Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

My browser is hijacked: http://rev2pub.adk2.co/rev2pub/creatives/36141

broswer hijacked

  • This topic is locked This topic is locked

#1
cintwinawork

cintwinawork

    New Member

  • Member
  • Pip
  • 8 posts

Recently my browswer has been hijacked. Ads will pop up on my screen. My websites will be redirected to other sites. I got the html above from one of the pop up ads.

 

I have NORTON Anitvirus and Live update. I just started getting an error when trying to access Norton Anti Virus program.

 

I restored my system back to June 28 before this all started and still have the hijackers.

 

Please help! :(

 

Cindy

Attached Thumbnails

  • 140728.png

  • 0

Advertisements


#2
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there, I will need to have a look at your system. What error does Norton give ?

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  • Select additions at the bottom
  • Press Scan button.
    frst.JPG
  • It will produce a log called FRST.txt in the same directory the tool is run from.
  • Please attach both logs generated.

  • 0

#3
cintwinawork

cintwinawork

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts

I'm attaching a screen shot of the norton error. I am also attaching the OTL logs and the Farber logs.

Attached Thumbnails

  • 140728a.png
  • Norton error.png
  • 140728.png

Attached Files


  • 0

#4
cintwinawork

cintwinawork

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts

Sorry, forgot the OTL extras log

Attached Files


  • 0

#5
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
OK lets start.  The thing to bear in mind is that most Antivirus programmes do not like system restore, I will see if Norton has a repair function

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

SearchScopes: HKLM-x32 - DefaultScope {8A289A0D-F50F-460C-9C7C-A677132F175F} URL =
SearchScopes: HKLM-x32 - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} URL = http://search.imgag....q={searchTerms}
SearchScopes: HKCU - DefaultScope {8A289A0D-F50F-460C-9C7C-A677132F175F} URL = http://search.condui...8555933254&UM=2
SearchScopes: HKCU - {49606DC7-976D-4030-A74E-9FB5C842FA68} URL =
SearchScopes: HKCU - {6D832424-63E4-4543-A7F5-28FC67BC5B2E} URL = http://websearch.ask...FF-41BFD5F0FE8A
SearchScopes: HKCU - {8A289A0D-F50F-460C-9C7C-A677132F175F} URL = http://search.condui...8555933254&UM=2
FF SearchPlugin: C:\Users\cindy\AppData\Roaming\Mozilla\Firefox\Profiles\qojbh5en.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\cindy\AppData\Roaming\Mozilla\Firefox\Profiles\qojbh5en.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\cindy\AppData\Roaming\Mozilla\Firefox\Profiles\qojbh5en.default\searchplugins\web-search.xml
C:\Users\cindy\xp.reg
Task: {0840070A-F90A-4D95-B542-61060696FF5C} - System32\Tasks\PC Optimizer Pro64 startups => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
CMD: bitsadmin /reset /allusers
CMD: DEL %TEMP%\*.* /F /S /Q
CMD: RD /S /Q %TEMP%
REBOOT:


Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
FINALLY

Download aswMBR.exe ( 4.5mb ) to your desktop.
Double click the aswMBR.exe to run it.
You may be offered the option of using virtualisation, accept that
When it offers to download the virus database allow that as well
Click the "Scan" button to start scan

AswMBR%20scan.JPG


On completion of the scan click save log, save it to your desktop and post in your next reply
  • 0

#6
cintwinawork

cintwinawork

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts

Here is the fix list as requested. I will continue with your instructions.


  • 0

#7
cintwinawork

cintwinawork

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts

Here is the fix list as requested. I will continue with your instructions.

Attached Files


  • 0

#8
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

Thanks, unfortunately Norton does not have a repair function, according to them you will need to fully uninstall and then re-install.  So you will need your licence file before we start on that road :)


  • 0

#9
cintwinawork

cintwinawork

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts

here is the adwcleaner log

Attached Files


  • 0

#10
cintwinawork

cintwinawork

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts

Here is my aswMBR log

Attached Files


  • 0

#11
cintwinawork

cintwinawork

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts

I will get my norton disk and uninstall and reinstall


  • 0

#12
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

Once done could you let me know if the ads/popups have ceased please


  • 0

#13
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP