• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Kudos1

Visual Bee is hijacking my browser!

Sorry...I know this is a stupid question, but I am exasperated and need some help.  I installed Norton 360 today, primarily because my browser is being hijacked by visual bee.  I couldn't find a valid fix anywhere online and am unable to find anything on Norton.  I removed the toolbar after hours of searching, but it is still hijacking Google Chrome.  Does anyone know how to fix this?  Thank you!

Replies

Kudos0

Re: Visual Bee is hijacking my browser!

Sorry...I know this is a stupid question, but I am exasperated and need some help.  I installed Norton 360 today, primarily because my browser is being hijacked by visual bee.  I couldn't find a valid fix anywhere online and am unable to find anything on Norton.  I removed the toolbar after hours of searching, but it is still hijacking Google Chrome.  Does anyone know how to fix this?  Thank you!

Kudos0

Re: Visual Bee is hijacking my browser!

I installed VB on my System, it is of the Conduit, Smartbar group,  Best you go to the like of the Bleeping Computer Malware Removal boards to make sure it is all gone and anything else on your system found to be removed gone also.

Object list

Chrome  (does change FF and IE also)

urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3268494&SearchSource=48&CUI

homepage = "hxxp://search.conduit.com/?ctid=CT3268494&SearchSource=48&CUI=UN25581938611958431&UM

suggest_url = "hxxp://suggest.search.conduit.com/Suggest.ashx?q=[{searchTerms}]

search_url = "hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&cui=UN25

keyword = "search.conduit.com",

icon_url = "hxxp://search.conduit.com/fav.ico",

Registry

HKCU\Software\AppDataLow\Software\Conduit
HKCU\Software\AppDataLow\Software\SmartBar
HKCU\Software\Google\Chrome\Extensions\nlndmljfcnlkbcbbneenigbpikmdfcdh
HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
HKLM\SOFTWARE\Classes\IESmartBar.BandObjectAttribute
HKLM\SOFTWARE\Classes\IESmartBar.BHO
HKLM\SOFTWARE\Classes\IESmartBar.DockingPanel
HKLM\SOFTWARE\Classes\IESmartBar.IESmartBar

HKLM\SOFTWARE\Classes\IESmartBar.IESmartBarBandObject
HKLM\SOFTWARE\Classes\IESmartBar.SmartbarDisplayState
HKLM\SOFTWARE\Classes\IESmartBar.SmartbarMenuForm
HKLM\SOFTWARE\Google\Chrome\Extensions\nlndmljfcnlkbcbbneenigbpikmdfcdh
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Files and Folders

C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlndmljfcnlkbcbbneenigbpikmdfcdh
C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage
C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal
C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlndmljfcnlkbcbbneenigbpikmdfcdh
C:\Users\[Username]\AppData\Local\PackageAware
C:\Users\[Username]\AppData\LocalLow\Conduit
C:\Users\[Username]\AppData\Roaming\OpenCandy

You have to probably reset the browser(s) homepage and search settings to what you had before, after the removal is complete.

Quads

Replies are locked for this thread.