Not what you were looking for? Ask our experts!
Reply
Newbie
ConnieO
Posts: 1
Registered: ‎03-21-2013

Visual Bee is hijacking my browser!

Sorry...I know this is a stupid question, but I am exasperated and need some help.  I installed Norton 360 today, primarily because my browser is being hijacked by visual bee.  I couldn't find a valid fix anywhere online and am unable to find anything on Norton.  I removed the toolbar after hours of searching, but it is still hijacking Google Chrome.  Does anyone know how to fix this?  Thank you!

Bot Obliterator
Quads
Posts: 16,528
Registered: ‎07-21-2008

Re: Visual Bee is hijacking my browser!

[ Edited ]

I installed VB on my System, it is of the Conduit, Smartbar group,  Best you go to the like of the Bleeping Computer Malware Removal boards to make sure it is all gone and anything else on your system found to be removed gone also.

 

VB_CT.jpg

 

 

 

Object list

Chrome  (does change FF and IE also)

 

urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3268494&SearchSource=48&CUI

homepage = "hxxp://search.conduit.com/?ctid=CT3268494&SearchSource=48&CUI=UN25581938611958431&UM

suggest_url = "hxxp://suggest.search.conduit.com/Suggest.ashx?q=[{searchTerms}]

search_url = "hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&cui=UN25

keyword = "search.conduit.com",

icon_url = "hxxp://search.conduit.com/fav.ico",

 

Registry

 

HKCU\Software\AppDataLow\Software\Conduit
HKCU\Software\AppDataLow\Software\SmartBar
HKCU\Software\Google\Chrome\Extensions\nlndmljfcnlkbcbbneenigbpikmdfcdh
HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
HKLM\SOFTWARE\Classes\IESmartBar.BandObjectAttribute
HKLM\SOFTWARE\Classes\IESmartBar.BHO
HKLM\SOFTWARE\Classes\IESmartBar.DockingPanel
HKLM\SOFTWARE\Classes\IESmartBar.IESmartBar

HKLM\SOFTWARE\Classes\IESmartBar.IESmartBarBandObject
HKLM\SOFTWARE\Classes\IESmartBar.SmartbarDisplayState
HKLM\SOFTWARE\Classes\IESmartBar.SmartbarMenuForm
HKLM\SOFTWARE\Google\Chrome\Extensions\nlndmljfcnlkbcbbneenigbpikmdfcdh
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

 

Files and Folders

 

C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlndmljfcnlkbcbbneenigbpikmdfcdh
C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage
C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal
C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlndmljfcnlkbcbbneenigbpikmdfcdh
C:\Users\[Username]\AppData\Local\PackageAware
C:\Users\[Username]\AppData\LocalLow\Conduit
C:\Users\[Username]\AppData\Roaming\OpenCandy

 

You have to probably reset the browser(s) homepage and search settings to what you had before, after the removal is complete.

 

Quads