X
Thinta lapha ukuze uye kuveshini yamakhalekhukhwini kusayithi.

Isithangami Sabeseki

Lolu chungechunge lwabekwa kunqolobane. Uyacelwa ubuze umbuzo omusha uma udinga usizo.

Bing/Zugo problem extension

Kuphostiwe

The wonderful Bing/Zugo fake search tool decided to come knocking at my door today. I did everything and got rid of it easily thanks to the support forums here.

However, now I have a new problem. On occasion, so far only when I'm on Facebook, a new window will open up randomly, which leads to a bogus website. I can close it, but I know it's stealing information or something similar. I know this because it will make a fake post on my Facebook page, which I've seen people experience on occasion.

I'm worried about this stealing other information besides that, so I'd like to get rid of this. I've done a Malwarebytes scan, which got rid of any remnant of the Bing/Zugo fake, but to no avail it seems, and I've searched for other remnants and found no solution. I even tried uninstalling Firefox and reinstalling it, which didn't work either.

Thanks in advance.

This happened

Every time Firefox opened

== Thursday, July 01, 2010

The wonderful Bing/Zugo fake search tool decided to come knocking at my door today. I did everything and got rid of it easily thanks to the support forums here. However, now I have a new problem. On occasion, so far only when I'm on Facebook, a new window will open up randomly, which leads to a bogus website. I can close it, but I know it's stealing information or something similar. I know this because it will make a fake post on my Facebook page, which I've seen people experience on occasion. I'm worried about this stealing other information besides that, so I'd like to get rid of this. I've done a Malwarebytes scan, which got rid of any remnant of the Bing/Zugo fake, but to no avail it seems, and I've searched for other remnants and found no solution. I even tried uninstalling Firefox and reinstalling it, which didn't work either. Thanks in advance. == This happened == Every time Firefox opened == Thursday, July 01, 2010

Eminye Imininingwane Yohlelo

Fakela amapulagi

  • -Office Plugin for Netscape Navigator
  • MetaStream 3 Plugin r4
  • 1.9.0009.1
  • MFireLauncher
  • Winamp Application Detector
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Adobe PDF Plug-In For Firefox and Netscape "9.3.3"
  • Default Plug-in
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • Provides additional functionality on Facebook. See our web site for details.
  • Pando Web Plugin
  • Shockwave Flash 10.1 r53
  • Adobe Shockwave for Director Netscape plug-in, version 11.5
  • Windows Presentation Foundation (WPF) plug-in for Mozilla browsers
  • Nexon Game Controller 1.0.0.1
  • Next Generation Java Plug-in 1.6.0_20 for Mozilla browsers
  • Npdsplay dll
  • DRM Netscape Network Object
  • DRM Store Netscape Plugin

Isisebenziso

  • I-ejenti Engumsebenzisi: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6 (.NET CLR 3.5.30729)

Eminye Imininingwane

Application Basics
Name
Firefox
Version
3.6.6
Profile Directory
Open Containing Folder
Installed Plugins
about:plugins
Build Configuration
about:buildconfig
Extensions
Name
Version
Enabled
ID
Java Console
6.0.11
true
Java Console
6.0.13
true
Java Console
6.0.14
true
Java Console
6.0.15
true
Java Console
6.0.16
true
Java Console
6.0.17
true
Java Console
6.0.19
true
Java Console
6.0.20
true
Microsoft .NET Framework Assistant
1.1
true
{20a82645-c095-46ed-80e3-08825760534b}
Java Quick Starter
1.0
true
jqs@sun.com
1-ClickWeather
1.1.9.1
true
Download Statusbar
0.9.6.8
true
GoogleEnhancer
1.79
true
{21e48e29-f574-4619-b65d-0f00eea92e5b}
Googlepedia
0.6.1
true
{1ABADB6E-DC4B-11DA-9F70-791A9CD9513E}
History Submenus
2.10
true
{7102aba3-045c-4ec2-b921-46d87636d84b}
SearchPreview
4.4
true
RSS Notifier
1.3.3
true
follow2-lite@follow2.com
Update Notifier
0.1.5.5
true
{95f24680-9e31-11da-a746-0800200c9a66}
WOT
20100503
true
Modified Preferences
Name
Value
browser.history_expire_days.mirror
180
browser.places.importBookmarksHTML
false
browser.places.smartBookmarksVersion
2
browser.startup.homepage
http://www.dota-allstars.com/
browser.startup.homepage_override.mstone
rv:1.9.2.6
extensions.lastAppVersion
3.6.6
general.useragent.extra.microsoftdotnet
(.NET CLR 3.5.30729)
network.cookie.prefsMigrated
true
privacy.sanitize.migrateFx3Prefs
true
security.warn_viewing_mixed.show_once
false

Umnikazi wombuzo

Steve again

After researching the link that pops up in the new window, the link itself seems to be directly related to Facebook only, specifically to adding a fake farmville cheat link to my page. The link itself is actually the text of the post it makes when you edit out some of the characters. I've provided the link below:

    • WARNING! ** DO NOT CLICK THIS LINK! **
Moderator edit: Removed spam...again -MJB

I hope this helps.

<blockquote>Steve again</blockquote> After researching the link that pops up in the new window, the link itself seems to be directly related to Facebook only, specifically to adding a fake farmville cheat link to my page. The link itself is actually the text of the post it makes when you edit out some of the characters. I've provided the link below: ** WARNING! ** DO NOT CLICK THIS LINK! ** <blockquote>Moderator edit: Removed spam...again -MJB</blockquote> I hope this helps.

Umnikazi wombuzo

how can i prevent or stop it?

how can i prevent or stop it?

Umnikazi wombuzo

Well, it seems to be limited to posting comments on Facebook looking like they're made by me. It basically opens a new window I have to close, and if I close Facebook after that, it doesn't get a chance to post it.

It's annoying as you can imagine, and I'd like to get rid of this pop-up. Preventing it from happening... well... that's not so hard. Just have to be careful when FF updates my add-on's in all.

Well, it seems to be limited to posting comments on Facebook looking like they're made by me. It basically opens a new window I have to close, and if I close Facebook after that, it doesn't get a chance to post it. It's annoying as you can imagine, and I'd like to get rid of this pop-up. Preventing it from happening... well... that's not so hard. Just have to be careful when FF updates my add-on's in all.

Umnikazi wombuzo

The Same exact thing is happening to me as with Steve.

If anyone can figure out exactly what is going on, that would be greatly appreciated! What needs to be removed?

What I've done as a temporary fix is to block the "Share" app because when the spam status is posted, it's always says that it was sent "via Share". I clicked on that and then hit "block this application." It's only a temporary fix because a new window still opens (when I first get on facebook, and every 20-30 minutes after I'm on), though it can no longer change my status. I'd still like to get rid of whatever is causing those windows to pop up. Thanks again!

The Same exact thing is happening to me as with Steve. If anyone can figure out exactly what is going on, that would be greatly appreciated! What needs to be removed? What I've done as a temporary fix is to block the "Share" app because when the spam status is posted, it's always says that it was sent "via Share". I clicked on that and then hit "block this application." It's only a temporary fix because a new window still opens (when I first get on facebook, and every 20-30 minutes after I'm on), though it can no longer change my status. I'd still like to get rid of whatever is causing those windows to pop up. Thanks again!

Umnikazi wombuzo

The problem is still happens -- about 2-3 minutes after I go onto Facebook, the link will pop up in a new window. Thankfully my status is protected since I blocked the Share app, but what's launching the link?

The problem is still happens -- about 2-3 minutes after I go onto Facebook, the link will pop up in a new window. Thankfully my status is protected since I blocked the Share app, but what's launching the link?

Umnikazi wombuzo

same issue here, except it also happens in chrome. malwarebytes, spybot, avg don't find anything...help!!!

in my chrome history the page title is 123456789

the url is http://krepi.net/trash//redirect.php?m= (then whatever they were trying to post as me).

when the window popped up, it actually crashed chrome but successfully posted in ff.

same issue here, except it also happens in chrome. malwarebytes, spybot, avg don't find anything...help!!! in my chrome history the page title is 123456789 the url is http://krepi.net/trash//redirect.php?m= (then whatever they were trying to post as me). when the window popped up, it actually crashed chrome but successfully posted in ff.

Umnikazi wombuzo

Not that anyone will like this, but it is a Facebook problem.

I took ALL my information off Facebook several weeks ago after doing some additional research on their 'income'. Remember when you signed up and they Promised that they did not share your information - well that is CRAP. Where does their $2 BILLION dollar revenue stream come from?

The redirect pop up you are getting is trying to hijack you to a Known Phishing site that Facebook 'sold' the rights to exploit their users. I am not saying that Facebook knew or knows they are Phishing, but that is the end result.

Want to correct the situation? Disable your Facebook account as over 3 million users have since the Income Scandal was exposed about a month ago - And stay the heck away from it!

Just my .02 worth.

Not that anyone will like this, but it is a Facebook problem. I took ALL my information off Facebook several weeks ago after doing some additional research on their 'income'. Remember when you signed up and they Promised that they did not share your information - well that is CRAP. Where does their $2 BILLION dollar revenue stream come from? The redirect pop up you are getting is trying to hijack you to a <u>'''Known'''</u> Phishing site that Facebook 'sold' the rights to exploit their users. I am not saying that Facebook knew or knows they are Phishing, but that is the end result. Want to correct the situation? Disable your Facebook account as over 3 million users have since the Income Scandal was exposed about a month ago - And stay the heck away from it! Just my .02 worth.

Umnikazi wombuzo

ya i have the same problem. i use google crome. and its only on facebook as well. one time i noticed a

500 internal server error

on my pop up but i dont really know what that is.

i think i got in while recently downloading a video game that had a virus. i tried system restoring but it did not work. currently i am trying to uninstall and reinstall google crome, but i changed my password on facebook and so far no reposts, but its only been 1 day. i will keep researching till i find a solution because this is annoying

ya i have the same problem. i use google crome. and its only on facebook as well. one time i noticed a 500 internal server error on my pop up but i dont really know what that is. i think i got in while recently downloading a video game that had a virus. i tried system restoring but it did not work. currently i am trying to uninstall and reinstall google crome, but i changed my password on facebook and so far no reposts, but its only been 1 day. i will keep researching till i find a solution because this is annoying

Umnikazi wombuzo

I have the same problem, and what I did was downloaded this.

https://addons.mozilla.org/en-US/firefox/addon/3145/

Then I added Krepi.net to the blacklist. The pop up will still come up, but the add-on will inform you it is blacklisted and will not let it load, thus not leaving an annoying facebook status.

I have the same problem, and what I did was downloaded this. https://addons.mozilla.org/en-US/firefox/addon/3145/ Then I added Krepi.net to the blacklist. The pop up will still come up, but the add-on will inform you it is blacklisted and will not let it load, thus not leaving an annoying facebook status.

Umnikazi wombuzo

To the previous poster, I've done what you've done too (reinstalling, changing password...) and the popup still appeared again for me and my guess is that it will for you too in a little while longer.

If you do find some answers from your research please do keep us updated here. Thanks!

To the previous poster, I've done what you've done too (reinstalling, changing password...) and the popup still appeared again for me and my guess is that it will for you too in a little while longer. If you do find some answers from your research please do keep us updated here. Thanks!

Umnikazi wombuzo

I have the exact same problem as the users above! While using Mozilla, the Facebook status of everyone using my PC is changed to "Finaly I changed the plain and boring white and blue Facebook colors to something a little more expressive! Ahhh that looks much much better! Try out ^removed spam -MJB^ (DONT VISIT THE WEBSITE!) and a very fast popup page with this adress also appears and dissapears "hxxp://krepi.net/trash//redirect.php?m=just%20discovered%20a%20super%20fun%20tool%20that%20allows%20you%20to%20change%20your%20Facebook%20design..%20it%27s%20sooo%20fun%20:D%20Here%20it%20is%20http://bit.ly/pag3rag3" I have temporarily used the Mozilla addon to block the activity of this website, but the popup still appears... I have scanned my PC with everything; Kaspersky; Trojan Remover; Ad-Aware; Malwarebytes, (and actually removed some Trojans and Malware); after, changed my passwords, etc but this still persists... I have left this problem and my "dds" logs on Tech Support Forum, but have no had any answer... I hope someone out there can find the solution for us... If I get any helpful information, I will post over here. Thank you for the time spent reading this.

I have the exact same problem as the users above! While using Mozilla, the Facebook status of everyone using my PC is changed to "Finaly I changed the plain and boring white and blue Facebook colors to something a little more expressive! Ahhh that looks much much better! Try out ^removed spam -MJB^ (DONT VISIT THE WEBSITE!) and a very fast popup page with this adress also appears and dissapears "hxxp://krepi.net/trash//redirect.php?m=just%20discovered%20a%20super%20fun%20tool%20that%20allows%20you%20to%20change%20your%20Facebook%20design..%20it%27s%20sooo%20fun%20:D%20Here%20it%20is%20http://bit.ly/pag3rag3" I have temporarily used the Mozilla addon to block the activity of this website, but the popup still appears... I have scanned my PC with everything; Kaspersky; Trojan Remover; Ad-Aware; Malwarebytes, (and actually removed some Trojans and Malware); after, changed my passwords, etc but this still persists... I have left this problem and my "dds" logs on Tech Support Forum, but have no had any answer... I hope someone out there can find the solution for us... If I get any helpful information, I will post over here. Thank you for the time spent reading this.

Umnikazi wombuzo

Hey guys, I think I got the solution for cleaning whatever is causing this. So I have been researching and all of the sudden I came across this website in some forgein language I didn´t understand, all I know is that they where talking about this "hxxp://krepi.net" (DONT ENTER THAT SITE) and about Spyware and a tool called SUPERAntiSpyware... so I thought "What the hell, I wont lose anything if I try it" So I downloaded SUPERAntiSpyware Free Edition from www.superantispyware.com/ , Ran it and removed a series of files like: Trojan.Agent/Gen-Redirector; Adware.Tracking Cookie; Adware.Flash Tracking Cookie, etc. Some hours have passed and I havent seen any popus coming up... I wont guarentee it´s not they´re site thats down, but at least try it... Over and out.

Hey guys, I think I got the solution for cleaning whatever is causing this. So I have been researching and all of the sudden I came across this website in some forgein language I didn´t understand, all I know is that they where talking about this "hxxp://krepi.net" (DONT ENTER THAT SITE) and about Spyware and a tool called SUPERAntiSpyware... so I thought "What the hell, I wont lose anything if I try it" So I downloaded SUPERAntiSpyware Free Edition from www.superantispyware.com/ , Ran it and removed a series of files like: Trojan.Agent/Gen-Redirector; Adware.Tracking Cookie; Adware.Flash Tracking Cookie, etc. Some hours have passed and I havent seen any popus coming up... I wont guarentee it´s not they´re site thats down, but at least try it... Over and out.

Umnikazi wombuzo

I was having the same problem, and kept looking around for solutions. Just tried David's suggestion and so far it's lookin good! Thanks.

I was having the same problem, and kept looking around for solutions. Just tried David's suggestion and so far it's lookin good! Thanks.

Umnikazi wombuzo

Thanks to David, I've finally gotten rid of that popup. I was a pretty suspicious at first about downloading some strange antivirus software, especially if it has the word "super" in it. The more hyped up something sounds, the fishier it appears right? But I got so annoyed at the krepi popup, that I gave it a try. And it actually worked! Be sure to download from a reputable site.

Thanks to David, I've finally gotten rid of that popup. I was a pretty suspicious at first about downloading some strange antivirus software, especially if it has the word "super" in it. The more hyped up something sounds, the fishier it appears right? But I got so annoyed at the krepi popup, that I gave it a try. And it actually worked! Be sure to download from a reputable site.

Umnikazi wombuzo

Yep, just confirmed it. Superantispyware fixed the Facebook problem! Rock on!

Yep, just confirmed it. Superantispyware fixed the Facebook problem! Rock on!

Umnikazi wombuzo

OMG THANK YOU DAVID4!!!! I've been trying to get rid of this"virus" for the last 2 weeks and I've tried dozens of free anti-spy/malware programs and the one you suggested was the ONLY one that got rid of the problem that I and a lot of the people in this thread had!

Everyone with this problem, download the program in "David4"s post and it'll fix it

thanks again man!

OMG THANK YOU DAVID4!!!! I've been trying to get rid of this"virus" for the last 2 weeks and I've tried dozens of free anti-spy/malware programs and the one you suggested was the ONLY one that got rid of the problem that I and a lot of the people in this thread had! Everyone with this problem, download the program in "David4"s post and it'll fix it thanks again man!

Umnikazi wombuzo

^^^OOPS...got the guys name confused with the guy who responded afterwards (sorry I was so excited I got rid of the virus)

the link in "DAVID"s post works!!!

^^^OOPS...got the guys name confused with the guy who responded afterwards (sorry I was so excited I got rid of the virus) the link in "DAVID"s post works!!!

Umnikazi wombuzo

OP here. I was a bit skeptical of the "super" antispyware as well, so I waited to see what someone braver than me had to say. Needless to say, I used this yesterday and haven't had any problems since.

Thanks again David, this problem is officially solved!

OP here. I was a bit skeptical of the "super" antispyware as well, so I waited to see what someone braver than me had to say. Needless to say, I used this yesterday and haven't had any problems since. Thanks again David, this problem is officially solved!

Umnikazi wombuzo

I´m glad you got it fixed dudes, always a pleasure to help.

I´m glad you got it fixed dudes, always a pleasure to help.
ra6907 0 izisombululo 1 izimpendulo
Kuphostiwe

OK now, the anti-spyware and antivirus ware and all of that happy horse$#!t removed the root cause but leaves a little something-something behind that allows it to hijack and continue to mess with you. I found THE REST of the problem:

1. go to the browser and type: about:config (hit enter)

2. heed the warnings but go in anyway 3. find the keyword.url line. 4. right click the end of it and select reset.

   If you were like me you saw that all too familiar zugo and Bing on that line.
 Ha, victory is ours!
OK now, the anti-spyware and antivirus ware and all of that happy horse$#!t removed the root cause but leaves a little something-something behind that allows it to hijack and continue to mess with you. I found THE REST of the problem: 1. go to the browser and type: about:config (hit enter) 2. heed the warnings but go in anyway 3. find the keyword.url line. 4. right click the end of it and select reset. If you were like me you saw that all too familiar zugo and Bing on that line. Ha, victory is ours!