X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

Firefox Homepage Hijacked by Claro-Search

Posted
    • RESETTING DOES NOT WORK**

Hello, I can recently acquired the Search Engine Malware? (I think it is a Malware)

http://isearch.claro-search.com/?affID=114169&tt=120812_bandext_3312_4&babsrc=HP_iclro&mntrId=907087e4000000000000002185985c90

I can not for the life of me take back the "HOMEPAGE" I have searched around everywhere and found how to take over the "NEW TAB" issue and it is back to Google.ca.

But I have yet to find a single issue with the Homepage being automatically hijacked and sending me straight back to the website no matter what I do to change the URL.

I have done the following things.

1: Removed the Toolbar from Add-ons

2: Removed the Toolbar from Control Panel

3: Shut down my computer and rebooted into Safe Mode - Networking to run Malware and other virus scanners.

4: Changed my Hosts File

5: Turned on Firefox in Safe-Mode resetting all defaults.

6: Changed the URL several times. ____________________________________________________

I can set the homepage to "Blank" which solves the issue. BUT I want Claro off my computer for good not just covered up with settings.


NOTE: I do not have expert knowledge in computerized configuration so I am at a lose into doing something like Manually checking my systems files and such to remove this issue.

If you know how to fix this, Please be detailed and simple.

Also! If i type anything into the search bar incorrectly it automatically uses iSearch-Claro to search for results.

Modified by Pawchii

Chosen solution

Is that the search bar on the about:home page?

If there is a problem with searching via the default about:home page then try to reset the search engine used on the about:home page.

Reset the browser.startup.homepage_override.mstone pref via the right-click context menu to the default on the about:config page and close and restart Firefox to restore the about:home page to its default.

  1. Open the about:config page via the location bar
  2. Type in the Filter bar: mstone
  3. Right-click the browser.startup.homepage_override.mstone line and select: Reset
  4. Close and restart Firefox

If this didn't help then delete the delete the chromeappsstore.sqlite file in the Firefox Profile Folder and repeat the above.

You can use this button to go to the Firefox profile folder:

  • Help > Troubleshooting Information > Profile Directory: Open Containing Folder
Read this answer in context 18

Additional System Details

This happened

Every time Firefox opened

This started when...

3 Days ago

Installed Plug-ins

  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • Google Update
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Next Generation Java Plug-in 10.5.1 for Mozilla browsers
  • Vizzed Retro Game Room Plugin
  • iTunes Detector Plug-in
  • 4.1.10329.0
  • Roblox Launcher Plugin
  • DivX Plus Web Player version 2.2.0.52
  • RealJukebox Netscape Plugin
  • RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In
  • RealPlayer(tm) HTML5VideoShim Plug-In
  • RealPlayer(tm) LiveConnect-Enabled Plug-In
  • 12.0.1.669
  • GEPlugin
  • Shockwave Flash 10.3 r183
  • Unity Player 3.4.1f5
  • Adobe Shockwave for Director Netscape plug-in, version 11.6.1.629
  • DivX VOD Helper Plug-in
  • Windows Presentation Foundation (WPF) plug-in for Mozilla browsers
  • Adobe PDF Plug-In For Firefox and Netscape

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.0; rv:14.0) Gecko/20100101 Firefox/14.0.1

More Information

Application Basics
Name
Firefox
Version
14.0.1
User Agent
Mozilla/5.0 (Windows NT 6.0; rv:14.0) Gecko/20100101 Firefox/14.0.1
Profile Folder
Show Folder
Enabled Plugins
about:plugins
Build Configuration
about:buildconfig
Crash Reports
about:crashes
Memory Use
about:memory
Extensions
Name
Version
Enabled
ID
AVG Do Not Track
12.0.0.2189
false
{F53C93F1-07D5-430c-86D4-C9531B27DFAF}
AVG Safe Search
12.0.0.2191
false
{1E73965B-8B48-48be-9C8D-68B920ABC1C4}
Browser Manager
2.2.565.25
false
{b64982b1-d112-42b5-b1e4-d3867c4533f8}
DivX Plus Web Player HTML5 <video>
2.1.2.145
false
{23fcfd51-4958-4f00-80a3-ae97e717ed8b}
Microsoft .NET Framework Assistant
0.0.0
false
{20a82645-c095-46ed-80e3-08825760534b}
RealPlayer Browser Record Plugin
14.0.7
false
{ABDE892B-13A8-4d1b-88E6-365A6E755758}
UltimateGamesBar
1.7.0.19505
false
2sffxtbr@GameNutt_2s.com
Important Modified Preferences
Name
Value
browser.cache.disk.capacity
1048576
browser.cache.disk.smart_size.first_run
false
browser.cache.disk.smart_size_cached_value
1048576
browser.places.smartBookmarksVersion
4
browser.startup.homepage
about:home
browser.startup.homepage_override.buildID
20120713134347
browser.startup.homepage_override.mstone
14.0.1
browser.tabs.onTop
false
browser.tabs.warnOnClose
false
extensions.lastAppVersion
14.0.1
keyword.URL
network.cookie.prefsMigrated
true
places.history.expiration.transient_current_max_pages
53385
privacy.sanitize.migrateFx3Prefs
true
security.warn_viewing_mixed
false
Graphics
Adapter Description
Intel(R) G33/G31 Express Chipset Family
Vendor ID
0x8086
Device ID
0x29c2
Adapter RAM
Unknown
Adapter Drivers
igdumd32
Driver Version
7.14.10.1461
Driver Date
3-25-2008
Direct2D Enabled
Blocked for your graphics driver version.
DirectWrite Enabled
false (7.0.6002.18592)
ClearType Parameters
ClearType parameters not found
WebGL Renderer
Blocked for your graphics driver version. Try updating your graphics driver to version 7.15.10.1666 or newer.
GPU Accelerated Windows
0. Blocked for your graphics driver version. Try updating your graphics driver to version 7.15.10.1666 or newer.
JavaScript
Incremental GC
1
Library Versions
Expected minimum version
Version in use
NSPR
4.9
4.9
NSS
3.13.5.0 Basic ECC
3.13.5.0 Basic ECC
NSS Util
3.13.5.0
3.13.5.0
NSS SSL
3.13.5.0 Basic ECC
3.13.5.0 Basic ECC
NSS S/MIME
3.13.5.0 Basic ECC
3.13.5.0 Basic ECC

vasconero 0 solutions 3 answers

Seguendo i tuoi consigli ho usato regedit ed ho cancellato tutte le voci Babylon e Claro. Per ora il problema sembra risolto. Prima evevo provato anche l'Add-on Searchreset, ma non mi aveva risolto il problema. Grazie a tutti per i vostri consigli. Se il problema non si ripeterà vi informerò.

vasconero 0 solutions 3 answers

Grazie Desarno, ma avevo già fatto tutto quello che mi hai scritto, l'unica soluzione che mi ha eliminato il problema è quella indicata da Vonrap. Andare su regedit ed eliminare tutte le voci "Babylon" e "Claro". Una per volta con molta attenzione. Grazie per il consiglio.

ciroberts 0 solutions 1 answers

To help out the cleaning out of this infection, once at the "about:config" page also reset the browser.newtab.url pref. To find it easy you can search for "claro" once there because this will the homepage it is set to or you can search for newtab either will find this pref. Once found just right-click on it and choose "reset" and it should set it back to "about:newtab" .

I completed the reset described above but it would still show up when I started new tabs. This will clear that out!

giusi 0 solutions 2 answers

Ciao a tutti, ho eseguito la prassi indicata da vonrap, ma purtroppo ho ancora babylon. Sono andata sul registro di sistema, ho eliminato tutto ciò che trovavo con babylon ma niente da fare. Sono pure andata sulla barra degli indirizzi con about:config e ho eseguito come richiesto, ma dopo la chiusura e riapertura di firefox, babylon riappare inesorabile. Che altro si può fare? sono preoccupata, non vorrei dover reinstallare il sistema operativo.

giusi 0 solutions 2 answers

Ciao Vonrap, ti ringrazio per il tempismo nel rispondere. Ti do una buona notizia: ce l'ho fatta. Dopo aver provato di tutto, ho continuato con la dritta di desarno e sono andata su componenti aggiuntivi e ho eseguito il percorso 2. Alla fine babylon è sparito ma me lo sono ancora ritrovata nell'icona della pagina iniziale in alto a destra. Non so come, ma sono andata su strumenti, opzioni e alla fine ho reimpostato la pagina inziale. Ora è davvero tutto ok. E' stata dura, era da alcuni giorni che cervavo di disinstallare questo malefico browser. Ringrazio te, desarno e tutti voi per l'aiuto. Buon pomeriggio.

81giulio 0 solutions 2 answers

ciao ho lo stesso problema non riesco a togliere claro,potresti aiutarmi? ho scaricato TEAMVIEWER e spero di trovare una soluzione

vonrap 0 solutions 5 answers

ti ho già risposto di sì contattami con team viewer 979 471 567 ciao

81giulio 0 solutions 2 answers

mi chiede la password che viene visualizzata dall'interlocutore, che vuol dire? Mi scuso per l'ignoranza

AEdaystar 0 solutions 3 answers

Yes, I chose the "Help > Restart with Add-Ons Disabled" and that seemed to work for me!

So glad to be rid of Claro. I tried deleting through my Add-Ons or Extensions which worked for me in Chrome but not Firefox.

zhdlkhan 0 solutions 1 answers

Ok...hope this helps because its working for me so far. First go to control panel and uninstall Claro it'll give you an error at the end of the uninstall process because the programmers of Claro are douchbags. When the uninstall is done and you can no longer see claro on uninstall then open mozilla .. Help - Restart with addons disabled and RESET. Reset Mozilla totally as it will delete all of your addons and extensions and you have to build it up from scratch. After that! Go to the mini search bar next to the url bar you'll still see Claro there. Click on Manage Search Engines and remove Claro. It's the only thing that has worked for me.

PS. I downloaded the top malware remover from Cnet and it still wouldn't delete Claro.

jrwygant 0 solutions 3 answers

This worked for me, but I'm not making any guarantees... 1) in the URL address bar type in about:config 2) on the config page there is a search bar at the top of the page; type in "claro" in that space 3) you will get a list of everything that contains the word "claro" 4) right-click on each line to bring up a menu that includes the option to "reset" that line; select that option 5) do that for all but the boolean (true/false) lines, and for those click instead on "toggle" to set them to "false" if they look like they let Claro do something and to "true" if they look like they let the user do something 6) when you've done all the lines (mine had about 17) without doing anything further, close Firefox 7) when you reopen it the problem should be gone (but I don't know for how long) 8) I also followed the instructions given elsewhere to delete the file chromeappsstore.sqlite which I found by using the Firefox menu, selecting Help / Troubleshooting Information and clicking the "show folder" button for Profile Information, but I don't know what that accomplished, since it did not get rid of the problem by itself. Good luck!

Modified by jrwygant

chemminger 0 solutions 1 answers

Helpful Reply

I just FINALLY cleaned up all this stuff. Every time I would reopen FireFox, all my settings would get reset to Claro homepage. I found that it also installed an Extension in FireFox called Browser Manager (publisher is Bit89). You need to UNINSTALL this, disabling it doesn't do anything.

To uninstall, Go to 'Uninstall or change program' in Computer. Look for something called Browser Manager and uninstall it. My browser seems like it is back to normal now.

I also deleted the rest of the contents of the folder after uninstalling to be safe. The location is C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753} or something similar to this depending on the version.

Modified by chemminger

ADE2012 0 solutions 1 answers

il problema è molto più grave...qualcuno ha notato che non si possono più salvare le impostazioni di privacy come opzione anti-tracciamento, o le impostazioni che impediscono di salvare password, cronologia, etc? Apparentemente sembra che le impostazioni siano salvate, ma basta riavviare il browser e tutto torna come prima! L'applicazione SearchReset fa sparire la stringa, ma il malware rimane....

Tyler Downer
  • Administrator
  • Moderator
1165 solutions 6642 answers

We are currently experimenting on ways to guard against attacks by extensions such as this in the future. If anyone is infected by Claro Search, Babylon, funmoods, etc. and wants to help test some new techniques to combat these extensions please Private message me.

genefreak2 0 solutions 1 answers

1.open firefox 2.about:config 3.search for babylon 4.reset any claro related urls to google.com 5.search for claro 6.repeat step 4 your done.restart firefox :D

EdgeBlade 0 solutions 1 answers

I tried the manual solution provided by cor-el. It worked to some extent. I uninstalled the calro toolbar. After system reboot, the isearch toolbar was gone, but the mozilla homepage was still the claro one. A Norton scan did not find any spyware.

Finally, I rebooted the system in Safe Mode (no networking). Then I ran mozilla to see what happened. The browser tried to load my normal homepages. But there is no internet connection, so nothing happened. At the same time, mozilla notified me that a program "Browser Manager" by "CBTInc." tried to install an extension. In my last combing through the Control Panel, I did not notice this program. Based on the time of installation of the "Browser Manager", I decided to remove this program. After another system reboot, my computer was back to normal. It seems different versions of this malware try to hide themselves by changing the file names. Maybe you should look through your recently installed programs to see if this is the case with you.

Viv 0 solutions 1 answers

Helpful Reply

I had the same problem and had tried all of the things in these posts and more to remedy it.

I FOUND A SOLUTION that WORKS for regular Firefox (not sure about Chrome).

Please recognize that Claro is also related to Babylon AND BROWSER MANAGER. Many people neglect to remove the Browser Manager from their computer and therefore Claro keeps popping up as if it never left (because it hasn't!).

Below I will simplify the directions on how to remove the Browser Manager application from running on my computer AND removing it entirely so that I am now CLARO-FREE!

(P.S. I have Windows 7 64-bit if that makes any difference.)

1. Go to start -> type “services.msc” at the bottom and hit enter. Find "Browser Manager" in the list and right click to choose "Properties."

2. A window will pop up and under the Startup dropdown, choose "disabled." Click "Apply" and hit "OK."

3. Right click "Browser Manager" again and then click "Stop."

4. Close the services window, you are finished with it.

5. Go to Start -> type “cmd” and and right click the black box at the top that the search brings up and click "Run as Administrator." Hit "Yes" to allow the program to open. Type “sc delete “Browser Manager” in the window that pops up. It will give you a "SUCCESSFUL" message if it worked properly.

6. Close the command prompt black window, you are finished with it.

7. Hit Ctrl+Alt+Del ONE time only and choose "Task Manager."

8. Find "Browser Manager" or any variant of that and right click to "END TASK."

9. Close "Task Manager," you are finished with it.

10. (Note: The next step requires editing your computer's registry. Removing the wrong items may damage your computer permanently! Please do not continue if you do not feel comfortable with it!!!)

11. Reboot to safe mode by pressing F8 when your computer is starting up

12. We will first create a BACK UP registry file in case anything happens. Do this by going to start -> run -> and typing in "regedit" without quotes.

13. In the top File menu choose "Export" and then NAME your BACKUP registry and save to desktop.

14. In the Edit menu, use the "Find" option to search for "browsemngr.exe." Before touching any of the entries that come up, look to the immediate left where all the yellow folders are. The entries on the right should be part of a "Browser Manager" folder on the left. DELETE the FOLDER on the LEFT by right clicking and choosing "Delete."

15. Repeat the search under Edit --> Search --> "browsemngr.exe." Another entry should show up under a folder, probably named something similar to the first. DELETE the YELLOW folder the right-side browsermngr.exe is located in.

16. Repeat the same search again to make sure you've gotten it all.

17. Try a NEW search for "Claro" and repeat deletion of those folder ONLY if they hold claro/babylon/browser manager items. DO NOT delete entire "Mozilla" folder, etc! Be careful.

18. Repeat search option for "Babylon" entries. Keep searching until NOTHING comes up for either of those 3 terms.

19. Close your registry and RESTART your computer.

Now when you load Mozilla Firefox, it should NOT show Claro anymore!

If it does, please try resetting Firefox homepage settings back to your preferred website and then restarting the browser OR going to Firefox --> Help --> Restart with Add-Ons Disabled --> Reset Firefox.

This worked for me, hope it works for you!!!!!!!!

Modified by Viv

steveburston 0 solutions 1 answers

I have exhausted all information submitted on this page and have even used microsoft emergency response tool (http://support.microsoft.com/gp/cu_sc_virsec_b107) including malware bytes, finaly got rid of this damn thing by simply using system restore to a date I was possitive was clean, immediatly shut down computer and ran malware bytes (fresh install) in safe mode, then full scan from microsoft security essentials after restart, three days I have battled with this and this procedure is successful, please excuse spelling errors.