Support Forum

Question

This thread was closed. Please ask a new question if you need help.

Firefox Homepage Hijacked by Claro-Search

49 replies
379 have this problem
66168 views
Last reply by jrwygant 4 months ago

Pawchii

Posted
8/14/12 7:35 AM

- RESETTING DOES NOT WORK**

Hello, I can recently acquired the Search Engine Malware? (I think it is a Malware)

http://isearch.claro-search.com/?affID=114169&tt=120812_bandext_3312_4&babsrc=HP_iclro&mntrId=907087e4000000000000002185985c90

I can not for the life of me take back the "HOMEPAGE" I have searched around everywhere and found how to take over the "NEW TAB" issue and it is back to Google.ca.

But I have yet to find a single issue with the Homepage being automatically hijacked and sending me straight back to the website no matter what I do to change the URL.

I have done the following things.

1: Removed the Toolbar from Add-ons

2: Removed the Toolbar from Control Panel

3: Shut down my computer and rebooted into Safe Mode - Networking to run Malware and other virus scanners.

4: Changed my Hosts File

5: Turned on Firefox in Safe-Mode resetting all defaults.

6: Changed the URL several times. ____________________________________________________

I can set the homepage to "Blank" which solves the issue. BUT I want Claro off my computer for good not just covered up with settings.

NOTE: I do not have expert knowledge in computerized configuration so I am at a lose into doing something like Manually checking my systems files and such to remove this issue.

If you know how to fix this, Please be detailed and simple.

Also! If i type anything into the search bar incorrectly it automatically uses iSearch-Claro to search for results.

Modified December 26, 2012 5:16:33 PM PST by Pawchii

Chosen solution

by cor-el

Is that the search bar on the about:home page?

If there is a problem with searching via the default about:home page then try to reset the search engine used on the about:home page.

Reset the browser.startup.homepage_override.mstone pref via the right-click context menu to the default on the about:config page and close and restart Firefox to restore the about:home page to its default.

http://kb.mozillazine.org/about:config

Open the about:config page via the location bar
Type in the Filter bar: mstone
Right-click the browser.startup.homepage_override.mstone line and select: Reset
Close and restart Firefox

If this didn't help then delete the delete the chromeappsstore.sqlite file in the Firefox Profile Folder and repeat the above.

You can use this button to go to the Firefox profile folder:

Help > Troubleshooting Information > Profile Directory: Open Containing Folder

Read this answer in context 18

Helpful replies

I just FINALLY cleaned up all this stuff. Every time I would reopen FireFox, all my settings would get reset to Claro homepage. I found that it also installed an Extension in FireFox called Browser Manager (publisher is Bit89). You need to UNINSTALL this, disabling it doesn't do anything.

To uninstall, Go to 'Uninstall or change program' in Computer. Look for something called Browser Manager and uninstall it. My browser seems like it is back to normal now.

I also deleted the rest of the contents of the folder after uninstalling to be safe. The location is C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753} or something similar to this depending on the version.

Go to answer 26

I had the same problem and had tried all of the things in these posts and more to remedy it.

I FOUND A SOLUTION that WORKS for regular Firefox (not sure about Chrome).

Please recognize that Claro is also related to Babylon AND BROWSER MANAGER. Many people neglect to remove the Browser Manager from their computer and therefore Claro keeps popping up as if it never left (because it hasn't!).

Below I will simplify the directions on how to remove the Browser Manager application from running on my computer AND removing it entirely so that I am now CLARO-FREE!

(P.S. I have Windows 7 64-bit if that makes any difference.)

1. Go to start -> type “services.msc” at the bottom and hit enter. Find "Browser Manager" in the list and right click to choose "Properties."

2. A window will pop up and under the Startup dropdown, choose "disabled." Click "Apply" and hit "OK."

3. Right click "Browser Manager" again and then click "Stop."

4. Close the services window, you are finished with it.

5. Go to Start -> type “cmd” and and right click the black box at the top that the search brings up and click "Run as Administrator." Hit "Yes" to allow the program to open. Type “sc delete “Browser Manager” in the window that pops up. It will give you a "SUCCESSFUL" message if it worked properly.

6. Close the command prompt black window, you are finished with it.

7. Hit Ctrl+Alt+Del ONE time only and choose "Task Manager."

8. Find "Browser Manager" or any variant of that and right click to "END TASK."

9. Close "Task Manager," you are finished with it.

10. (Note: The next step requires editing your computer's registry. Removing the wrong items may damage your computer permanently! Please do not continue if you do not feel comfortable with it!!!)

11. Reboot to safe mode by pressing F8 when your computer is starting up

12. We will first create a BACK UP registry file in case anything happens. Do this by going to start -> run -> and typing in "regedit" without quotes.

13. In the top File menu choose "Export" and then NAME your BACKUP registry and save to desktop.

14. In the Edit menu, use the "Find" option to search for "browsemngr.exe." Before touching any of the entries that come up, look to the immediate left where all the yellow folders are. The entries on the right should be part of a "Browser Manager" folder on the left. DELETE the FOLDER on the LEFT by right clicking and choosing "Delete."

15. Repeat the search under Edit --> Search --> "browsemngr.exe." Another entry should show up under a folder, probably named something similar to the first. DELETE the YELLOW folder the right-side browsermngr.exe is located in.

16. Repeat the same search again to make sure you've gotten it all.

17. Try a NEW search for "Claro" and repeat deletion of those folder ONLY if they hold claro/babylon/browser manager items. DO NOT delete entire "Mozilla" folder, etc! Be careful.

18. Repeat search option for "Babylon" entries. Keep searching until NOTHING comes up for either of those 3 terms.

19. Close your registry and RESTART your computer.

Now when you load Mozilla Firefox, it should NOT show Claro anymore!

If it does, please try resetting Firefox homepage settings back to your preferred website and then restarting the browser OR going to Firefox --> Help --> Restart with Add-Ons Disabled --> Reset Firefox.

This worked for me, hope it works for you!!!!!!!!

Go to answer 7

Answer 1 · 2012-11-19T05:38:55-08:00

persianboy 0 solutions 1 answers

Posted
11/19/12 5:38 AM

Just open the webpage you need to be as your homepage, Bookmark it.

Now, go to Mozilla tools>>> Setting>>> in the homepage section click on Use Bookmarks>>. Choose your Page from the list. Apply & OK.

Restart the browser. Done!!

OR>>>>> https://addons.mozilla.org/firefox/addon/searchreset/

U will never see the Claro search anymore. :-)

Persian Boy.

Modified November 19, 2012 6:42:26 AM PST by persianboy

Answer 2 · 2012-11-19T11:48:50-08:00

bakoma 0 solutions 1 answers

Posted
11/19/12 11:48 AM

Just share my experience:

As of 11/19/2012.

This virus varies from time to time. Above posts are no longer useful. I was not able to find any effective way by searching online. It took me a whole day to figure it out.

Both in your registry and hard drive, search the following:

claro, browsermngr, (another thing I forgot)

Delete them and their possible containers. Everything will be fine. Most files won't be able to be deleted directly. You either need to do it in safe mode, or remove them from service and then reboot to continue.

Answer 3 · 2012-11-19T15:55:24-08:00

gabitao 0 solutions 1 answers

Posted
11/19/12 3:55 PM

I haver tried a lot of things and finally I HAVE SUCCEED.

I have:

1. Uninstalled the Claro LTD Toolbar software from Windows and any other Claro or Babylon software.

2. Cleaned Extensions, etc.

3. Cleaned the about:config

4. Reset search engine settings.

But claro search engine kept on appearing as a home page.

What I think it has been the killer move has been to remove the "Browser Manager" process (browsemngr.exe), following this, with a little variation:

http://www.explosiveknowledge.net/main/2012/08/19/browsemngr/ http://www.explosiveknowledge.net/main/2012/08/19/browsemngr/

The variations are:

1. Run the cmd as administrator. If not the command will not be able the delete the service (sc delete "browser manager" will not work).

2. To finally Remove the Browser Manager folder you might need to restart in safe mode.

I hope this helps :-) because it was a really annoying and interfering malware.

(The same overall process worked with Chrome, as long as its homepage had also been hickjaked by the same malware.)

I have not tried using Malware Bytes, maybe it works.

Answer 4 · 2012-11-21T02:26:12-08:00

kck48 0 solutions 1 answers

Posted
11/21/12 2:26 AM

Thanks for this. I have tried all other help ideas without success. This one works by Uninstalling Browser Manager in Control Panel as well as removing the Caro search in manage search engines in the top right of the screen and restoring default preffered home page in File, Options, homepage settings. thanks

Answer 5 · 2012-12-18T09:55:38-08:00

oldDavid 0 solutions 1 answers

Posted
12/18/12 9:55 AM

Just started using Firefox and downloaded Version 18 and since I haven't used Firefox for some time I was very surprise to find some problems still exist; for one is the crazy Claro Search Toolbar and Search Page, so after following All attempts that are listed and appear easy-they didn't work for me, the last resort I used the Program AdwCleaner-And it worked-so far?- the following is the listing from this program;

# AdwCleaner v2.101 - Logfile created 

12/18/2012 at 11:33:30
# Updated 16/12/2012 by Xplode
# Operating system : Windows 7 Home Premium 

Service Pack 1 (32 bits)
# User : Dell - DELL-PC
# Boot Mode : Normal
# Running from : C:\Users\Dell\Downloads

\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : PC Performer Manager

***** [Files / Folders] *****

Deleted on reboot : C:\ProgramData\pc 

performer manager
File Deleted : C:\Program Files\Mozilla 

Firefox\searchplugins\babylon.xml
File Deleted : C:\Users\Dell\AppData

\Roaming\Mozilla\Firefox\Profiles

\tynfknvj.default-

1355778179274\bprotector_extensions.sqlite
File Deleted : C:\Users\Dell\AppData

\Roaming\Mozilla\Firefox\Profiles

\tynfknvj.default-

1355778179274\bprotector_prefs.js
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData

\IBUpdaterService
Folder Deleted : C:\Users\Dell\AppData

\Roaming\OpenCandy
Folder Deleted : C:\Users\Dell\Documents

\ShopToWin

***** [Registry] *****

Data Deleted : HKLM\..\Windows [AppInit_DLLs] 

= c:

\progra~2\pcperf~1\24897~1.175\{61d8b~1\pcpmn

gr.dll
Key Deleted : HKCU\Software\AppDataLow

\Software\PriceGong
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\Microsoft

\Internet Explorer\SearchScopes\{0ECDF796-

C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft

\Windows\CurrentVersion\Ext\bProtectSettings
Key Deleted : HKCU\Software\Microsoft

\Windows\CurrentVersion\Ext\Settings

\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}
Key Deleted : HKCU\Software\Microsoft

\Windows\CurrentVersion\Ext\Settings

\{1631550F-191D-4826-B069-D9439253D926}
Key Deleted : HKCU\Software\Microsoft

\Windows\CurrentVersion\Ext\Settings

\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Classes

\Interface\{79FB5FC8-44B9-4AF5-BADD-

CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKU\S-1-5-21-3966030448-

1202514810-862185238-1000\Software\Microsoft

\Internet Explorer\SearchScopes\{0ECDF796-

C2DC-4D79-A620-CCE0C0A66CC9}
Value Deleted : HKCU\Software\Microsoft

\Internet Explorer\Main [bprotector start 

page]
Value Deleted : HKCU\Software\Mozilla

\Firefox\Extensions [{dfefbe51-ca52-484b-

adf0-6b158b05262d}]
Value Deleted : HKLM\SOFTWARE\Microsoft

\Internet Explorer\Toolbar [{9E131A93-EED7-

4BEB-B015-A0ADB30B5646}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Mozilla Firefox v18.0 (en-US)

Profile name : default-1355778179274 [Profil 

par défaut]
File : C:\Users\Dell\AppData\Roaming

\Mozilla\Firefox\Profiles\tynfknvj.default-

1355778179274\prefs.js

Deleted : user_pref

("browser.search.selectedEngine", "Claro 

Search");
Deleted : user_pref("keyword.URL", 

"^hxxp://www\\.claro-search\\.com/\\?

affID=114506.*&q=");

-\\ Google Chrome v [Unable to get version]

File : C:\Users\Dell\AppData\Local

\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [3256 octets] - 

[18/12/2012 11:30:00]
AdwCleaner[S1].txt - [3148 octets] - 

[18/12/2012 11:33:30]

########## EOF - C:\AdwCleaner[S1].txt - 

[3208 octets] ##########

Modified December 19, 2012 1:05:49 AM PST by cor-el

Answer 6 · 2012-12-25T07:43:56-08:00

Calrosearch 0 solutions 6 answers

Posted
12/25/12 7:43 AM

Hello from Claro search support team! Claro search is very easy to remove, please follow this link: http://info.claro-search.com/uninstall.html to get full and quick instructions. In case you need more, feel free to contact us at: Support@Claro-Search.com, we'll be glad to help you with any issue!

Answer 7 · 2012-12-25T13:41:39-08:00

jrwygant 0 solutions 3 answers

Posted
12/25/12 1:41 PM

The Claro solution changes the homepage only. When I opened a new blank tab I still got the Claro search page, rather than the Firefox page that shows thumbnails of recently opened pages. It was much more complicated getting rid of that. I don't think they know what they're doing.

Answer 8 · 2012-12-26T00:45:09-08:00

Calrosearch 0 solutions 6 answers

Posted
12/26/12 12:45 AM

Hello jrwygant did you try to use our uninstall site? that's the link: http://info.claro-search.com/uninstall.html we offer quick and easy instructions so you'll be able to remove it from firefox. in case you need further assistance please contact us: support@claro-search.com

Modified December 26, 2012 12:49:45 AM PST by Calrosearch

Answer 9 · 2012-12-26T17:16:33-08:00

jrwygant 0 solutions 3 answers

Posted
12/26/12 5:16 PM

Yes, of course I looked at the Claro page. As I already mentioned, all that pages does is tell the user how to reset the homepage. Reading all of the messages in this forum should make it abundantly clear that the problem is much greater than that. The homepage will not stay reset, and a new tab will not come up with thumbnails of recent pages, but instead opens onto Claro Search. This has been stated many times, but I'll try it again: RESETTING THE HOMEPAGE IS NOT A SOLUTION. I have fixed my problem, using various techniques described in this forum, including cleaning out a Firefox data page and uninstalling a Claro program that I don't recall ever installing. This is a serious problem that demands more serious attention from Claro.

Support Forum

Firefox Homepage Hijacked by Claro-Search

Chosen solution

Helpful replies

Additional System Details

This happened

This started when...

Installed Plug-ins

Application

More Information