Firefox getting hijacked

Beppe · Mar 3, 2008

Hi,

I'm running Windows XP with McAfee and use Firefox 99% of the time.

The last couple of days my Firefox has been acting weird. On some sites I get redirected to a "The page cannot be found 404 error". The site I get redirected to is urlseek.vmn.net. When I go to the same original site from work there are no problems and I don't get redirected. I have Firefox there to.

It's obviously something on my home computer. When I go to the same pages using IE I also don't get redirected to the 404 page. I searched the net for help and found this site and thought I should ask for advice since I'm not very computersavvy. I have done the READ & RUN ME FIRST- Malware Removal Guide. The problems persist.

When I ran SuperAntiSpyware I got a McAfee pop up with the following message. /translated from Swedish/ "McAfee has automatically prevented a possibly unwanted program running on your computer:

Name: Generic PUP.c
Process:C:\Program\Superantispyware\Superantispyware
Name of process: SuperAntiSpyware

PATH :C:\Systemvolumeinformation\
-restore{A2AF58B2-83EB-46DB-8FC8-
B6CEAAE16AC0}\RP491\A0126453.DLL

Since SAS was running i figured it was ok and allowed McAfee to run the program.

Right after that I get another popup from McAfee with the exact same path but with the extension .EXE instead of .DLL at the end. This time I got a little bit worried and asked McAfee to remove it. I obvioulsy made a mistake on at least one of them.

I have no idea if those popups from McAfee has anything to do with my Hijacked Firefox but thought I should mention them anyway.

Hope someone can find some irregularities in the log files.

SUPERAntiSpy · Mar 3, 2008

McAfee has a false-postive and lists SUPERAntiSpyware as a "PUP" - we are working with them to get this removed.

Beppe · Mar 3, 2008

Thanks for your reply. I guess I wrongly blocked the .exe extension above then. How do I undo that in McAfee? At least the PUP hasn't anything to do with the Hijack then.

Hope someonce can find the cause in the logfiles.

Beppe · Mar 6, 2008

I know one shouldn't bump own threads but I got approval from Lev since my original problems still remains and I hadn't got any help for the last 3 days.

So, my Firefox still get redirections to the site urlseek.vmn.net. I googled urlseek.vmn and got some hits. It seems like some malware or hijacker. There were some suggestions on how to remove it. I don't know how to remove though. I need help.

Could some one of you Malware Fighters please help me to remove this from my computer and also have a look in my log files for eventual other problems.

Thanks a lot.

Lev · Mar 6, 2008

WRONG!

You did not get approval to BUMP your thread from me. My exact words were :

You had a reply 3 days ago to your problem http://forums.majorgeeks.com/showthread.php?t=153270

If it is still not resolved and you are having issues related to the original problem, go ahead and add another post to your thread to bring this to the attention of the Malware Fighters.

If it is a totally unrelated new problem then start a new thread in the appropriate forum.
Click to expand...

Infact if you read my next post in the Welcome Center thread I clearly tell you NOT to bump and link you to the thread that tells you why.

To clarify again, bumping is not acceptable. Adding to your post when you are having additional issues is acceptable. You have only succeeded now in putting yourself to the end of the list again.

TimW · Mar 6, 2008

We appologize for the delay ..there are only three of us that work this forum and it appeared as though you were being helped due to the number of replies.

Give me a chance to review your logs and do note that the items being flagged are in your system restore files.....which will be removed when we do the final cleanup and toggle system restore.

TimW · Mar 6, 2008

I'm not seeing any malware ....I copied and pasted the urlseek into my firefox and got the same 404 error....so there is something wrong with the address ....again, you are being alerted to the system restore files and if you are not having any other issues ...

1. If we used Pocket Killbox during your cleanup, do the below
* Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
7. If we had you run Avenger, you can delete all files related to Avenger now.
8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
10. If you are running Windows XP or Windows ME, do the below:
* Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
* Then reboot and Enable System Restore to create a new clean Restore Point.
11. After doing the above, you should work thru the below link:
*How to Protect yourself from malware!
Click to expand...

Beppe · Mar 7, 2008

Thanks for assisting me TimW. Good to hear you didn't find any serious problems in my log files.

BUT

I'll give you a real life example of what my browserproblem (which is still alive and kicking) is.

From Work Computer:
1. I go to the site cardrunners.com using Firefox
2. I read and surf that site without any problems

From Home Computer
1. I go to the site cardrunners.com using Firefox
2. I can see the site for like 2 seconds then BAAAM... I get a forced redirect to the 404 error page (the urlseek.vmn page).

Clearly the cardrunnersite don't have broken links of any sort since I surf that site perfectly fine from work. When I do it from home I get the annoying hijacks. It happens on more sites than the one above. I just wanted to show you one example. I can not surf sites from home that I can surf perfectly fine from work. This suggests that there's something wrong with my home comp.

Now, I have googled "urlseek.vmn" and see that there are more people than just me with this problem. Could you please do it aswell. There are people there that have explained their problems better than me. Here's are 2 of the links where people discuss the urlseek.vmn problem

http://usersupport.multiply.com/notes/item/2134
http://firefox.group.stumbleupon.com/forum/83459/

PS. When using IE I don't get the forced redirects. Only with Firefox.

TimW · Mar 7, 2008

Then I would totally uninstall FireFox ...profiles and all!! Then run ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

* Double-click ATF-Cleaner.exe to run the program.
* Under Main choose: Select All
* Click the Empty Selected button.

If you use Firefox browser

* Click Firefox at the top and choose: Select All
* Click the Empty Selected button.
o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

* Click Opera at the top and choose: Select All
* Click the Empty Selected button.
o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

Try a different browser such as Opera ...see if the problem persists ...then after making sure you have no leftover FF files ...reinstall and see if it re-occurs.

Beppe · Mar 7, 2008

Thanks a LOT. Your last reply and the instructions managed to get rid of the forced redirects. Yes.

I'll now go ahead and do the other steps below to create a new clean restore point and close this case.

Thanks again TimW !!!

TimW · Mar 7, 2008

My fingers are crossed ...and you're welcome.

Log in or Sign up

Firefox getting hijacked

Beppe Private E-2

Attached Files:

Superantispywarelog.txt

combofixlog.txt

MGlogs.zip

SUPERAntiSpy Private E-2

Beppe Private E-2

Beppe Private E-2

Lev MajorGeek

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Beppe Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Beppe Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member