Browser Hijacker Deskbar?

[Jimmy9190]

My wife has a Toshiba laptop, it is less than a year old. It runs Windows 7 Home Edition and the default browser is Firefox, it is up to date, running FF 18.

Last night my wife said her laptop was running very slowly and it was taking a very long time to boot up. When it did boot up the internet was slower than usual, but the home page had not been changed and did not appear to have been altered and it had no new tool bars or other add-ons that I could see or find. The laptop also has Norton NIS 2013 on it. A Norton scan last night did not find any problems.

I scanned it today with MWB free version, it found nothing. Then I downloaded the free trial of SAS Pro version, it came back with 112 items found and said it found "browser hijacker deskbar" and "Adware HB Helper". I used SAS to remove the junk. Yesterday I disabled the Java plug-ins in Firefox after reading a thread here about the new security problems with Java.

I have now re-started the laptop in safe mode and am scanning again with SAS Pro. It is now 29 minutes into the scan and so far it has found no problems. When this scan is done I will do a system restore back to a point before this problem appeared. Is that good enough or do you guys here have any further info or tips on how to get rid of this browser hijack malware?

Thanks for any help with this.

 

[LeakySeals]

I would not go back if the problem is resolved. Stay where you are. Going back may re-introduce it.

 

[Jimmy9190]

Thanks. The SAS scan in safe mode scan took 57 minutes and did not find any problems. I am running a full system SAS scan in normal mode now, just to see if anything comes back. FF is still a bit slow and the system itself was still a little slow to boot up the desk top but it appears to be better than it was. We are headed out for a while so I will check it again when we get home. I may try the Microsoft Malicious Software removal tool on it too and see what it might come up with. It is probably also time for a tune-up with CCleaner.

 

[FoxS]

Switch wifi off.

 

[bubbajoe_2112]

No need for a restore if everything is fixed. I'd run TDSS killer just to be sure you are clear of 0Access and rootkits.

Deskbar and Adware HB Helper are companion malware. They probably got installed when you installed some kind of 3rd party software or plugin. I'd check your program list in Control Panel and remove any PUP type software that happens to be there.

 

[Jimmy9190]

Well the hijacker junk appears to be gone. SAS Pro took care of it. I ran one SAS scan in normal mode that removed the junk, then I ran another scan in safe mode and another scan in normal mode again just to see if it missed anything. The safe mode and second normal mode scans came back clean. I did a scan with the Microsoft Malicious Program removal tool and scanned with TDSS Killer, both of those came back clean.

I also removed Norton and installed Avast and its initial scan came back clean as well. Mrs. Jimmy is none too pleased with Norton at the moment. I explained to her how not all AV programs will catch or remove every piece of malware all of the time, but she fired Norton and had me hire Avast. She knows I am very well pleased with Avast and the other security programs I use on my computer.

I also installed Advanced Uninstaller Pro and used it and the Norton Removal tool to remove all traces of Norton, and did some registry clean-up and made a backup of the new registry too. I went in and used a lot of the tools in Advanced Uninstaller to clean up old files, remove duplicate files, remove cookies and delete a lot of temp files.

Her regular everyday user account is just a standard account with no admin privileges. She has a second account for admin functions. I think the browser hijacker probably came from an infected link for a job offer that she saw posted on Craigs List. She knows not to click on links like that but she believed the post was from a legitimate employer on CL. Neither my wife nor I have installed any third party plugins or software, not to our knowledge anyway. If some dirtbag hacker or internet crook did it, it was done without our knowledge.

My wife will change her banking and credit card passwords just to be on the safe side but I am pretty sure the hijacker gimmick is gone. Her laptop is running a whole lot faster and much more efficiently now.

Thanks for everybody's help here. I do appreciate it very much.

 

[bubbajoe_2112]

So I guess you'll be firing Malwarebytes as well since it didn't detect either?

MBAM won't find it, neither will MSE or MMP or Microsoft Safety Scanner. I doubt Avast would either. As of right now, SAS may be one of the very few who will detect/remove it.

 

[The_Eric]

SAS Pro? Is that Super Anti Spyware?

 

[Jimmy9190]

Originally Posted By: The_Eric
SAS Pro? Is that Super Anti Spyware?


Yes it is the Pro version of Super Anti Spyware, it has more features and it auto-updates. I think it costs about $25.00. It is very similar to MWB, as in how the free version of MWB is an on-demand scanner only that you have to manually update and there is also a paid version of MWB that runs in real time that updates itself daily and has more features to it.

I checked her laptop again today and it is doing fine. I am glad this one appears to have been a simple fix, and we will keep an eye on it for a while to be sure it does not come back.

 

[Triple_Se7en]

I would guess the free version of SuperAntiSpyware would have caught it.

I use Avast 24-7. Then once a week on successive days, I runs scans using SuperAntiSpyware one day, Malwarebytes the next day - then Spybot the following day. Then a couple days later, I'll run a once-a-week scan from Avast.

 

[Jimmy9190]

My wife did not have SAS on her laptop until yesterday. We did have MWB Free on it though and she would scan with it about once a week. When I started working on the problem and MWB did not find anything, my next step was to try SAS. When I went to download the free version, it said there was a free trial of SAS Pro and I accepted the trial offer. I think the trial is only for a two week period and then it will revert back to the free version.

I think Avast is an excellent AV program and it is absolutely free too. I use it and SAS and I bought a lifetime subscription to MWB Pro. I scan with each at least once a week. I can not use my MWB Pro on her laptop though, it is a one-pc license only. I may get one for her laptop soon if she wants it. It only costs $25.00. MWB is the only malware program I would pay for.