Categories: Report an Issue :

how to remove qooqlle hijack

Showing 1-31 of 31 messages
how to remove qooqlle hijack reamer 11/9/10 12:56 AM
qooqlle.com has hijacked my google chrome browser and no antivirus software has been able to remove it. 

it says google custom search when i search anything
Re: how to remove qooqlle hijack †Tommy G.† 11/9/10 7:31 AM
Check to see if this thing has not installed itself in your Add/Remove program. 

Also, try the help link below...
Re: how to remove qooqlle hijack beejw1 11/11/10 11:52 PM
I tried everything to delete qooqlle - adaware, spybot, malwarebytes, super, comodo even contacted my ISP but everytime I reset my homepage and then rebooted, qooqlle remained my homepage.
Appear to have solved it myself now, realising this MF was in my Registry.
Try This..

Click - Start
Click Run
Type regedit
Click Edit
Click Find
Type qooqlle
It should come up on the right side of the screen.
Delete the pesky MF.

Worked for me after downloading multi MB of anti spy and malware software
Re: how to remove qooqlle hijack bradlai1982 11/12/10 7:12 PM
I am having the same problem....not just Chrome, but also IE and Firefox.


I have tried:

Lava soft Ad-Aware
Avast
AVG 2011
TDSSKiller
Spybot-Search and Destroy.
Malwarebytes Anti-Malware (although this one keeps crashing on me)
SpaywareBlaster
SUPERAntiSpayware Free Edition (It seems to clear up some of the stuff, and helps me block the homepage from changing on IE.  But I use Google Chrome mostly. amnd it still changes my homepage and the defult search engine everytime I restart my PC)


None of them really worked.  Can anybody please help me out?  Thanks!
Re: how to remove qooqlle hijack bradlai1982 11/12/10 7:13 PM
I tried to delete them in the Registry, too...but it keeps coming back.
Re: how to remove qooqlle hijack Ankit Sharma 11/12/10 7:30 PM
@bradlai1982

The culprit will be your hosts file.

C:\Windows\System32\Drivers\etc\hosts

You are being redirected to false Google sites which is your problem:?If you can delete these from the host file

Re: how to remove qooqlle hijack bradlai1982 11/12/10 9:16 PM
Hi Ankit,

I tried your suggestion and delted C:\Windows\System32\Drivers\etc\hosts

But when I restarted my PC, it did the same thing again! :-(
Re: how to remove qooqlle hijack KingOfRome 11/13/10 4:02 AM
Does anybody know how to get rid of this? I tried everything and so far it's the same
Re: how to remove qooqlle hijack reamer 11/14/10 5:16 PM
The last thing i tried (after trying EVERYTHING) was comodo internet security, it seemed to do the trick even though it didn't find anything in the scan, but when i restarted the computer my homepage wasn't qooqlle anymore.  also, try klapersky (i tried several things before restarting)

It seems to me that different solutions work for different pc's, so just try every anti-malware program out there and eventually you should find a cure.
Re: how to remove qooqlle hijack KingOfRome 11/14/10 5:18 PM
i did the system restore feature on windows and I got rid of it
Re: how to remove qooqlle hijack reamer 11/14/10 5:19 PM
http://forum.tip.it/topic/280021-anyone-know-how-to-get-rid-of-qooqlle/ - this forum gave some suggestions.
Re: how to remove qooqlle hijack reamer 11/14/10 5:20 PM
i tried system restore first, after running avg and malware bytes and none of these worked for me. so literally TRY EVERYTHING
Re: how to remove qooqlle hijack KingOfRome 11/14/10 5:23 PM
@reamer I did system restore and worked fine for me... I'm so sorry I can't give you any other ideas :-(  I really thought I would need to format my computer.
Re: how to remove qooqlle hijack reamer 11/14/10 5:31 PM
@KingOfRome No worries man.
Re: how to remove qooqlle hijack neip2000 11/15/10 3:00 AM
I also tried everything.  Editing the registry stopped qooqlle from loading as my home page IE, but didnt' stop qooqlle from coming up when I tried to search from the Chrome adress bar.  Finally, uninstalled Chrome with Revo Uninstaller.  When I reinstalled Chrome, the problem appears to have been solved.
Re: how to remove qooqlle hijack reamer 11/15/10 4:27 AM
@neip2000    I do believe you have the most efficient resolve for the dilemma, as that was one of the things i did before restarting (i repeat i did several things beforehand.) However, the virus/malware/adware-whatever it is may not be completely removed. you never know what it's actually doing to the system because this has happened on multiple browsers. so how can uninstalling/reinstalling one browser fix the problem without uninstalling/reinstalling the other? (i use both google chrome, Mozilla and internet explorer.)

I would like to mention that if anyone can find a way to get any internet security program developers onto this immediately that it would infinitely be the best solution. (it doesn't seem like anyone can fix it PROPERLY because i tried everything and nothing found anything wrong except Comodo. Comodo reported several 'password files')

also, i am intoxicated so excuse the random wording 'n shit'.
Re: how to remove qooqlle hijack Luckhor 11/15/10 6:10 AM
I used Comodo (www.comodo.com) to detect the malware and it did. It detected Heur.Susicious@xxx. After that I used Revo uninstaller  (www.revouninstaller.com) to uninstall Chrome. Restarted the system and then installed Chrome again. So far it worked and IE was also fixed. I think Comodo did the most and probably did not need Revo anymore. Oh I also manually cleaned up the registry file (c:\windows\system32\rededit) by searching for qooqle and deleted the whole folder.

In another forum, some users say that Comodo did not worked for them. This I do not know.

I hope this will help you guys clean this malware up.

P.S. It took Comodo a long time so stopped the Scan after 5 hours but it already detected the malware so I assume no other files or apps where infected.
Re: how to remove qooqlle hijack kyle can fix it 11/15/10 10:09 AM
hi,

a little about me:
============
i have been using and programming and hacking around on computers since the early 1980's.
i do this for friends, family, and as a side job as i work on my electrical engineering degree.
i would say that i have a very very high level of understanding of much of this kind of stuff.

with regards to this QOOQLLE browser homepage / search engine hijack:
===============================================================
i found a more definitive fix. heres what i tried at first

i ran a bunch of scans (ms security essentials, adaware, spybot search & destroy, malware bytes anti-malware, comodo),
deleted all of my temp files with cleanup 4.52, and reset my browsers pages (in chrome, firefox, and internet explorer).

it looked to be gone.

but i would reboot and it would return. qooqlle was my browser homepage and search engine again on all browsers.

**************************************************************************
**************************************************************************
here is how i finally got rid of it

1) ran all the above scans.
2) deleted my temp files with cleanup 4.52

and what i believe to be the most important step:

3) i looked at all of the currently running programs with process explorer, and looked at all of the programs that run at computer startup with msconfig and also with chameleon startup manager. chameleon is like using msconfig, but easier to use

...i also ran hijack this again (i had done this before) everything seemed to be ok.

BUT... looking at everything CLOSELY i discovered

1) a registry entry (which i deleted) that started this program on reboot located here:
hkey_local_machine\software\microsoft\windows\currentversion\run\igfxtraysound

and

2) an offending program called either IGFXTRAY.EXE or IGFXTRAYSOUND.EXE

there is supposedly a valid program named similarly, which is for intel chipset computers -- built in sound or video programs. googling it, it says its the "Intel Integrated Display Adapter component"

but i actually dont use my onboard graphics (intel chipset) and use an added pci express video card instead.

so look in the directory

C:\users\{my user name}\appdata\roaming\igfxtray.exe
(for windows 7 / vista)

C:\documents and settings\{my user name}\application data\igfxtray.exe
(for windows xp)

i made sure it wasnt currently running in the background (checked process explorer and stopped the running process),
deleted it from my hard drive,
restarted my pc,
and the qooqle browser hijacker (hijacking my home page on all 3 browsers) did not return!
**************************************************************************
**************************************************************************

finally, i must make note of my favorite real time process monitoring tools that helped me figure this out.
they dont use very much cpu power, dont slow the computer, and work very well. much less cpu intensive than symantec bloatware, mcafee, or especially avg !

try a combo of these two:
1) adaware. the component of adaware that monitors in realtime is called adwatch live. it  works well and with minimal compute power
2) spybot search and destroy. make sure to enable "teatimer" ("protection of over-all system settings")

hope this helps. it defintely helped me.

cheers,
  kyle.
 
kyle-can-fix-it {at} att {dot} net
kyle-can-fix-it {dot} does-it {dot} net / reviews
Re: how to remove qooqlle hijack Shahmoradi 11/17/10 7:23 AM
"kyle can fix it", Thanks a lot.
Re: how to remove qooqlle hijack drumm3r02 11/22/10 12:11 AM
Hey guys I managed to fix up the whole qooqlle search engine thing.

Just go to the settings button in google chrome (top right corner, under the X button), and click options.

- Under "Default Search" click Manage.
- You'll see that Google (Default) is your default search engine, click on it and then click Edit... on the right.
- In the URL tab, paste this: http://www.google.com.au/#hl=en&safe=off&biw=1366&bih=667&q=%s&aq=f&aqi=&aql=&oq=&gs_rfai=&fp=a12c66f6e0f723f8

Then click OK and exit out of options.

Try searching something up in the search bar and you'll find that you're search engine will be back to Google, and not qooqlle.

hope this helps :)
Re: how to remove qooqlle hijack Tom Scutt 12/11/10 1:29 AM
The version of the Qooqlle hijack I got came with a "codec pack"
I followed Kyle's directions, but the .exes and processes were named differently on my machine... I didn't have igfxtraysound

Instead I found (and deleted) these:

1) a registry entry that started this program on reboot located here:
hkey_local_machine\software\microsoft\windows\currentversion\run\GProton.exe

and

2) an offending program called either GProton.exe

Which you'll find in:

C:\users\{my user name}\appdata\roaming\igfxtray.exe
(for windows 7 / vista)

C:\documents and settings\{my user name}\application data\igfxtray.exe
(for windows xp)

You'll have to kill the process before you can delete the file. My process was called alg.exe - I don't know if this is always what it's called or whether Gproton gives it a random name.

I also found a .scr file (randomly named) and a couple of other files (all created at exactly the same time today) in my application data directory. I deleted those as well as they'd clearly been created on startup.
Re: how to remove qooqlle hijack Net_guy 12/14/10 10:57 PM
I had the problem too.
My solution is:

download StopZilla spyware from www.stopzilla.com it is free

install it

do the scan and repair

uninstall it or keep it if you like
Re: how to remove qooqlle hijack jon_w 12/31/10 10:21 AM
StopZilla didn't stop it I'm sad to say.
Re: how to remove qooqlle hijack GeeTheKing 2/4/11 2:55 AM
Hi everybody!

First, thanks for help.
But i had no the 'igfxtray****' files, but by one day searching i found the evil thing. Its called TunesHelper.exe it is a hidden file, and found in the Docs & Sets dir. I hear this is an Iphone/Ipod file but i dont use any Apple device. I killed this devil, deleted all registry data (searched 'qooqlle' and 'tuneshelper') then problem fixed.
My computer is fully AMD (motherboard chipset, CPU, GPU) i think this is the reason that i had no the igfxtray-something.
I hope this can help somebody.

G.

!qooqlle must die!
Re: how to remove qooqlle hijack nskrynski 2/23/11 8:53 AM
I also got HiJacked by this, it seems that it can install itself with different names. After much searching trying different Virus/Malware programs, I was able to get rid of it by the following:

1. Malware got the qoqlle redir file, I also found the error in the Host file mentioned above and corrected this.
2. I ran MSCONFIG and saw the igfxtray noted above and disabled it.  (This still didn't help me after rebooting)
3. In MSCONFIG I came across 3 other files which I had read about, these being" Readar_sl.exe ", "TunesHelper.exe" (Noted above) and   "Volpanel32".  They are misspellings/misrepresentations of good programs.   I disabled all three of these and things became better after rebooting (no more directing to Qooqlle) yet, I still had traces of "Qooqlle" when searching.  
4. After searching these files I came across a Log which someone posted and I was able to find these items in the registry.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Readar_sl.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\TunesHelper.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\VolPanel32.

I deleted all of these.

I cleaned all files/ temps etc. with CCleaner, uninstall Chrome (Firefox was preloaded and I uninstalled that as well) After rebooting I reinstalled Chrome and all the problems were solved.

I checked IE as well, I had the Omnibox (search) set to google and upon searching again qooqlle resurfaced.  I removed it, cleaned cache etc. and rebooted.  I reinstalled google and it now works fine.  
 
I can't be sure if this will get rid of all traces but maybe a more experienced person could check and offer any other advice of removing any remnants of this program.

I originally got this from a Codec file.  Hope that it helps
Re: how to remove qooqlle hijack olgacv 3/2/11 6:58 AM
I tried kyle's suggestions but i could not find it by that name so i just used malwerbyte's (there is a free version of the program) and i think i got rid of it for good. I hope i've helped.
Re: how to remove qooqlle hijack SirBeaver 4/11/11 4:33 PM
In my case (Intel, 32-bit XP) Comodo found 4 boogies, deleting them didn't really help.

c:\program files\common files\svhost.exe
c:\WINDOWS\system32\wmiprvse.exe
c:\WINDOWS\system32\netsetup.exe|Unsfx|WinXPChk.exe
c:\WINDOWS\system32\dllcache\netsetup.exe|Unsfx|WinXPChk.exe

(Maybe not all are related to this hijack.)
I had to disable them in Chameleon Monitor.
Now everything is fine, thanks for the help!
Re: how to remove qooqlle hijack YoBYoL 6/24/11 1:36 AM
I think malwarebyte's free trial full version worked for me, first try!
Firefox and Explorer both clean in WIN7Home. WOW
Re: how to remove qooqlle hijack peter48a 7/20/11 9:27 AM
It took a few scans and cleanups, and it looks to be gone (have re started several times to verify).

I was using chrome and explorer.

I downloaded the following all free trials: Malwarbytes anti malware, ad aware (by lavasoft), and spy bot search and destroy,

I ran full scans, and deleted the bad items through the 3 programs mentioned above.

I then downloaded and ran "clean up"....which deleted thousands of temp files, without harm.

I also downloaded chameleon start up, and I am not sure if this helped but I deleted ctfmon.exe BUT BE CAREFUL!!...

ctfmon,exe is a windows file, for word processing, upon windows startup...so far no ill effects but, it may be better to just disable it.
Re: how to remove qooqlle hijack peter48a 8/24/11 10:00 AM
The computer is still working very well! 1 month later.
Re: how to remove qooqlle hijack nicolettemcclure04 9/20/11 11:11 AM
You only have one thing to do in order to get rid of "qooqlle" once and for all...
Go to the following website:  http://www.removeonline.com/remove-qooqlle-com-google-redirect-virus/
click on the download for "qooqlle remover" and once that is done, simply follow instructions.
I tried every spyware and manually removed things and did many a scans, to no avail.
This is the only thing that worked.  You do have to pay $39.00 to register it once it has scanned but it is money well spent.
The first time it removed almost everything... when "qooqlle" popped up once more, I went to custom fix on "spynomore" and notified them that it still came up.  They responded within 24 hours when I checked status...(you will see this option on spynomore) and just followed their instructions again... restarting, it automatically scanned and then prompted me to eliminate one more time an infected file.  Again, once you download this software the directions/instructions are very simple to follow... I am so relieved to finally get rid of this nasty virus... :)))))
More topics »