Had binkiland malware, removed it, now on my website another window is opened
New laptop, with windows 8.1 while downloading one of the software programs i needed, got some malware. Binkiland was one of them, another one i can't recall name of. Got both removed after several hours. the binkiland was in registry, all over my pc and in about:config in firefox.
Randomly it seems to happen that while on a website a window will pop up with advertising stuff on it. i see it happen today from my own website, which has zero advertisements on it. I pressed one of my hyperlinks on that site and a tab opened with "Kelly Blue Book" advertisement.
In general, i'm finding that windows 8.1 seems not as robust for malware / attacks as windows 7. I can't believe how much crap got installed on this new PC, that has never happened in my 35 years of setting up personal computers. Okay, needing to vent a bit, Google Chrome also got installed after installing FireFox, and for sure i look at those screens and set the options. I think Avast probably did that, never saw that option appear so I could unclick it.
I looked for addons in Firefox, the only thing there is Avast.
Appreciate your help.
Thanks Betsy
Chosen solution
You might want to start with some additional scanners, as each tends to find different things. Our support article lists tools other Firefox users have found helpful: Troubleshoot Firefox issues caused by malware. These are free and take considerable time to run. If they seem to finish quickly and particularly if they require payment, you may have a more serious infection. The specialized forums listed in the article would be the next stop in that case.
If links are hijacked, an extension is the first suspect. Since some extension have self-hiding capabilities, you may want to review the Add-ons page again in Firefox's Safe Mode. That's a standard diagnostic tool to deactivate extensions and some advanced features of Firefox. More info: Use Troubleshoot Mode in Firefox.
You can restart Firefox in Safe Mode using either:
- "3-bar" menu button > "?" button > Restart with Add-ons Disabled
- Help menu > Restart with Add-ons Disabled
Not all add-ons are disabled: Flash and other plugins still run
After Firefox shuts down, a small dialog should appear. Click "Start in Safe Mode" (not Reset).
Any new extensions? Any change in behavior?
Links also might be hijacked by a proxy or if your DNS settings have been hacked. To check the settings within Firefox, you can use:
"3-bar" menu button (or Tools menu) > Options > Advanced > Network mini-tab > "Settings" button
The default of "Use system proxy settings" piggybacks on your Windows/IE LAN setting, but you also could try "No proxy".
Read this answer in context 👍 1All Replies (5)
Chosen Solution
You might want to start with some additional scanners, as each tends to find different things. Our support article lists tools other Firefox users have found helpful: Troubleshoot Firefox issues caused by malware. These are free and take considerable time to run. If they seem to finish quickly and particularly if they require payment, you may have a more serious infection. The specialized forums listed in the article would be the next stop in that case.
If links are hijacked, an extension is the first suspect. Since some extension have self-hiding capabilities, you may want to review the Add-ons page again in Firefox's Safe Mode. That's a standard diagnostic tool to deactivate extensions and some advanced features of Firefox. More info: Use Troubleshoot Mode in Firefox.
You can restart Firefox in Safe Mode using either:
- "3-bar" menu button > "?" button > Restart with Add-ons Disabled
- Help menu > Restart with Add-ons Disabled
Not all add-ons are disabled: Flash and other plugins still run
After Firefox shuts down, a small dialog should appear. Click "Start in Safe Mode" (not Reset).
Any new extensions? Any change in behavior?
Links also might be hijacked by a proxy or if your DNS settings have been hacked. To check the settings within Firefox, you can use:
"3-bar" menu button (or Tools menu) > Options > Advanced > Network mini-tab > "Settings" button
The default of "Use system proxy settings" piggybacks on your Windows/IE LAN setting, but you also could try "No proxy".
What is worst about mal-ware is sometimes they leave presents behind. Scan you computer and your web site using most or all of the programs.
I ran most of the malware removal tools as well did deep scan with Avast and boot time scan. Each program kept removing stuff. Until last one ran clean.
I then saw it still appeared on certain internet pages, not others. Then idea: clear the browser cache. That took care of it.
The cause:
I think these 2 malware programs:
Binkiland & SearchProtect
were installed from an Avast free antivirus I downloaded, can't remember where i got it from. I remember when i installed it, the installation failed and hung at the end. So that is good sign it was a modified copy.
Thanks for you help!
It’s very sad, but many of the software down-loaders / installers will trick you into installing not only their program, but other programs as well. You have heard of the fine print in shady contracts, right? Well, some installers you need to look at the itsy bitsy teeny weeny fine print. You are thinking you are giving the installer permission to install the program you want by using the recommended option. But if you use the Manual Option Instead, you discover all kinds of stuff that you do not even know what it is or what it does. From now on, everyone needs to Use The Manual Option to put a stop to this.
Actually for complete removal of Binkiland Search you need to uninstall WSE_Binkiland from your PC (the Control Panel of it). You need to check the list of legally installed programs of your PC. If you see this WSE_Binkiland there, go ahead and uninstall it immediately. The guide below https://www.system-tips.net/binkiland-search-removal-tips/ also explains how to reset all major browsers automatically (no need to pay for any program). This method should solve all other browser issues.