, but I couldnt remove it with that guide.Every time a closed the connection window, the dns address came back.Recently I couldnt connect to the net, so I started to search in theregistry. I found the lines that contained that address, instead of mydefault. I typed in mine, but every time I closed regedit, it came backagain Then I checked the permissions to that lines, and switched thepermissions to deny on DhcpNameServer, and NameServer (these linescontains the wrong DNS address in somewhere of regedit), for Systemprocesses (The last in the list). I also switched permissions to allowfor Administrator. Then finally I could replace these bastards' DNSaddress to mine, and it never changed back. And I have internet now

(Thesenew kind of SaH has a System process I guess, or something like that. Icouldnt find it, but now DNS address switching has gone)P.S.: Itried every method I found on the net, I downloaded the spyware removalproducts you and others have recommended, but those were useless.

Sorry for my bad english, I hope you understand what I'm explaining...-reply by Peter

[iGuest 3]

For those who cannot remove it!DNS Hijack SearchAtHand.com Browser Result Removal

Hi! I had the same problem, but I couldnt remove it with that guide. Every time a closed the connection window, the dns address came back. Recently I couldnt connect to the net (maybe their DNS server were down), so I started to search in the registry. I found the lines that contained that address, instead of my default. I typed in mine, but every time I closed regedit, it came back again Then I checked the permissions to that lines, and switched the permissions to deny on DhcpNameServer, and NameServer lines (these lines contains the wrong DNS address), for System processes (the last in the list). Also I switched permissions to allow for Administrator. Then finally I could replace these bastards' DNS address to mine, and it never changed back. And I have internet now (These new kind of SaH has a System process I guess, or something like that. I couldnt find it, but now DNS address switching has gone)P.S.: I tried every method I found on the net, I downloaded the spyware removal products you and others have recommended, but those were useless.Sorry for my english

 

-reply by Peter

[iGuest 3]

DNS hijacked, but IP nowhere in sightDNS Hijack SearchAtHand.com Browser Result Removal

I found this website when searching for a solution to being constantly rerouted. Unfortunately it doesn't help for me, because I don't see the IP address anywhere, and everything is already set to work with DHCP.

Might I be having a problem that simply looks like this one?

Bert V.