Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Resolved Question

PC Hijacked

May 13, 2013 8:22PM PDT

Hi,

Recently I received a message telling me to update my adobe flash player. Since doing this I've had all kinds of weird things happening. I'm using Windows 7 and IE10.

- When I click on the IE icon on the task bar another icon appears at the other end and hijacks IE. In other words, it disables the original IE icon and takes over. If I delete it and start again it does it again.

- My Norton 360 keeps sending this message: "1119[1].js is not safe and has been removed". It pops up all day.

- My back arrow doesn't work periodically.

- When I click on a link I often get interrupted by the following full page message: "You have been randomly selected to take part in a national survey. Respond now and you may have the chance to win an Iphone5..." Regardless of whether I "OK" it or kill it, it still takes me to the survey. The http is "serve.bannersdontwork.com".

I've run a full Norton scan and also downloaded Superantispyware to remove any malware but the problem persists. I've also disabled a number of add-ons but to no avail. The following add-ons didn't allow me to disable them: Giant Savings Extension, Lyrics Sing.

Any ideas will be appreciated.

Thanks in advance.

VG

Discussion is locked

vrygreen has chosen the best answer to their question. View answer

Best Answer

- Collapse -
Sounds like a bug alright
May 13, 2013 9:36PM PDT
- Collapse -
Answer
Hijack/redirect
May 14, 2013 3:07AM PDT

When this occurs what does your homepage read as in Internet Options??? Is there anything alluding to CONDUIT?That is an item that is floating around of late and a prior poster mentioned potential fixes using safe mode. Use safe mode with networking to run these items, another shot would be to try the Revo uninstaller. One of the temporary fixes is as you have done, disabling in the browser (add ons). The reason I mention this is because I've see 3 systems with similar issues and am wondering if what you have contracted is not related to the CONDUIT issue which creates a very similar effect to what you have, a redirect or hijack and is very troublesome to deal with. The flash player update you mention, in the cases I have seen is bogus, it is not Adobe.If you read up on the issue, should it be CONDUIT related, you will see the name Symantec pop up in several of the commentaries as part of the problem, very strange indeed. Best of luck!!

- Collapse -
Problem Almost Resolved
May 14, 2013 5:26PM PDT

Thanks guys for your assistance.

The problem seems to have almost resolved through uninstalling Lyrics Sing.

I still have the problem though of the replicating taskbar IE icon.

First of all, if I close IE the new icon disappears and I'm left with the original which, if I click on it, replicates itself again. If I close IE and remove the original icon from the taskbar, I then have to go to Start and click on Internet Explorer to start the program again. This opens IE and restores the new icon on the taskbar. If, instead of opening IE through Start, I pin IE to the taskbar and click on it, it is replicated again. If I then click on the original icon 3 times, 3 new icons appear one behind the other on the replicated icon, each one with its own home page.

I've deleted the iconcache.db and rebooted but to no avail.

I've also tried Start Task Manager/Processes/explorer.exe/End Processes/File/New Task (Run) but to no avail.

Any ideas?

VG

- Collapse -
I am curious
May 14, 2013 8:43PM PDT

Did you follow the link to Grif's method of malware elimination and do it?

- Collapse -
(NT) Yep, Run Those Scans
May 15, 2013 9:37AM PDT