Search-Plugin messed up

doktor5000 · Post by **doktor5000** » December 10th, 2004, 8:41 am

ahh well my problem is that i got some sort of adware/searchpage hijacker.
i think i managed to delete it, but the prob is that when entering something
in the small search field (standard is google.com) i get passed to
search.findwhatevernow.com/search.jsp saying we can't find "google.com".
search something and it diyplays another name under "we can't find ..."
so i just set my standard search engine to google.de (btw i'm german)
my question is how to remove this damn f*cker, cause i thought that
such hijackers only affect the IE and how to delete the standard plugin
and replace it, because i want to use google.com (censorship reasons)
and i don't get on even by typing in the url.

thx for your answers in advance

doktor5000 · Post by **doktor5000** » December 10th, 2004, 8:44 am

NOTE: just found out this also happens when opening links, f.e.
www.mozilla.org/firefox/support/options

Guest · Post by **Guest** » December 11th, 2004, 5:36 am

may it be useful if i post the sourcecode of the referring page?

anyone plz help...

Guest · Post by **Guest** » December 11th, 2004, 10:12 am

I suggest that you <A HREF="http://www.mozilla.org/support/firefox/profile#new">create a new profile</A>.
That will reset many settings easily. If the problem is corrected, you may then retrieve bookmarks from the old profile (another topic). If it does not correct the problem, it is easily removed with no harm done.

Fück Spÿwärë · December 11th, 2004, 12:29 pm

As doktor5000 mentioned, this is a spyware issue. Spyware doesn't affect Firefox much but you've acquired this spyware when using internet explorer (or some other browser theoretically) before switching to Firefox.

You need to make a clean sweep of your computer. These programs will help you do just that:

Spybot - Search & Destroy 1.3
http://www.safer-networking.org/en/download/index.html

Ad-Aware SE Personal 1.05
http://www.lavasoftusa.com/support/download/

SpywareBlaster 3.2
http://www.javacoolsoftware.com/spywareblaster.html

I have them all myself and at least they were very useful when I was an Internet Eplorer user. These all are very powerful programs to remove and block ad/spyware. All of them are also free. I really would suggest anyone to atleast try these software. I bet they will stay on your harddrives!

doktor5000 · Post by **doktor5000** » December 12th, 2004, 10:13 am

thanks for your help, although at least it was not needed.
i just managed to solve the problem. i ran masses of
spyware/adware scanners on my pc but none found anything
related to my problem. by searching for
"search.findwhatevernow.com"
i got on a site about google/searchpage hijackers.
so i tried to correct my dns-nameservers after reading
some threads and it added 2 custom dns-servers.
removed 'em and it works. the solution via a new profile
seemed to much work for me but nevertheless thanks
for all your help.

Guest · Post by **Guest** » December 12th, 2004, 10:27 am

Hey Doc5K
Great detective work. And thanks for sharing the solution

Guest · Post by **Guest** » December 13th, 2004, 1:18 am

could this be of interest?
http://www.pchell.com/support/dsoexploit.shtml

also there's this.
http://www.majorgeeks.com/download4392.html

doktor5000 · Post by **doktor5000** » December 13th, 2004, 9:01 am

Finally a last post for those who are still buggered by this hijacker:

to correct the DNS-nameservers you open up regedit, and head to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
one or two of these CLSID's (i think the last ones) holds your network configuration.
Look somewhere in the middle or search for "DNS", then look into your network-connections
for the adapter you are accesing the internet with, point at tcp-ip-protocol and look for your
DNS-servers (primary and secondary) write them down an look in the registry if these are
correct. if there are four of them delete the two not-matching ones (after registry backup).
for me this worked perfect. FYI, i got this tip from computercops.biz, search in the forum
for the search paged you are hijacked to. some versions of this hijackers should be detected
by "http://www.kephyr.com/spywarescanner/index.html". i couldn't detect it on any
spyware/adware program.
my final statement is DO NOT download little thingies from sources which you don't know exactly.
if anyone got questions post or mail me at doktor5000@arcor.de

and besides these DataSourceObjects got nothing to do with hijackers, i think ...

Guest · Post by **Guest** » December 13th, 2004, 9:06 am

@ Fück Spÿwärë

and for your interest it did affect firefox directly, because messing up with the registry
affects almost every prog accesing the internet if it does not bring its own tcp-ip stack with it.

but anyway thanks for your help although at last i didn't really need it

Fück Spÿwärë · December 13th, 2004, 4:45 pm

no problem man, good to hear you got on top of it. what i really meant was you dont get any hijacker programs installed thru firefox. of course after you have them allready installed on your system (thu ie or some mail attachment or whatever) they might affect just about anything. say once you get rooted your operating system never again tell you the truth.

happy holidays peeple!

Guest · Post by **Guest** » December 16th, 2004, 3:45 pm

Hi,

I had exactly the same problem and finally found the possible solution.

Open your google.src file found in the "searchplugins" subdirectory of the mozilla directory (depending on where you installed it but the default should be "c:\program files\mozilla firefox"). Open it using wordpad or notepad.

Then open up this page: http://www.google.com/mozilla/google.src" using your broken firefox.

Copy all the contents of this file and replace the original content on your word/notepad.

Save and close the google.src file above.

Close Firefox and restart it.

Should work now.

Just in case you can't view the file at google, here it is:

============

# Mozilla/Google plug-in by amitp+mozilla@google.com

<search
name="Google"
description="Google Search"
method="GET"
action="http://www.google.com/search"
update="http://www.google.com/mozilla/google.src"
updateCheckDays=1
queryEncoding="utf-8"
queryCharset="utf-8"
>

<input name="q" user>
<input name="sourceid" value="mozilla-search">
<inputnext name="start" factor="10">
<inputprev name="start" factor="10">
<input name="ie" value="utf-8">
<input name="oe" value="utf-8">

<interpret
browserResultType="result"
charset = "UTF-8"
resultListStart=""
resultListEnd=""
resultItemStart=""
resultItemEnd=""
>
</search>

=======