Firefox defaulting it's searches with Babylon

luckymoneysaver

rmg1 wrote: »

It's not classed as malware, more of a toolbar.
The Hijackthis log will show what's installed and what can safely be removed.

Thanks. Do you have a legit link where the software can be downloaded.

Just done a search for it and some of the websites look a bit dodgey!!

edit. found a link

I cant see anything babylon related??

GunJack

http://www.filehippo.com/download_hijackthis/

totally legit

luckymoneysaver

Just opened up my internet explorer an the babylon search has set itself as homepage for that also.

http://search.babylon.com/?affID=110774&babsrc=lnkry_nt

this is the url it is using

in internet explorer, in options, the home page it is using is this

publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=30&affid=110774&searchtype=hp&babsrc=lnkry_nt

just been through my control panel recently installed programms and found linkury search bar. ive uninstalled that, in the hope that it makes a difference.

rmg1

I can't see anything obvious for babylon in the log (but I'm no expert).
What I can see is a load of items at startup you don't need.
Might be worth giving them a prune via the MSCONFIG startup tab.

It might also be worth following the speed-up sticky at the top of this forum as well.

luckymoneysaver

rmg1 wrote: »

I can't see anything obvious for babylon in the log (but I'm no expert).
What I can see is a load of items at startup you don't need.
Might be worth giving them a prune via the MSCONFIG startup tab.

It might also be worth following the speed-up sticky at the top of this forum as well.

Thanks, just had a look at the startup tab in msconfig. What would you recommend I disable at startup. I know what most of it is, but some stuff not so sure.

GunJack

C:\Users\Alex\AppData\Local\Smartbar\Application\L inkury.exe

running (from hjt log). Part of Smartbar, which is prob causing your redirects. Either remove via Programs and Features, MSCONFIG, or CCleaner's Tools (Uninstall or Startup)

luckymoneysaver

GunJack wrote: »

C:\Users\Alex\AppData\Local\Smartbar\Application\L inkury.exe

running (from hjt log). Part of Smartbar, which is prob causing your redirects. Either remove via Programs and Features, MSCONFIG, or CCleaner's Tools (Uninstall or Startup)

Thanks, that was the linkury search bar. I found it in my control panel and uninstalled it. It was installed a few days ago, but I don't remember doing it.

Hopeful that was the cause of the problems and now it's going away.

GunJack

Now you've uninstalled it, run CCLeaner's cleaner and registry cleaner. Then download malwarebytes, update and quick scan

http://www.filehippo.com/download_malwarebytes_anti_malware/

decline the trial, let it delete all it finds (might need a reboot) and post the log back up here.

luckymoneysaver

Thanks, quick scan done. Nothing detected.

waddler_8

OTL would have been a better choice as it shows Firefox related data - Preferences, Add-ons etc. Hijackthis shows only IE.

http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [URL]hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&use[/URL] rid=30&affid=110774&searchtype=ds&babsrc=lnkry&q={ searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [URL]hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&use[/URL] rid=30&affid=110774&searchtype=ds&babsrc=lnkry&q={ searchTerms}


R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL =[URL="hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&use"] hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&use[/URL] rid=30&affid=110774&searchtype=ds&babsrc=lnkry&q={ searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = [URL]hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&use[/URL] rid=30&affid=110774&searchtype=ds&babsrc=lnkry&q={ searchTerms}

babsrc = Babylon Search?

Anything in your installed programs refer to either Open Candy or Helperbar?

Open Candy: http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=ADWARE:WIN32/OPENCANDY