Wikiposts
Search
Computer/Internet Issues & Troubleshooting Anyone with questions about the terribly complex world of computers or the internet should try here. NOT FOR REPORTING ISSUES WITH PPRuNe FORUMS! Please use the subforum "PPRuNe Problems or Queries."

Firefox hijackers

Thread Tools
 
Search this Thread
 
Old 14th Dec 2012, 11:56
  #1 (permalink)  
Thread Starter
 
Join Date: Jul 2012
Location: spacetime
Posts: 263
Likes: 0
Received 0 Likes on 0 Posts
Firefox hijackers

Anyone know how to PERMANENTLY get rid of SweetIm and Blecko hijackers? Have trolled the web for answers, with no success. Guess the problem lies in the registry somewhere.
gemma10 is offline  
Old 14th Dec 2012, 12:17
  #2 (permalink)  
Per Ardua ad Astraeus
 
Join Date: Mar 2000
Location: UK
Posts: 18,579
Likes: 0
Received 0 Likes on 0 Posts
Have trolled the web for answers
- apart from 'trolling', have you tried all the solutions Google offers? What are these problems you have? Site re-direct/toolbar/spamming - what? What do you mean by 'hijacker'?
BOAC is offline  
Old 14th Dec 2012, 16:20
  #3 (permalink)  
Thread Starter
 
Join Date: Jul 2012
Location: spacetime
Posts: 263
Likes: 0
Received 0 Likes on 0 Posts
On the firefox homepage you have a google main bar and a google in top right hand corner provided you have set google as your main search engine. When the firefox page is hijacked only the search in the top right hand corner finds google searches. The main centre page google defaults to a blecko or sweetIm search engine. Appears to be a known problem just search for "get rid of blecko". Malwarebytes, Norton, Spybot and Superantispyware do not get rid of it.
gemma10 is offline  
Old 14th Dec 2012, 16:29
  #4 (permalink)  
More bang for your buck
 
Join Date: Nov 2005
Location: land of the clanger
Age: 82
Posts: 3,512
Likes: 0
Received 0 Likes on 0 Posts
I have SweetIM on my firefox browser but i cannot remove it. it doesn't appear under Extensions or Appearances in Tools. Please help | Firefox Support Forum | Mozilla Support
green granite is offline  
Old 14th Dec 2012, 16:36
  #5 (permalink)  
Thread Starter
 
Join Date: Jul 2012
Location: spacetime
Posts: 263
Likes: 0
Received 0 Likes on 0 Posts
Thanks for that GG. Have done all they say but its still there. Im pretty sure its not a trojan but only malware. Like I said before I think its in the registry.
gemma10 is offline  
Old 14th Dec 2012, 16:45
  #6 (permalink)  
Per Ardua ad Astraeus
 
Join Date: Mar 2000
Location: UK
Posts: 18,579
Likes: 0
Received 0 Likes on 0 Posts
I think you are saying that your 'home page'; has been hijacked by sweet1m - there is also a search engine hijack it can do but you have not described that since you say the search box is still 'Google'. It appears to be associated with 'smilies' on instant messaging like MSN and yahoo and is thought to be harmless (but annoying!). I understand from your reply that 'blecko' is also coming up as a browser page and not just a search box item?

You have done this?

1) Use Add/Remove Programs from Control Panel in Windows to remove sweet1m and blecko (if they are there)
2) In Firefox go to Tools/Add-Ons/Extensions and uninstall the SweetIM and blecko extensions (if they are there)
3) Go to your search engines and find Manage Search Engines then delete the SweetIm search engine from the list. (JUST IN CASE!)
4) In Firefox go to Tools/Options and look at the Main tab. Be sure that your home page URL has not been hijacked.

If that does not fix it, run malwarebytes in Windows Safe mode and see.

Can you report back then?
BOAC is offline  
Old 14th Dec 2012, 16:56
  #7 (permalink)  
 
Join Date: Mar 2002
Location: near an airplane
Posts: 2,842
Received 69 Likes on 50 Posts
I've removed this pest from a colleagues laptop and the link in post #4 has the relevant tips that I used then:
Reset your Location Bar search engine (if typing a few words in the URL/Location Bar takes you to SweetIM search):
  • type about:config in your Location Bar, like typing a web site address, and press the Enter key
  • ignore warning and choose to continue
  • in Filter, type keyword.URL
  • in lower part of screen, if it is bold and shows "user set", right-click keyword.URL and choose "Reset"
  • in Filter, type SweetIM
  • any items in lower part of screen in bold and showing "user set", right-click and choose "Reset"
  • close about:config tab
I only had to search for 'SweetIM' and reset those values.
Jhieminga is online now  
Old 14th Dec 2012, 17:02
  #8 (permalink)  
Thread Starter
 
Join Date: Jul 2012
Location: spacetime
Posts: 263
Likes: 0
Received 0 Likes on 0 Posts
Thanks BOAC, have done all items 1 to 4 many times. Time to try it in safe mode as you say with malwarebytes. I think there is a program called IKILL which supposedly destroys this nuisance but am reluctant to go charging into the registry.
gemma10 is offline  
Old 14th Dec 2012, 17:20
  #9 (permalink)  
Psychophysiological entity
 
Join Date: Jun 2001
Location: Tweet Rob_Benham Famous author. Well, slightly famous.
Age: 84
Posts: 3,275
Received 42 Likes on 22 Posts
I'm worried now.

W7 Pro and FF 17 0 1


I like nothing on the main screen except Goo search box. Yes, the top one is there but I never use it.



The second I start typing, the box jumps to the top left. It's marked with a colourful Goo logo and over to the right is my e-mail address.

I just don't remember a new box appearing, but then my memory is somewhat suspect these days. Oh, BTW, it started doing it while I was still on FF 13
Loose rivets is offline  
Old 14th Dec 2012, 17:39
  #10 (permalink)  
 
Join Date: Mar 2002
Location: near an airplane
Posts: 2,842
Received 69 Likes on 50 Posts
Loose rivets: That's Google's latest interface, nothing to do with Firefox or hijackers. You're seeing normal behaviour.
Jhieminga is online now  
Old 15th Dec 2012, 03:30
  #11 (permalink)  
Psychophysiological entity
 
Join Date: Jun 2001
Location: Tweet Rob_Benham Famous author. Well, slightly famous.
Age: 84
Posts: 3,275
Received 42 Likes on 22 Posts
Phew! Thanks for that.
Loose rivets is offline  
Old 15th Dec 2012, 07:38
  #12 (permalink)  
Per Ardua ad Astraeus
 
Join Date: Mar 2000
Location: UK
Posts: 18,579
Likes: 0
Received 0 Likes on 0 Posts
gemma - it sounds as if post #7 may have your answer.
BOAC is offline  
Old 15th Dec 2012, 09:52
  #13 (permalink)  
 
Join Date: Aug 2007
Location: London, New York, Paris, Moscow.
Posts: 3,632
Likes: 0
Received 0 Likes on 0 Posts
Thumbs up I don't have the problem but thats like brilliant



Nice routine Jhieminga I've NEVER even heard of that stuff



one to store away.
glad rag is offline  
Old 15th Dec 2012, 10:03
  #14 (permalink)  
 
Join Date: Nov 2000
Location: Cambridge, England, EU
Posts: 3,443
Likes: 0
Received 1 Like on 1 Post
Very easy answer:

(1) Delete Firefox.

(2) Use IE.

Problem sorted.

For next time, the rule to apply is:

(3) Do not download, and install, and run, any malware.
Gertrude the Wombat is offline  
Old 15th Dec 2012, 10:56
  #15 (permalink)  
Thread Starter
 
Join Date: Jul 2012
Location: spacetime
Posts: 263
Likes: 0
Received 0 Likes on 0 Posts
SORTED. Thanks to all and especially post No.7. Ive seen something similar to that before but not in that detail..Up yours sweetim and blecko
gemma10 is offline  
Old 15th Dec 2012, 11:42
  #16 (permalink)  
More bang for your buck
 
Join Date: Nov 2005
Location: land of the clanger
Age: 82
Posts: 3,512
Likes: 0
Received 0 Likes on 0 Posts
Gemma 10 had you followed all the stuff in the link in post #4 you would have done the about:config bit.
green granite is offline  
Old 15th Dec 2012, 16:17
  #17 (permalink)  
Thread Starter
 
Join Date: Jul 2012
Location: spacetime
Posts: 263
Likes: 0
Received 0 Likes on 0 Posts
GG You`re right, didnt follow it right through, but thanks anyway
gemma10 is offline  

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service

Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.