X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

Firefox Homepage Hijacked by Claro-Search

Posted
    • RESETTING DOES NOT WORK**

Hello, I can recently acquired the Search Engine Malware? (I think it is a Malware)

http://isearch.claro-search.com/?affID=114169&tt=120812_bandext_3312_4&babsrc=HP_iclro&mntrId=907087e4000000000000002185985c90

I can not for the life of me take back the "HOMEPAGE" I have searched around everywhere and found how to take over the "NEW TAB" issue and it is back to Google.ca.

But I have yet to find a single issue with the Homepage being automatically hijacked and sending me straight back to the website no matter what I do to change the URL.

I have done the following things.

1: Removed the Toolbar from Add-ons

2: Removed the Toolbar from Control Panel

3: Shut down my computer and rebooted into Safe Mode - Networking to run Malware and other virus scanners.

4: Changed my Hosts File

5: Turned on Firefox in Safe-Mode resetting all defaults.

6: Changed the URL several times. ____________________________________________________

I can set the homepage to "Blank" which solves the issue. BUT I want Claro off my computer for good not just covered up with settings.


NOTE: I do not have expert knowledge in computerized configuration so I am at a lose into doing something like Manually checking my systems files and such to remove this issue.

If you know how to fix this, Please be detailed and simple.

Also! If i type anything into the search bar incorrectly it automatically uses iSearch-Claro to search for results.

Modified by Pawchii

Chosen solution

Is that the search bar on the about:home page?

If there is a problem with searching via the default about:home page then try to reset the search engine used on the about:home page.

Reset the browser.startup.homepage_override.mstone pref via the right-click context menu to the default on the about:config page and close and restart Firefox to restore the about:home page to its default.

  1. Open the about:config page via the location bar
  2. Type in the Filter bar: mstone
  3. Right-click the browser.startup.homepage_override.mstone line and select: Reset
  4. Close and restart Firefox

If this didn't help then delete the delete the chromeappsstore.sqlite file in the Firefox Profile Folder and repeat the above.

You can use this button to go to the Firefox profile folder:

  • Help > Troubleshooting Information > Profile Directory: Open Containing Folder
Read this answer in context 18

Additional System Details

This happened

Every time Firefox opened

This started when...

3 Days ago

Installed Plug-ins

  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • Google Update
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Next Generation Java Plug-in 10.5.1 for Mozilla browsers
  • Vizzed Retro Game Room Plugin
  • iTunes Detector Plug-in
  • 4.1.10329.0
  • Roblox Launcher Plugin
  • DivX Plus Web Player version 2.2.0.52
  • RealJukebox Netscape Plugin
  • RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In
  • RealPlayer(tm) HTML5VideoShim Plug-In
  • RealPlayer(tm) LiveConnect-Enabled Plug-In
  • 12.0.1.669
  • GEPlugin
  • Shockwave Flash 10.3 r183
  • Unity Player 3.4.1f5
  • Adobe Shockwave for Director Netscape plug-in, version 11.6.1.629
  • DivX VOD Helper Plug-in
  • Windows Presentation Foundation (WPF) plug-in for Mozilla browsers
  • Adobe PDF Plug-In For Firefox and Netscape

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.0; rv:14.0) Gecko/20100101 Firefox/14.0.1

More Information

Application Basics
Name
Firefox
Version
14.0.1
User Agent
Mozilla/5.0 (Windows NT 6.0; rv:14.0) Gecko/20100101 Firefox/14.0.1
Profile Folder
Show Folder
Enabled Plugins
about:plugins
Build Configuration
about:buildconfig
Crash Reports
about:crashes
Memory Use
about:memory
Extensions
Name
Version
Enabled
ID
AVG Do Not Track
12.0.0.2189
false
{F53C93F1-07D5-430c-86D4-C9531B27DFAF}
AVG Safe Search
12.0.0.2191
false
{1E73965B-8B48-48be-9C8D-68B920ABC1C4}
Browser Manager
2.2.565.25
false
{b64982b1-d112-42b5-b1e4-d3867c4533f8}
DivX Plus Web Player HTML5 <video>
2.1.2.145
false
{23fcfd51-4958-4f00-80a3-ae97e717ed8b}
Microsoft .NET Framework Assistant
0.0.0
false
{20a82645-c095-46ed-80e3-08825760534b}
RealPlayer Browser Record Plugin
14.0.7
false
{ABDE892B-13A8-4d1b-88E6-365A6E755758}
UltimateGamesBar
1.7.0.19505
false
2sffxtbr@GameNutt_2s.com
Important Modified Preferences
Name
Value
browser.cache.disk.capacity
1048576
browser.cache.disk.smart_size.first_run
false
browser.cache.disk.smart_size_cached_value
1048576
browser.places.smartBookmarksVersion
4
browser.startup.homepage
about:home
browser.startup.homepage_override.buildID
20120713134347
browser.startup.homepage_override.mstone
14.0.1
browser.tabs.onTop
false
browser.tabs.warnOnClose
false
extensions.lastAppVersion
14.0.1
keyword.URL
network.cookie.prefsMigrated
true
places.history.expiration.transient_current_max_pages
53385
privacy.sanitize.migrateFx3Prefs
true
security.warn_viewing_mixed
false
Graphics
Adapter Description
Intel(R) G33/G31 Express Chipset Family
Vendor ID
0x8086
Device ID
0x29c2
Adapter RAM
Unknown
Adapter Drivers
igdumd32
Driver Version
7.14.10.1461
Driver Date
3-25-2008
Direct2D Enabled
Blocked for your graphics driver version.
DirectWrite Enabled
false (7.0.6002.18592)
ClearType Parameters
ClearType parameters not found
WebGL Renderer
Blocked for your graphics driver version. Try updating your graphics driver to version 7.15.10.1666 or newer.
GPU Accelerated Windows
0. Blocked for your graphics driver version. Try updating your graphics driver to version 7.15.10.1666 or newer.
JavaScript
Incremental GC
1
Library Versions
Expected minimum version
Version in use
NSPR
4.9
4.9
NSS
3.13.5.0 Basic ECC
3.13.5.0 Basic ECC
NSS Util
3.13.5.0
3.13.5.0
NSS SSL
3.13.5.0 Basic ECC
3.13.5.0 Basic ECC
NSS S/MIME
3.13.5.0 Basic ECC
3.13.5.0 Basic ECC

persianboy 0 solutions 1 answers

Just open the webpage you need to be as your homepage, Bookmark it.

Now, go to Mozilla tools>>> Setting>>> in the homepage section click on Use Bookmarks>>. Choose your Page from the list. Apply & OK.

Restart the browser. Done!!

OR>>>>> https://addons.mozilla.org/firefox/addon/searchreset/

U will never see the Claro search anymore. :-)

Persian Boy.

Modified by persianboy

bakoma 0 solutions 1 answers

Just share my experience:

As of 11/19/2012.

This virus varies from time to time. Above posts are no longer useful. I was not able to find any effective way by searching online. It took me a whole day to figure it out.

Both in your registry and hard drive, search the following:

claro, browsermngr, (another thing I forgot)

Delete them and their possible containers. Everything will be fine. Most files won't be able to be deleted directly. You either need to do it in safe mode, or remove them from service and then reboot to continue.

gabitao 0 solutions 1 answers

I haver tried a lot of things and finally I HAVE SUCCEED.

I have:

1. Uninstalled the Claro LTD Toolbar software from Windows and any other Claro or Babylon software.

2. Cleaned Extensions, etc.

3. Cleaned the about:config

4. Reset search engine settings.

But claro search engine kept on appearing as a home page.

What I think it has been the killer move has been to remove the "Browser Manager" process (browsemngr.exe), following this, with a little variation:

http://www.explosiveknowledge.net/main/2012/08/19/browsemngr/ http://www.explosiveknowledge.net/main/2012/08/19/browsemngr/

The variations are:

1. Run the cmd as administrator. If not the command will not be able the delete the service (sc delete "browser manager" will not work).

2. To finally Remove the Browser Manager folder you might need to restart in safe mode.

I hope this helps :-) because it was a really annoying and interfering malware.

(The same overall process worked with Chrome, as long as its homepage had also been hickjaked by the same malware.)

I have not tried using Malware Bytes, maybe it works.

kck48 0 solutions 1 answers

Thanks for this. I have tried all other help ideas without success. This one works by Uninstalling Browser Manager in Control Panel as well as removing the Caro search in manage search engines in the top right of the screen and restoring default preffered home page in File, Options, homepage settings. thanks

oldDavid 0 solutions 1 answers

Just started using Firefox and downloaded Version 18 and since I haven't used Firefox for some time I was very surprise to find some problems still exist; for one is the crazy Claro Search Toolbar and Search Page, so after following All attempts that are listed and appear easy-they didn't work for me, the last resort I used the Program AdwCleaner-And it worked-so far?- the following is the listing from this program;

# AdwCleaner v2.101 - Logfile created 

12/18/2012 at 11:33:30
# Updated 16/12/2012 by Xplode
# Operating system : Windows 7 Home Premium 

Service Pack 1 (32 bits)
# User : Dell - DELL-PC
# Boot Mode : Normal
# Running from : C:\Users\Dell\Downloads

\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : PC Performer Manager

***** [Files / Folders] *****

Deleted on reboot : C:\ProgramData\pc 

performer manager
File Deleted : C:\Program Files\Mozilla 

Firefox\searchplugins\babylon.xml
File Deleted : C:\Users\Dell\AppData

\Roaming\Mozilla\Firefox\Profiles

\tynfknvj.default-

1355778179274\bprotector_extensions.sqlite
File Deleted : C:\Users\Dell\AppData

\Roaming\Mozilla\Firefox\Profiles

\tynfknvj.default-

1355778179274\bprotector_prefs.js
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData

\IBUpdaterService
Folder Deleted : C:\Users\Dell\AppData

\Roaming\OpenCandy
Folder Deleted : C:\Users\Dell\Documents

\ShopToWin

***** [Registry] *****

Data Deleted : HKLM\..\Windows [AppInit_DLLs] 

= c:

\progra~2\pcperf~1\24897~1.175\{61d8b~1\pcpmn

gr.dll
Key Deleted : HKCU\Software\AppDataLow

\Software\PriceGong
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\Microsoft

\Internet Explorer\SearchScopes\{0ECDF796-

C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft

\Windows\CurrentVersion\Ext\bProtectSettings
Key Deleted : HKCU\Software\Microsoft

\Windows\CurrentVersion\Ext\Settings

\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}
Key Deleted : HKCU\Software\Microsoft

\Windows\CurrentVersion\Ext\Settings

\{1631550F-191D-4826-B069-D9439253D926}
Key Deleted : HKCU\Software\Microsoft

\Windows\CurrentVersion\Ext\Settings

\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Classes

\Interface\{79FB5FC8-44B9-4AF5-BADD-

CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKU\S-1-5-21-3966030448-

1202514810-862185238-1000\Software\Microsoft

\Internet Explorer\SearchScopes\{0ECDF796-

C2DC-4D79-A620-CCE0C0A66CC9}
Value Deleted : HKCU\Software\Microsoft

\Internet Explorer\Main [bprotector start 

page]
Value Deleted : HKCU\Software\Mozilla

\Firefox\Extensions [{dfefbe51-ca52-484b-

adf0-6b158b05262d}]
Value Deleted : HKLM\SOFTWARE\Microsoft

\Internet Explorer\Toolbar [{9E131A93-EED7-

4BEB-B015-A0ADB30B5646}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Mozilla Firefox v18.0 (en-US)

Profile name : default-1355778179274 [Profil 

par défaut]
File : C:\Users\Dell\AppData\Roaming

\Mozilla\Firefox\Profiles\tynfknvj.default-

1355778179274\prefs.js

Deleted : user_pref

("browser.search.selectedEngine", "Claro 

Search");
Deleted : user_pref("keyword.URL", 

"^hxxp://www\\.claro-search\\.com/\\?

affID=114506.*&q=");

-\\ Google Chrome v [Unable to get version]

File : C:\Users\Dell\AppData\Local

\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [3256 octets] - 

[18/12/2012 11:30:00]
AdwCleaner[S1].txt - [3148 octets] - 

[18/12/2012 11:33:30]

########## EOF - C:\AdwCleaner[S1].txt - 

[3208 octets] ##########

Modified by cor-el

Claro Search 0 solutions 6 answers

Hello from Claro search support team! Claro search is very easy to remove, please follow this link: http://info.claro-search.com/uninstall.html to get full and quick instructions. In case you need more, feel free to contact us at: Support@Claro-Search.com, we'll be glad to help you with any issue!

jrwygant 0 solutions 3 answers

The Claro solution changes the homepage only. When I opened a new blank tab I still got the Claro search page, rather than the Firefox page that shows thumbnails of recently opened pages. It was much more complicated getting rid of that. I don't think they know what they're doing.

Claro Search 0 solutions 6 answers

Hello jrwygant did you try to use our uninstall site? that's the link: http://info.claro-search.com/uninstall.html we offer quick and easy instructions so you'll be able to remove it from firefox. in case you need further assistance please contact us: support@claro-search.com

Modified by Claro Search

jrwygant 0 solutions 3 answers

Yes, of course I looked at the Claro page. As I already mentioned, all that pages does is tell the user how to reset the homepage. Reading all of the messages in this forum should make it abundantly clear that the problem is much greater than that. The homepage will not stay reset, and a new tab will not come up with thumbnails of recent pages, but instead opens onto Claro Search. This has been stated many times, but I'll try it again: RESETTING THE HOMEPAGE IS NOT A SOLUTION. I have fixed my problem, using various techniques described in this forum, including cleaning out a Firefox data page and uninstalling a Claro program that I don't recall ever installing. This is a serious problem that demands more serious attention from Claro.