Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 342
  • Last Modified:

Web Browsers Start Page Hijacker

I have installed one of those free software which with one click and hard to see recommendation and agreements I ended up to a new start page (hijacked) of my browsers.
The unwanted page is http://www.seeklatin.com/ 
I blocked it in the host file, but the browsers still redirect for that page when I start them.
I have the problem with internet explorer, firefox, chrome and opera.
I have tried all kind of cleaners and after some cleaning nothing could be detected anymore. Still I have the same problem.
I have rested the web browsers and only chrome is now clean.
How do I get rid of www.seeklatin.com?
What cleaners and methods do you recommend?
Cleaners used: MalwareBytes, Hitman Pro, SpyHunter, SuperAntiSpyware, AdwCleaner, Lavasoft Ad-Aware and other...
0
viki2000
Asked:
viki2000
7 Solutions
 
bbaoIT ConsultantCommented:
> I blocked it in the host file, but the browsers still redirect for that page when I start them.

the host file doesn't help here at all if the hijacker software uses IP addrssing directly.

> I have the problem with internet explorer, firefox, chrome and opera.

that basically means the malware has been installed and running (still active) on your computer. it might be initially injected by IE using an unsolicited ActiveX control but then implanted itself into your system once the marlicious binary code was executed at privilege rights (I guess your account is an admin, right?).

which version of Windows are you using?

anyway first try disabling all add-ons in IE, Chrome, Firefox and Opera and all unknown Auto Start items of Windows using MSCONFIG, then restart your computer and boot into Windows Safe Mode with networking support. Open a non-IE browser to see if the start page is still hijacked one. if yes, try changing it and see if it still comes back automatically.

let us know your test result.
0
 
Dr. KlahnPrincipal Software EngineerCommented:
Restore the system to the most recent Restore Point prior to when the problem occurred.
0
 
dbruntonCommented:
What operating system are you running?

Do you have anything loaded in your Startup folder?
0
Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

 
viki2000Author Commented:
I will try your suggestions tonight when i am home. Until then here are some answers:

@Bing CISM / CISSP
“the host file doesn't help here at all if the hijacker software uses IP addrssing directly”
I realized that, but at least the content is not shown any more.
My account is admin on that PC indeed.
I am using Win 8.1 64bit.
I disabled all the add-ons on all browsers and there is nothing on Auto-Start. I tried to reset all the browsers. After cleaning and the reset of browsers only Chrome became clean and does show that problem anymore.
I did not try yet the safe mode; I forgot about it, I will try tonight.

@Dr. Klahn
I never liked system restore and I do not want it. I prefer it as last solution. The reason is that I play with different programs, sometimes often and are too many changes which a system restore cannot remember as I do not make a regularly backup/save point for the system.

@dbrunton
I use Win 8.1 64bit.
There is nothing in Startup folder.

I tried also 2 antiviruses and several antispyware, anti-adware, anti-malware and it is nothing detected. That is the strange part. So it seems somehow attached to the browser. If it would be an active malware inside Windows and tries to reach that page no matter what browser I use, then how come Chrome is now clean?
0
 
dbruntonCommented:
Possible test.

Got Flash installed?  If so, try removing it.

Chrome uses its own version of Flash.  The others use Adobe Flash.
0
 
Dirk MareSystems Engineer (Acting IT Manager)Commented:
use kaspersky rescue disk or bitdeffender rescue disk
quick google you can finf both of them and the tutorials

download iso install to USB or burn on CD
boot from CD/USB follow all the prompts
download latest definitions
scan pc

restart
reset all browser settings

DirkMare
0
 
viki2000Author Commented:
SpyHunter detected next:
Conduit search
If I delete sessionstore.js what do I lose except all the tabs and history?
I except that will solve the Firefox problem.
0
 
viki2000Author Commented:
Removed Flash.
Still the same problem.
0
 
viki2000Author Commented:
Restarted in safe mode.
The same problem.
If I remove all the tabs from Firefox and I set Show My Home Page when Firefox starts and I set My Home Page as www.google.com, then that home page is hijacked. When Firefox starts it jumps to that www.seeklatin.com , the same in safe mode, with firefox, opera and IE. Only Chrome is now clean.
0
 
viki2000Author Commented:
I have made important progress.
Now I have also IE and Firefox clean.
I used next cleaner https://www.avast.com/browser-cleanup
I had to uncheck at the bottom "Exclude add-ons with a good rating", reset browser and set the home page to Google.
I downloaded Kaspersky Rescue CD and Rufus to make USB bootable, but I did not try them yet.
Now I need only Opera to be cleaned.

I could uninstall and reinstall Opera.
Other suggestions?
0
 
David AndersTechnician Commented:
HijackThis is available from FileHippo, MajorGeeks, and BleepingComputer.
I have used it successfully on WinXP. It supposedly runs on Win8.
Getting advice from an online expert is recommended.
0
 
viki2000Author Commented:
I uninstalled Opera, deleted user data and reinstalled latest version of Opera.
Now is clean.
Seems all browsers are clean now and the problem solved.
I will let this question open for several days to see if everything remains clean.
0
 
serialbandCommented:
HijackThis! should really be downloaded from SourceForge where the current latest vesion resides.  Don't send people to download aggregators, especially FileHippo.  https://sourceforge.net/projects/hjt/
0
 
viki2000Author Commented:
Thank you for your suggestions.
It seems I am clean now.
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now