Solved

Browser Hijacker

  • 28 October 2012
  • 61 replies
  • 914 views

Chrome, on our our home computer,  has been subverted by a browser hijacker that allways directs it to secure.conduit.  It is quite annoying that the browser immediately goes to bing.  It cannot be removed using the Chrome search engine option though I did delete some browsers I didn't want.
 
Does/Could SecureAnywhere deal with this and if so how?
icon

Best answer by rayb-baby 10 April 2017, 03:59

View original

61 replies

Userlevel 3
This DEFINITELY worked for "Guruofsearch" on Chrome, but I suspect that it will work for other browser hijackers and it also fixed my Internet Explorer.

I went to Chrome Help at this link:
https://support.google.com/chrome/answer/2765944#browsersettings
It was EASY and QUICK!  I was rid of "Guruofsearch" in no time.

 
Or you can go directly to the Chrome Cleanup Tool for Windows 7 thru 10.
https://www.google.com/chrome/cleanup-tool/

 
"Clean Chrome of unwanted ads, pop-ups, & malware
If you're seeing some of these problems with Google Chrome, you might have unwanted software or malware installed on your computer:
  • Pop-up ads won't go away.
  • Your Chrome homepage or search engine keeps changing or is not set to Google anymore.
  • Unwanted Chrome extensions or toolbars keep coming back.
  • You keep getting redirected to unfamiliar webpages."   
 "Chrome will open a new tab, and ask you to reset your settings. Click Reset".
 
It literally worked in seconds.  I'm no expert, but I think it cleared the cache as all of my saved sign-ins were gone.  A small price to pay.  I hope you know all of your passwords .      It also disabled my extensions, so enable any extensions that you're using.

                     
I'm not even sure if there is any relation, but the "plugin" link for FlashPlayer still didn't work, so I went here:
https://support.google.com/chrome/answer/142064?hl=en
The link still doesn't do anything, but now when a FlashPlayer video comes up it asks me if I want to activate it.  Goodbye plugin link, hello ask me on screen.  That's good enough for me!  I even like it better that way!

If anyone still has the problem, I hope it works for you.  And YES, it's SAFE to use.

     
Userlevel 7
Hi Charlotte_Sterling
 
Thanks for your intent to assist.
 
However, here in the Community we do not advocate the recommendation or use of YouTube-related solutions to malware and/or PUA removal unless they are from a source known to be reputable, i.e., from a security app vendor or one of the major institutions such as Microsoft, Apple, Google, etc.; this is due to the fact that malware removal is a skilled task and many of the solution shown may not be safe or have considered all aspects of the removal process. 
 
And even if one has found a suitable video we believe that the best approach, if WSA is unable to handle the issue (and no security app can handle 100% of issues/infections 100% of the time...not even WSA ;)), is for the OP to Open a Support Ticket to get the Webroot Support Team of professionals to intevene and resolve the issue. This is a free service available to all users with an active subscription.
 
This is what I would advocate using in this instance, and so potentially avoiding getting into further trouble be doing something  unforseen to one's system.
 
Regards, Baldrick
Do NOT download any Malware removal tools!! Assume you have a PC. (My husband every so often gets Browser Hijackers. He has a PC.) What I did was search through all of his files and any file which seemed "odd" I googled and if it mentioned or said it was a malware or browser hijacker then I deleted it.

I just googled "how to get rid of Browser Hijacker Gurofsearch - and there was a link to a YouTube video, which looked really helpful!

You've probably also figured out you need to be careful searching for sites, and reading the link BEFORE clicking - some are ads (which could also be Malware).

On my MAC, there's an app WOT (I think), that I downloaded from the Apple store for free (not sure if there's something like that for PCs). It rates all of your sites you've googled as Trustworthy or not, with different colored circles: Green (good), Yellow (questionable) and Red (bad) or Blue Question mark (probably not so good?). Good Luck!!
Userlevel 3
Sorry, the blue and white icon between the Webroot icon and the 3 vertical dots.  The pencil disappeared from my photo for some reason.
Userlevel 3
I have the link for plugins in my bookmark bar.   When that failed me I found the blue and white shortcut next to the pencil online and had that installed.  In either case, they both brought up the "This site can't be reached " page.   By the way, those are two photos and the way Webroot brought them up.  I couldn't figure out how to separate them and write text around them.  Maybe next time.  At any rate,  I can't open FlashPlayer because of this.  I've tried everything you suggested multiple times plus the things I said in my original post.  The only thing I haven't done yet is go to "Open a Support Ticket" because I wanted to answer your question first.  That will be my next step after I hear back from you.



 
Userlevel 7
No worries, Muddy7
 
We are all of us a learning...every day...and that is what makes this Commuinty so great. :D
 
Regards, Baldrick
@ wrote:
To make sure that your WSA is checking for PUAs proficiently, it sometimes helps to reset the PUA detection within WSA's settings. For PUA's that had previously been scanned and determined to be OK, but have since been added to detection/removal, you may want to complete the following steps:
 
  • Open Webroot SecureAnywhere
  • Click on ‘Advanced Settings’ from the top right
  • Select ‘Scan Settings’ from the left side
  • Unselect the option “Detect Potentially Unwanted Applications”
  • Click on the Save button (you may have to enter in a CAPTCHA)
  • Reselect the option to “Detect Potentially Unwanted Applications”
  • Click on the Save button
  • Run another scan with Webroot and remove any items that get detected.
and...
@ wrote:
PS.  What I occassionally do is go into the Advanced Settings, Scan settings, and toggle off the Detect PUAs...setting, save the configuration, then go back in and toggle it back on, save once more and then run a scan.  This is a tip provided by one of the excellent Threat Researchers, as something that seems to 'bump' the detection of PUAs/PUPs...not sure how or why but it seems to, so yo many want to try it. 


Thanks, Baldrick! I'd somehow missed that one. As you may have noticed, I recently reported here on my first ever "infection" since using Prevx/WSA (more than 10 years now) and what I had done to get rid of it. If this ever happens again, I shall first try the hint you give above.
Userlevel 7
No worries...;)
 
When you say that your "plugins are blocked and I can't use Flashplayer" precisely what do you mean/how does the blocking/issue manifest itself? Are their any messages informing you of the blocking? What are you seeing?
 
Regards, Baldrick
Userlevel 3
Thanks!  I'll give it a try and let you know how things work out,  The worst thing is that my plugins are blocked and I can't use Flashplayer.
Userlevel 7
Hi yayb-baby
 
Sorry to hear about you issue.
 
Guruofsearch.com is indeed a browser hijacker...and it is most definitively 'caught' via bundling with other free software that one downloads off of the Internet. When installed this browser hijacker (a PUA or Potentially Unwanted Application in Community parlance) it will set the homepage and search engine for your web browser to http://guruofsearch.com.
 
Given what you say about not having installed any software recently usually the key to avoiding them is to make sure that when downloading apps one does so from the author's own website or one that they have recommended, and not 3rd party downloading site.
 
WSA does detect and remove many PUA's, and more are being added, but WSA does not detect all of them. A simple browser add-on with PUA behaviour that is easy to identify and easy to remove is not likely to be detected and removed by WSA. Those that are intentionally difficult to locate and remove are. Please see THIS LINK for more information regarding Webroot's stance on these annoying programs.
 
To make sure that your WSA is checking for PUAs proficiently, it sometimes helps to reset the PUA detection within WSA's settings. For PUA's that had previously been scanned and determined to be OK, but have since been added to detection/removal, you may want to complete the following steps:
 
  • Open Webroot SecureAnywhere
  • Click on ‘Advanced Settings’ from the top right
  • Select ‘Scan Settings’ from the left side
  • Unselect the option “Detect Potentially Unwanted Applications”
  • Click on the Save button (you may have to enter in a CAPTCHA)
  • Reselect the option to “Detect Potentially Unwanted Applications”
  • Click on the Save button
  • Run another scan with Webroot and remove any items that get detected.
 
If that does not helps and you feel or consider yourself technically proficient then you can try these steps to remove it from your system.
 
And if that does not work or you do not feel technically capable then the best thing to do is to Open a Support Ticket & ask Webroot Support to take a look and remove these for you.  There is NO CHARGE for this for valid/active WSA license holders.
 
Hope that helps somewhat?
 
Regards, Baldrick
 
Userlevel 3
My browser was just hijacked by "guruofsearch".  Not only did it hijack my google, but my "plugins" link is dead which I use to turn on and off my flashplayer that is now dead.  It came out of nowhere as I didn't load any new programs.

Before doing anything else I checked my extensions, settings, programs, task manager and my Webroot for viruses.  Everything was normal.  No "guruofsearch", except it appears every time I want to do a search.

 
I then installed the google link in my Chrome bookmarks bar so I am able to search with google now, but I'd rather not have to do it that way, obviously.  I want my address bar back and I want my FlashPlayer back, too.
Not only that, I tried InternetExplorer.  The ONLY thing I can do there is click on news links that are already on the screen.  The address bar and bing search are completely dead.  I don't even get the "guruofsearch".  NO browser at all for IE.

There are all kinds of "solutions" online, but they require downloading another malware removal tool which I'd rather not do as I already have Webroot and it has been good to me ....... so far.

 
So, how do I get rid of it?
Userlevel 7
Hi Stuart
 
Welcome to the Community Forums.
 
We appreciate your desire to assist other Community members but if you wish to promote malware removal tips from other site please do so outside the Forums, i.e., via an offer to PM (Private Message) with interested members.
 
For more information on the Guidelines please see here.
 
Regards, Baldrick
Hi everyone, it is really tough to deal with browser hijacker becasue it is going to hurt the browser so badly, apart from overall system is aversely affected by it. Nevertheless, it is possible to remove Cheapcomputersupport.com browser hijacker.
 
for more visit: <URL snipped as contrary to Community Guidelines to post links to 3rd party security and/or malware removal sites>
Userlevel 7
Badge +56
Hello @ please don't post links to off site help forums just forums for OS's such as Microsoft Answer Forums: http://answers.microsoft.com/en-us as Webroot likes to help there own users and members.
 
TIA,
 
Daniel 😉
You can get easy and complete removal instruction of search.conduit and other browser hijacker program form ~snip Removed Link to off site help forums only OS support Forums like Microsoft snip~. This place provide complete details about threat and there removal  instruction in a easy manner. It helped me alot, my friends also get benefited form this place. In my view this is the best place for those user whose PC get affected with browser hijacker and other computer threats. Wish you be safe and secure in future. 
Userlevel 7
Hi BobbyBoswell13
 
Welcome to the Community Forums.
 
Thanks for your input into the Great Debate...if only it were that simple but unfortunately PUAs come in all shapes and sizes, i.e., from different sources, impacting the system in different ways, embedding themselves in browsers, installed as programs, chnaging the Registry, adding services, etc., or any permutastion of the aforementioned and more.
 
As I am sure that you must have read in numerous threads and posts on the topic WSA does detect and remove many PUA's, and more are being added, but WSA does not detect all of them. A simple browser add-on with PUA behaviour that is easy to identify and easy to remove is not likely to be detected and removed by WSA.
 
There are thos that that are intentionally difficult to locate and remove are. But having said all of that Webroot does have an official stance on these annoying programs, which you can read more on here is you are interested.
 
Also, one of our gurus @ has posted an Idea for Webroot to consider asking them to increase PUA detection.  Please go along, review this, add your comments (this is the best place as the Development Team frequently review what has been raised/posted in the Ideas Exchange) and even kudo the feature request...it will all help to get traction on improving WSA...and after all that is one of the things we want to do...help make WSA a better product.
 
Regards, Baldrick
@ wrote:
On the flipside alot of programs include other downloads as part of the software so are we supposed to blacklist Java/Flash/Adobe etc? Google search results are a common thing that are shown as "Evidence" of malware just because a program is difficult to remove it doesnt mean its malware. I spent ages over the weekend trying to remove .net to get it reinstalled again. Does that mean its malicious because its tricky to remove? Of course not but you can see where I am coming from.
 
As I have always said with these topics arrive I detest toolbars and these "free" programs you see on a lot of well known sites.
ok well why not add a program to webroot that uninstalls the program, then searchs the computer for other instances of it and/or similar programs/files and allows the person to choose whether or not to have webroot delete/uninstall them and then alerts the person anytime it sees this file or program try to recreate itself and lets them choose to block it or let it thru
I had the same search conduit browser hijacker.its such a pain. It doesn't matter if u change ur chrome settings and u won't find any programs to remove; it's still always there ruining ur browsing experience and making ur PC run at a snails pace.
 
Remainder of post edited/removed: References to competitor product.  Please note that any PUA that WSA does not automatically detect and remove can be removed free of charge by Webroot Support.  The proper path in this case is to file a Trouble Ticket.  By having Webroot Support remove the nuisance software, the software will be reviewed for possible inclusion in the detection/removal engines.  shorTcircuiT
 
 
Userlevel 7
Badge +62
Hi Mary _Smith, you say,

It often comes with third-party software downloads
Uninstall Conduit toobar from chrome.
Click on the chrome menu bar icon
Select tool option
Remove trash bin icons by clicking on extension
Restart chrome page
-----------------------------------------

Thank you so much for your input! Sounds great!

Have a great day! 😉
It often comes with third-party software downloads
Uninstall Conduit toobar from chrome.
Click on the chrome menu bar icon
Select tool option
Remove trash bin icons by clicking on extension
Restart chrome page
Userlevel 6
@ wrote:
Hi,
Browser Hijacker is a nasty virus which enters into the system without permission. After that it displays pop-ups and also disable some application and because of this users cannot access the system. But to remove such virus, virus removal tool is used so that it can help you to get rid of virus.
Welcome to the community stephanic !
 
Nice to have you here!
 
Thank you for your input!
 
Beth
Userlevel 7
Browser Hijackers are not malware but in nearly all cases are user installed toolbars. PUA`s often come bundled with other junk that will install a toolbar or will change the default homepage. Please dont post links to 3rd party sites/tools, we can fix these issues for our customers without using them. 
Userlevel 7
Baldrick has it right on the nail.  WSA has until recently not detected and removed what we call PUA's.. that is new to the 2014 version and the functionality of it is still in the beginning stages.  Each time someone posts here regarding a specific one, especially if we have them contact Support about it, that helps being more and more PUA's into the radar, getting them added to the Cloud detection.
 
In that sense, we are ALL 'training' Webroot, but it is on a global sale and trains it for all users at the same time 🙂
Userlevel 7
Hi Charlotte
 
It is not so much that you are training WSA but rather that the Cloud that holds all the information on what is good and what is not good grows daily, what with all the Webroot Threat Researchers continually analysing new files and apps that are daily being released and/or new versions of existing files and apps.
 
So when your system is scanned the threat database in the Cloud will have changed, and things previously not flagged up will be, etc.
 
If you take a look at the excellent post that Daniel put up earlier you will see what all of that entails.
 
Hope that helps...and keep asking the questions. ;)
 
Regards
 
 
 
Baldrick
 
PS.  What I occassionally do is go into the Advanced Settings, Scan settings, and toggle off the Detect PUAs...setting, save the configuration, then go back in and toggle it back on, save once more and then run a scan.  This is a tip provided by one of the excellent Threat Researchers, as something that seems to 'bump' the detection of PUAs/PUPs...not sure how or why but it seems to, so yo many want to try it. :D
After hunting through the various posts regarding the Browser Hijackers, I learned a lot, as respects the terms PUP and PUA, so I went through all of the programs on my husband's PC, if something looked like an "odd" program name, I googled it, if it came up that it was a PUP or malware I deleted it. Thanks all of those posts were so helpful! Do have a question though about WebRoot. The scans said his PC was clean of malware, however, when I was looking for and deleting all of those PUPs/PUAs, quite often I'd get a pop up window from WebRoot saying it had identified a potential threat. But these threats weren't any of the ones I was deleting! It almost seemed as if the software was "thinking" and looking for patterns now that I'd been deleting stuff. Am I training WebRoot to be on the lookout for new patterns, or what?? It was interesting because all of a sudden it was finding things that it hadn't found or identified on the prior first scan.

Reply