Problems with Firefox (and all my other browsers)

Discussion in 'Malware Help (A Specialist Will Reply)' started by Nadienne, Oct 20, 2012.

  1. Nadienne

    Nadienne Private E-2

    Hello--

    Okay, so, all the browsers I use (IE, Chrome, and Firefox) have an adware problem. Sometimes a random word or phrase is hyperlinked to an ad--TextEnhance, which pops up in a little window and lingers for a bit. Also, Firefox won't let me change the homepage (it automatically goes to a Searchqu.com or something like that), though the other browsers are fine in that area.

    This problem has been going on for a long time--months and months. I'm not sure when it started or what I did to cause this to happen.

    I've followed all the steps in Read & Run Me First. A few notes:

    * Rogue Killer did not work. When I first started the process, I got interrupted, and I think Norton ate Rogue Killer before it got going. So I re-downloaded it and started again. But then I got an error message that Rogue Killer had stopped working, so I just continued with Read & Run Me

    * The logs are attached (except Rogue Killer)

    * IE and Chrome seem to be okay.

    * Firefox: I still can't change the homepage, though Malwarebytes is stopping the Searchqu page from loading. However, the hyperlink ads changed from TextEnhance to DownloadNSave

    Thanks in advance for your help!

    ~Nadienne
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Uninstall the below software:
    Babylon toolbar on IE
    Java(TM) 6 Update 29
    Optimizer Pro v3.0

    Now install the current version of Sun Java from: Sun Java Runtime Environment




    Now please download Junkware Removal Tool to your desktop.
    • Please save the work in your browsers before proceeding.
    • Double-click JRT.exe to run (Vista/7 right-click and select Run as Administrator)
    • The tool will open and start scanning your system.
    • Note that this will reset your home page to a default with google.
    • Please be patient as this can take a while to complete.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Please attach JRT.txt to your next message. (See: HOW TO: Attach Items To Your Post )
    No run a new scan with Hitman Pro just like you did in the READ & RUN ME and create the new log.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • JRT.txt
    • the new log from Hitman Pro
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  3. Nadienne

    Nadienne Private E-2

    Thank you for the welcome!

    I followed your directions. Here is where things are at:

    IE: No adware, no problems with the start page.

    Chrome: I am getting adware (ad hyperlinks) from Vid-Saver.

    Firefox: Homepage issue is resolved; I can now set the homepage (woo-hoo!). However, I'm still getting ads from DownloadNSave.

    New logs are attached.

    Thanks again so much!
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Are you referring to items seen on a webpage that have double underlines and when you move your mouse over them, you see an advertisement?


    Look at the plugins that you have installed in Firefox. Do you see DownloadNSave?

    Run Hitman again and allow it to remove all those items that still remain.
     
  5. Nadienne

    Nadienne Private E-2

    Yup.


    I didn't find a DownloadNSave, though I did find a Codec-C add-on and I disabled it (then removed it) after running Hitman. That seemed to do the trick: none of the above-mentioned ads anymore.

    I ran Hitman, which took care of the SearchQu stuff, and then some. The log is attached. After running Hitman, I disabled (then removed) the Codec-C add-on in Firefox.

    I think everything's all cleared up! :celebrate Thanks very, very much!
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 4 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    8. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds