genieknows - browser hijacker

[Guest]

Hi,

I have searched this forum and can't find any mention of the browser
hijacker genieknows. Google searching makes it seem like a good thing, but
when I try to go to Hotmail, or other sites, it returns to this address
(using IE): http://feed.genieknows.com/search/reslp.jsp?q=passport. I
tried blocking cookies, but no good.

Spybot's website tells how to remove it, but the files it mentions are not
showing up on my registry. (CrackedEarth or Search Hook). Running Spybot
says I'm clean.

Please tell me how to remove this. Thanks,

C Kraft

 

[Ramesh, MS-MVP]

Hi Kraft,

Here is some more information:

SpySubtract - Spyware Research Center:
http://www.intermute.com/spysubtract/researchcenter/CrackedEarth.html

 

[Guest]

"Ramesh, MS-MVP" wrote:

Hi Ramesh,

I already tried that site, but no success. There is no SearchHook value in
my registry, nor Cracked Earth. I think it's hiding in my Favorites. IE
opens with Search Companion, which is not normal, and then when I click on My
Favorites, they come up. If I hit Hotmail, the address bar switches to
genieknows and the thing takes over. Even if I type in a new address, it
will go back to genieknows and I can't get to most websites. I did make it
to ebay and it was fine until I tried to search "seller's other items", then
it took over and I couldn't proceed. So far, it hasn't hacked into Mozilla.
Any other thoughts?

Carolyn

 

[Ramesh, MS-MVP]

Carolyn,

I'd suggest you download HijackThis and then post the log file in one of the
following security forums for expert advice. HijackThis is an excellent
anti-hijack tool that lists all the vulnerable points and shows if a malware
has modified the key areas of the system.

Visit http://aumha.org/a/quickfix.php. The quickfix methodology helps in
eliminating most of the malware, but some require user intervention and
examination of the HijackThis log. If that is the case follow step 8. "IF
THERE IS STILL A PROBLEM"

http://forums.aumha.org
http://www.castlecops.com
http://forums.spywareinfo.com

 

[Genieknows]

Hi Carolyn,

I can understand your frustation with this, I have been through the same thing before. I am from Genieknows.com and Genieknows does not support any IE highjacking activities. I have read the comments in the message board and please review this page from crackedearth.com.

http://www.crackedearth.com/remove.html
+---------------------------------------------------------------------------+
Where C is the hard drive letter where your Windows directory is stored (usually C) do the following to remove the CrackedEarth.com Viewer or Internet Enhancer:

Close all open Web Browser applications.

Click the Start button in the Task Bar, select the Run... menu item.

Type in:

(before May 16th 2001)
C:\SearchHook\uninstall.bat

(after May 16th 2001)
C:\CrackedEarth\uninstall.bat

And hit the Enter key.

The CrackedEarth.com Viewer or Internet Enhancer Uninstaller should execute.

(before July 23rd 2001) **Windows 2000 Uninstall**

Run:

C:\CrackedEarth\regsvr32 /s /u searchhook.dll

C:\CrackedEarth\uninstall.bat

+---------------------------------------------------------------------+


If this does not solves your problem let us know and someone from our tech department will try to see how this can be resolved.

Regards,

Mausam Kalra
902-431-4847 ext 112
Genieknows.com