Mozilla hijacked???

[Alboguy]

Hey guys!

Look what happens when I write something in Firefox address bar and search for it:



After pressing Enter:



And the results:



What's this? Is Firefox hijacked? How to fix this?

[hellnoire]

Post a HijackThis log please

[leofelix]

Sorry for intrusion.
Apart from Hellnoire's request, just a couple of questions:

1) did you install Incredimail?

hxxp://w w w.incredimail. com/english/splash.aspx

2) Do you use WinAmp and you installed its toolbar too?

Both of them are adware, they hijack your browser and display advertisments.

http://www.mywot.com/en/scorecard/incredimail.com

While it is safe not to install winAmp toolbar (and use only WinAmp player) it is not safe to install Incredimail since you can get rid of its ads/spyware only by buying the full Incredimail e-mail client

[Alboguy]

@hellnoire I'll post it after a few minutes and I thought of it.

@leo well yeah leo it's my friend's laptop and he did install incredimail but winamp was just for example. It doesn't have Winamp installed. Anyways is there anyway to fix all this?

[hellnoire]

If that's the case, uninstall Incredimail and use a different client then. Just my two cents, since it's a paid ad-ware one, like Leofelix said.

[leofelix]

Once uninstalled Incredimail, your friend should reset default Firefox search engine

Win + R(or start>run) type "firefox -safe-mode" then hit enter

a pop up windows will prompt, now select
- Reset toolbars and controls
-Restore default search engines
-Reset all user preferences to Firefox defaults

click on Make Changes and restart

http://support.mozilla.com/en-US/forum/1/563122

Run a SUPERantspyware portable full scan

http://www.superantispyware.com/portablescanner.html

let SAS remove all malware found.

Now clean with CCleaner or ATF Cleaner your browser cache.

However a HJT log - as per hellnoire's request - should be necessary

[vickypark]

ya i too had the same probs, but i did know how to fix it...
first uninstall incredimail...

type about:config in URL bar...

there search for keyword.URL

then...right click it and click 'reset'

thats it now your default search is brought back as google...

[LizardMan]

The post of vickypark this is the right way to fix your problem Alboguy

[leofelix]

The post of vickypark this is the right way to fix your problem Alboguy

I wouldn't be so sure.
That trick reset only FF search engine to google search, you can do the same by opting only for "Restore default search engines" within firefox in safe mode and not all changes made by malware.

Moreover: without an antimalware scan you won't get rid of adware installed by Incredimal (even if you had Incredimail uninstalled)



[EDIT to add] Forgot to say: congrats vickypark, the tip you mentioned is very good anyway. Thank you for your helpfulness

[Alboguy]

I fixed the problem guys! Thanks a lot!!