X
Tap here to go to the mobile version of the site.

Support Forum

all my browsers, including firefox, have been hijacked

Posted

Hi. My new computer, running Windows 8, picked up the very annoying "search.nu" malware (also known as "search.qu"). All my browsers are affected. (Yes, I guiltily confess to occasionally using browsers other than FF!) I see various ways suggested, both in the Firefox forum and generally on the web, to rid one's computer of this virus-like parasite. But it seemed sensible to me, before doing what was suggested, to go to Windows control panel and use the "uninstall program" process. So my initial question is: why is it that no one mentions the uninstall process as the logical first step? I hesitate to try "uninstall" when none of the experts seems to be recommending it.

I will greatly appreciate any enlightenment Firefox Forum members can supply.

Hi. My new computer, running Windows 8, picked up the very annoying "search.nu" malware (also known as "search.qu"). All my browsers are affected. (Yes, I guiltily confess to occasionally using browsers other than FF!) I see various ways suggested, both in the Firefox forum and generally on the web, to rid one's computer of this virus-like parasite. But it seemed sensible to me, before doing what was suggested, to go to Windows control panel and use the "uninstall program" process. So my initial question is: why is it that no one mentions the uninstall process as the logical first step? I hesitate to try "uninstall" when none of the experts seems to be recommending it. I will greatly appreciate any enlightenment Firefox Forum members can supply.

Chosen solution

Hello patrickmc, AliceWyman, and cor-el!! Thank you all very much for your contributions. Let me briefly fill you in on the developments---and what I fervently hope is the quick and pleasant resolution of the problem.

First, in all honesty, I should acknowledge that the villain of the piece, "search.nu", at least with me, was more of a shoplifter than a serial killer. Yes, it did prevent me from getting to my home page, and instead offered a blank screen with just a search box--its own search box, of course. Had I been foolish enough to use that search engine, quite possibly some hair-curling or hair-raising events would have befallen me. But from the very first moment I knew to ignore it and so my difficulties never amounted to more than an annoyance. And yet, even a mere annoyance should be eliminated if possible, don't you think?-- especially when I'm feeling so loving and protective towards my brand-new computer and want to keep it pristine.

So, following the extremely simple instructions of Firefox and Chrome, I deleted Search.nu as my homepage, replacing it with Yahoo, and as the unlamented Search.nu exited stage right, along with it went the potentially very mischievous search box of Search.nu. I closed and reopened both browsers several times, and it appears that that simple measure sufficed.

The reason I didn't delete the entire program was that when I went to the Windows Uninstall a Program and began the process, it turned out I had downloaded the offending search.nu as unexpected and unwanted baggage with J-zip, a piece of software I've used for years on my previous computer--and love. I certainly wanted to keep j-zip! So, at that point, I decided to try the simple maneuver described above and eliminate search.nu while retaining j-zip.

I know from reading online about search.nu that in the past it strenuously resisted eviction--you'd think that you'd killed it when suddenly it would spring up very much alive and bent on vengeance, like Glenn Close in the bathtub scene in  "Fatal Attraction"!!   But maybe all the terrible publicity over the past few years that search.nu has received (e.g. McAfee Siteadvisor puts up a big red X and obstructs access) has caused search.nu to mutate into a more benign form.  You know, in real life, viruses (biological, not computer, ones) often do exactly that--if they're too virulent, and kill off their hosts very quickly, they don't have time to replicate.  So the most successful biological viruses rapidly mutate into milder forms, making you just sick enough to cough and sneeze, etc. and spread them to others, and I think maybe search.nu, in allowing itself to be controlled so easily, has wisely done just that sort of mutating.

Anyway, patrickmc, AliceWyman, cor-el, I thank you again, and it's great that, for all the malicious elements on the internet like search.nu and worse, there are still people like you three who combine altruism with knowledge and intelligence---and really benefit people like me!!

Read this answer in context 0

Additional System Details

Installed Plug-ins

  • Shockwave Flash 11.6 r602
  • Google Talk Plugin Video Accelerator version:0.1.44.23
  • Version 3.14.17.11865
  • Google Update
  • McAfee MSS+ NPAPI Plugin
  • RealPlayer(tm) LiveConnect-Enabled Plug-In
  • RealPlayer Download Plugin
  • SiteAdvisor
  • RealNetworks(tm) RealDownloader Chrome Background Extension Plug-In
  • RealNetworks(tm) RealDownloader PepperFlashVideoShim Plug-In
  • RealNetworks(tm) RealDownloader HTML5VideoShim Plug-In
  • RealDownloader Plugin
  • Intel web components for Intel® Identity Protection Technology
  • Intel web components updater - Installs and updates the Intel web components
  • Exent® AOD Gecko Plugin

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0

More Information

patrickmc
  • Administrator
  • Moderator
34 solutions 223 answers

Helpful Reply

Hello barth9,

Malware is pretty invasive and doesn't just affect browsers. Doing a clean install is a good idea, but I would also try these free programs to scan for malware, which work with your existing antivirus software:

Microsoft Security Essentials is a good permanent antivirus for Windows 7/Vista/XP if you don't already have one.


Further information can be found in the Troubleshoot Firefox issues caused by malware article.

Did this fix your problems? Please report back to us!

Hello barth9, Malware is pretty invasive and doesn't just affect browsers. Doing a clean install is a good idea, but I would also try these free programs to scan for malware, which work with your existing antivirus software: * [http://www.microsoft.com/security/scanner/default.aspx Microsoft Safety Scanner] * [http://www.malwarebytes.org/products/malwarebytes_free/ MalwareBytes' Anti-Malware] * [http://support.kaspersky.com/faq/?qid=208283363 TDSSKiller - AntiRootkit Utility] [http://windows.microsoft.com/MSE Microsoft Security Essentials] is a good permanent antivirus for Windows 7/Vista/XP if you don't already have one. Further information can be found in the [[Troubleshoot Firefox issues caused by malware]] article. Did this fix your problems? Please report back to us!
AliceWyman
  • Moderator
236 solutions 2553 answers
Maybe this article will help? [[Remove a toolbar that has taken over your Firefox search or home page]] Another article that you can use as a general guide for removing unwanted software via Windows Control Panel: [[How to remove the Babylon toolbar, home page and search engine]] For Internet Explorer and other browsers, I found: * http://answers.microsoft.com/en-us/windows/forum/windows_7-security/what-is-the-story-on-searchqu-ilivid-and-bandoo/7f1272e1-1ac9-43c9-ba99-94182076f77d ...which links to: *http://www.tweaksformypc.com/2012/04/searchqu-removal-instructions.html Hope that helps.
cor-el
  • Top 10 Contributor
  • Moderator
16992 solutions 153423 answers
See these threads and pages about searchqu/searchnu: *[[/questions/816181]] *[[/questions/790833]] *[[/questions/921690]] *http://bit.ly/searchqutoolbar *http://www.ilivid.com/faq.htm#8 *http://www.beyourownit.com/forum/security-malware-issues/4758-searchnu-searchqu.html

Chosen Solution

Hello patrickmc, AliceWyman, and cor-el!! Thank you all very much for your contributions. Let me briefly fill you in on the developments---and what I fervently hope is the quick and pleasant resolution of the problem.

First, in all honesty, I should acknowledge that the villain of the piece, "search.nu", at least with me, was more of a shoplifter than a serial killer. Yes, it did prevent me from getting to my home page, and instead offered a blank screen with just a search box--its own search box, of course. Had I been foolish enough to use that search engine, quite possibly some hair-curling or hair-raising events would have befallen me. But from the very first moment I knew to ignore it and so my difficulties never amounted to more than an annoyance. And yet, even a mere annoyance should be eliminated if possible, don't you think?-- especially when I'm feeling so loving and protective towards my brand-new computer and want to keep it pristine.

So, following the extremely simple instructions of Firefox and Chrome, I deleted Search.nu as my homepage, replacing it with Yahoo, and as the unlamented Search.nu exited stage right, along with it went the potentially very mischievous search box of Search.nu. I closed and reopened both browsers several times, and it appears that that simple measure sufficed.

The reason I didn't delete the entire program was that when I went to the Windows Uninstall a Program and began the process, it turned out I had downloaded the offending search.nu as unexpected and unwanted baggage with J-zip, a piece of software I've used for years on my previous computer--and love. I certainly wanted to keep j-zip! So, at that point, I decided to try the simple maneuver described above and eliminate search.nu while retaining j-zip.

I know from reading online about search.nu that in the past it strenuously resisted eviction--you'd think that you'd killed it when suddenly it would spring up very much alive and bent on vengeance, like Glenn Close in the bathtub scene in  "Fatal Attraction"!!   But maybe all the terrible publicity over the past few years that search.nu has received (e.g. McAfee Siteadvisor puts up a big red X and obstructs access) has caused search.nu to mutate into a more benign form.  You know, in real life, viruses (biological, not computer, ones) often do exactly that--if they're too virulent, and kill off their hosts very quickly, they don't have time to replicate.  So the most successful biological viruses rapidly mutate into milder forms, making you just sick enough to cough and sneeze, etc. and spread them to others, and I think maybe search.nu, in allowing itself to be controlled so easily, has wisely done just that sort of mutating.

Anyway, patrickmc, AliceWyman, cor-el, I thank you again, and it's great that, for all the malicious elements on the internet like search.nu and worse, there are still people like you three who combine altruism with knowledge and intelligence---and really benefit people like me!!

Hello patrickmc, AliceWyman, and cor-el!! Thank you all very much for your contributions. Let me briefly fill you in on the developments---and what I fervently hope is the quick and pleasant resolution of the problem. First, in all honesty, I should acknowledge that the villain of the piece, "search.nu", at least with me, was more of a shoplifter than a serial killer. Yes, it did prevent me from getting to my home page, and instead offered a blank screen with just a search box--its own search box, of course. Had I been foolish enough to use that search engine, quite possibly some hair-curling or hair-raising events would have befallen me. But from the very first moment I knew to ignore it and so my difficulties never amounted to more than an annoyance. And yet, even a mere annoyance should be eliminated if possible, don't you think?-- especially when I'm feeling so loving and protective towards my brand-new computer and want to keep it pristine. So, following the extremely simple instructions of Firefox and Chrome, I deleted Search.nu as my homepage, replacing it with Yahoo, and as the unlamented Search.nu exited stage right, along with it went the potentially very mischievous search box of Search.nu. I closed and reopened both browsers several times, and it appears that that simple measure sufficed. The reason I didn't delete the entire program was that when I went to the Windows Uninstall a Program and began the process, it turned out I had downloaded the offending search.nu as unexpected and unwanted baggage with J-zip, a piece of software I've used for years on my previous computer--and love. I certainly wanted to keep j-zip! So, at that point, I decided to try the simple maneuver described above and eliminate search.nu while retaining j-zip. I know from reading online about search.nu that in the past it strenuously resisted eviction--you'd think that you'd killed it when suddenly it would spring up very much alive and bent on vengeance, like Glenn Close in the bathtub scene in "Fatal Attraction"!! But maybe all the terrible publicity over the past few years that search.nu has received (e.g. McAfee Siteadvisor puts up a big red X and obstructs access) has caused search.nu to mutate into a more benign form. You know, in real life, viruses (biological, not computer, ones) often do exactly that--if they're too virulent, and kill off their hosts very quickly, they don't have time to replicate. So the most successful biological viruses rapidly mutate into milder forms, making you just sick enough to cough and sneeze, etc. and spread them to others, and I think maybe search.nu, in allowing itself to be controlled so easily, has wisely done just that sort of mutating. Anyway, patrickmc, AliceWyman, cor-el, I thank you again, and it's great that, for all the malicious elements on the internet like search.nu and worse, there are still people like you three who combine altruism with knowledge and intelligence---and really benefit people like me!!
AliceWyman
  • Moderator
236 solutions 2553 answers

Thanks for posting back that you fixed the problem by simply changing your home page to Yahoo in the affected browsers. I'll mark your reply as the solution.

Thanks for posting back that you fixed the problem by simply changing your home page to Yahoo in the affected browsers. I'll mark your reply as the solution.
AliceWyman
  • Moderator
236 solutions 2553 answers

barth9, You wrote above,
The reason I didn't delete the entire program was that when I went to the Windows Uninstall a Program and began the process, it turned out I had downloaded the offending search.nu as unexpected and unwanted baggage with J-zip, a piece of software I've used for years on my previous computer--and love. I certainly wanted to keep j-zip!

One reason I posted a link to http://answers.microsoft.com/en-us/windows/forum/windows_7-security/what-is-the-story-on-searchqu-ilivid-and-bandoo/7f1272e1-1ac9-43c9-ba99-94182076f77d is because of this April 12, 2012 post, which I read to mean that you don't need to have Searchqu installed to continue using the software that included it as an optional install:


Hi,
My name is John, and I'm a member of the Searchqu Support Team. I'm here to help :)
Searchqu is offered to users by our partners – developers and companies who publish free PC applications. It's offered, like many other toolbars, as an option during the installation. If the user chooses not to install Searchqu, the free software which they downloaded will work just fine.
If you have anymore questions please don't hesitate to let us know!
Thank you,
The Searchqu support team

I also found this "SearchquSupport" post dated 1/8/12 in earlier thread:


https://support.mozilla.org/en-US/questions/907403#answer-295928

Hi, My name is John, and I'm a member of the Searchqu Support Team. I'm here to help :) When jZip installs onto your pc it offered two basic installs, typical installation, which lists the add-on features such as searchqu homepage, and custom installation, which allows you to select the add-ons that you wish to install. There's no need to worry if you did the typical install - this isn't a virus, nor malware, and there's no need to Perform a virus scan against it. Since Searchqu is an addon feature of jZip, there's no need to uninstall jZip http://www.jzip.com/, the jZip Download Manager will work just fine without it :-) If you prefer to change your homepage please check: http://www.jzip.com/uninstall.php We are here to answer to any further questions :) The searchqu team support

'''barth9''', You wrote above, <br> ''The reason I didn't delete the entire program was that when I went to the Windows Uninstall a Program and began the process, it turned out I had downloaded the offending search.nu as unexpected and unwanted baggage with J-zip, a piece of software I've used for years on my previous computer--and love. I certainly wanted to keep j-zip!'' One reason I posted a link to http://answers.microsoft.com/en-us/windows/forum/windows_7-security/what-is-the-story-on-searchqu-ilivid-and-bandoo/7f1272e1-1ac9-43c9-ba99-94182076f77d is because of this April 12, 2012 post, which I read to mean that you don't need to have Searchqu installed to continue using the software that included it as an optional install: ----- Hi, My name is John, and I'm a member of the Searchqu Support Team. I'm here to help :) Searchqu is offered to users by our partners – developers and companies who publish free PC applications. It's offered, like many other toolbars, as an option during the installation. If the user chooses not to install Searchqu, the free software which they downloaded will work just fine. If you have anymore questions please don't hesitate to let us know! Thank you, The Searchqu support team ----- I also found this "SearchquSupport" post dated 1/8/12 in earlier thread: ----- https://support.mozilla.org/en-US/questions/907403#answer-295928 Hi, My name is John, and I'm a member of the Searchqu Support Team. I'm here to help :) When jZip installs onto your pc it offered two basic installs, typical installation, which lists the add-on features such as searchqu homepage, and custom installation, which allows you to select the add-ons that you wish to install. There's no need to worry if you did the typical install - this isn't a virus, nor malware, and there's no need to Perform a virus scan against it. Since Searchqu is an addon feature of jZip, there's no need to uninstall jZip http://www.jzip.com/, the jZip Download Manager will work just fine without it :-) If you prefer to change your homepage please check: http://www.jzip.com/uninstall.php We are here to answer to any further questions :) The searchqu team support -----
hiding-behind-the-sofa 0 solutions 11 answers

Hi, I have just had this problem too, whilst downloading iLivid. During the download process, the "nubar" search engine installed itself as an extension (as Data Manager five point something something) without my permission, and proceeded to oust Firefox as my homepage.

I eventually managed to reinstate Firefox via the "general" tab on the options page, but when I tried to disable the extension it refused to do so. Uninstalling / reinstalling my Firefox browser did not help, but thankfully I managed to delete it by following the instructions for uninstalling extensions manually.

Writing this 24 hours later, everything seems back to normal - indeed, I received a message this morning stating that an attempt to modify my internet browser had been successfully blocked.

Hi, I have just had this problem too, whilst downloading iLivid. During the download process, the "nubar" search engine installed itself as an extension (as Data Manager five point something something) without my permission, and proceeded to oust Firefox as my homepage. I eventually managed to reinstate Firefox via the "general" tab on the options page, but when I tried to disable the extension it refused to do so. Uninstalling / reinstalling my Firefox browser did not help, but thankfully I managed to delete it by following the instructions for uninstalling extensions manually. Writing this 24 hours later, everything seems back to normal - indeed, I received a message this morning stating that an attempt to modify my internet browser had been successfully blocked.
AliceWyman
  • Moderator
236 solutions 2553 answers

Helpful Reply

hiding-behind-the-sofa, You wrote in part:

the "nubar" search engine installed itself as an extension (as Data Manager five point something something)
when I tried to disable the extension it refused to do so. 
I managed to delete it by following the instructions for uninstalling extensions manually. 

Thanks for adding that information. For the benefit of others, I take that to mean you were able to uninstall the Data Manager extension by following the instructions in the Uninstalling manually section of the Cannot remove an add-on (extension or theme) article.

'''hiding-behind-the-sofa''', You wrote in part: the "nubar" search engine installed itself as an extension (as Data Manager five point something something) when I tried to disable the extension it refused to do so. I managed to delete it by following the instructions for uninstalling extensions manually.'' Thanks for adding that information. For the benefit of others, I take that to mean you were able to uninstall the Data Manager extension by following the instructions in the [https://support.mozilla.org/en-US/kb/Cannot%20uninstall%20an%20add-on#w_uninstalling-manually Uninstalling manually] section of the [[Cannot uninstall an add-on]] article.
hiding-behind-the-sofa 0 solutions 11 answers

Just wanted to add that as someone who is in no way an IT expert and is still finding their way around so to speak, I found the install / uninstall advice on Mozilla Support to be very helpful  :)

Just wanted to add that as someone who is in no way an IT expert and is still finding their way around so to speak, I found the install / uninstall advice on Mozilla Support to be very helpful :)