Well, a temporary solution... a workaround. (or not)
Add this Youtube downloader to your Firefox browser, and it will block attempts by the Iliviid searqu malware to hijack your browser. It wont destroy the virus, but at least you can have some peace while you're finding a way to permanently kill it.
youtubedownloadersite.com
It seems to protect at least some major browsers from being hijacked.
And it's quite a useful piece of free software, too.
Jan 2012.
Not sure that was what was blocking it... I think it may have been one of the other programs I installed. I've disabled and removed just about everything including Glary Utilities (which, as it turned out, had malware in it too - I've emailed Glary so they can fix this problem but as yet have had no reply) and the searqu virus has not raised its ugly head again for the last couple of weeks.
I visited the Ilivid Facebook page last night - it seems they're having difficulty removing the sometimes very nasty comments that keep appearing there.
Showing posts with label malware. Show all posts
Showing posts with label malware. Show all posts
Wednesday, December 28, 2011
Sunday, December 18, 2011
Ilivid makes me livid
Wrote the following to Google tonight:
"The advert is for ilivid browser plugin. This plugin is malware and is responsible for many thousands of infections. Google 'ilivid malware', 'searchqu'. Go to http://bentinck.blogspot.com/search/label/malware for more information."
I found the advert on paint.net.
Sunday, November 6, 2011
Searchqudtx.dll Virus
More information...
This is what I found in IE today:
Name: Searchqu Toolbar
Publisher: Control name is not available
Type: Browser Helper Object
Version: Not available
File date:
Date last accessed: Today, 6 November 2011, 2 minutes ago
Class ID: {99079A25-328F-4BD4-BE04-00955ACAA0A7}
Use count: 7
Block count: 1370
File: searchqudtx.dll
Folder: C:\PROGRA~1\WI371A~1\Datamngr\ToolBar
I went down 9 levels in C:\Programs and could not find the blighter with Xtree. Windows Explorer seach could not find anything for searchqu either.
This is what I found in IE today:
Name: Searchqu Toolbar
Publisher: Control name is not available
Type: Browser Helper Object
Version: Not available
File date:
Date last accessed: Today, 6 November 2011, 2 minutes ago
Class ID: {99079A25-328F-4BD4-BE04-00955ACAA0A7}
Use count: 7
Block count: 1370
File: searchqudtx.dll
Folder: C:\PROGRA~1\WI371A~1\Datamngr\ToolBar
I went down 9 levels in C:\Programs and could not find the blighter with Xtree. Windows Explorer seach could not find anything for searchqu either.
Sunday, October 23, 2011
Searchqu Malware Virus
My computer is infested with searchqu malware
It's not a virus, it hijacks browsers such as Internet Explorer, Firefox and Google Chrome
whois search for searchqu.com
Registrar: GODADDY.COM, INC.
Whois Server: whois.godaddy.com
Name Servers:
dns.netvision.net.il
nypop.netvision.net.il
whois search for netvision.net.il
person: Liora Barak
address: Netvision Ltd
address: Omega Center , Matam
address: Haifa
address: 31905
address: Israel
phone: 04-8560600 (answering service)
fax-no: 04-8551004
e-mail: registrar@netvision.net.il
person: Wide Area Network Group
address: NetVision - Israeli ISP
address: Advanced Technology Center Haifa, 31905, send SPAM and ABUSE complaints to abuse AT netvision.net.il
address: as above
phone: 04 8560 634 (not connected)
Main Office013 Netvision
15 Hamelacha St., Rosh Ha’ayin 48091
Fax: 972-3-9001113
Omega Center, Matam Haifa 31905
Tel: 972-4-8560660 Fax: 972-3-5201960 SalesTel: 1-800-013-013
customer service Tel: 972-4-8560660 Fax: 972-3-5201960
service@netvision013.net.il
Support Tel: 972-4-8560570
Spokesperson Dana Friedman
Telephone: + 972 3 9001861 (leave message)
Cell: 972 52 3133300
E-mail: dana@013netvision.co.il
Several phone calls to Dana Friedman's landline have not been returned, and she has not responded to mobile calls either.
Searchqu.com is owned and operated by Bandoo, Inc.
e-mail: privacy@searchqu.com
Postal: Bandoo, Inc., Attention: Privacy Policy Administrator, 40 kimonos st.3095 Limassol, Cyprus
................
The scumware installed by ilivid is very difficult to remove, if you believe the hundreds of forum posts on the subject. I have run both Malwarebytes and another removal tool which both picked up trojans and trackers, but so far nothing will remove Searchqu - it just keeps coming back.
Here's a post I've not yet tried:
http://www.malwareremoval.com/forum/viewtopic.php?f=12&t=57145
.........
Not directly related, an article about suing malware distributors:
http://www.mediapost.com/publications/article/113850/microsoft-sues-malware-distributors.html
.........
On my XP machine I found an entry in Program Files/searchcore for browsers and ran the uninstall.exe, then deleted the remaining dlls and directories. I then uninstalled all mention of the scumware from IE again. 24 hours later, so far, so good.
....
Several days later, it's back.
Searchqu on Wikipedia
http://en.wikipedia.org/wiki/Searchqu
.........
Removing Searchqu from Google Chrome
Step 1. Press ctrl+shift+del in Chrome, and clear your private data, cookies etc
Step 2. Click on Tools (the spanner icon, top right) > Options > Basics then click the Manage Search Engines button. If the nasty is in there, remove it by clicking X on the right side when you highlight it. It will probably have a name like Web Search.
.........
Hard to believe, but this scumware is distributed not only by shady fly-by-night software sites, but also by some of the largest and ostenibly most trustworthy around, including cnet, which, to its credit, displays numerous negative review which say ie ""DANGER DO NOT INSTALL"
.........
Postscript Dec 2011
I posted something about Ilivid, searchqu and malware on Wikipedia. It was deleted with a warning indicating it was rather naughty to say whatever I said. Can't have been very complimentary!
It's not a virus, it hijacks browsers such as Internet Explorer, Firefox and Google Chrome
whois search for searchqu.com
Registrar: GODADDY.COM, INC.
Whois Server: whois.godaddy.com
Name Servers:
dns.netvision.net.il
nypop.netvision.net.il
whois search for netvision.net.il
person: Liora Barak
address: Netvision Ltd
address: Omega Center , Matam
address: Haifa
address: 31905
address: Israel
phone: 04-8560600 (answering service)
fax-no: 04-8551004
e-mail: registrar@netvision.net.il
person: Wide Area Network Group
address: NetVision - Israeli ISP
address: Advanced Technology Center Haifa, 31905, send SPAM and ABUSE complaints to abuse AT netvision.net.il
address: as above
phone: 04 8560 634 (not connected)
Main Office013 Netvision
15 Hamelacha St., Rosh Ha’ayin 48091
Fax: 972-3-9001113
Omega Center, Matam Haifa 31905
Tel: 972-4-8560660 Fax: 972-3-5201960 SalesTel: 1-800-013-013
customer service Tel: 972-4-8560660 Fax: 972-3-5201960
service@netvision013.net.il
Support Tel: 972-4-8560570
Spokesperson Dana Friedman
Telephone: + 972 3 9001861 (leave message)
Cell: 972 52 3133300
E-mail: dana@013netvision.co.il
Several phone calls to Dana Friedman's landline have not been returned, and she has not responded to mobile calls either.
Searchqu.com is owned and operated by Bandoo, Inc.
e-mail: privacy@searchqu.com
Postal: Bandoo, Inc., Attention: Privacy Policy Administrator, 40 kimonos st.3095 Limassol, Cyprus
................
The scumware installed by ilivid is very difficult to remove, if you believe the hundreds of forum posts on the subject. I have run both Malwarebytes and another removal tool which both picked up trojans and trackers, but so far nothing will remove Searchqu - it just keeps coming back.
Here's a post I've not yet tried:
http://www.malwareremoval.com/forum/viewtopic.php?f=12&t=57145
.........
Not directly related, an article about suing malware distributors:
http://www.mediapost.com/publications/article/113850/microsoft-sues-malware-distributors.html
.........
On my XP machine I found an entry in Program Files/searchcore for browsers and ran the uninstall.exe, then deleted the remaining dlls and directories. I then uninstalled all mention of the scumware from IE again. 24 hours later, so far, so good.
....
Several days later, it's back.
Searchqu on Wikipedia
http://en.wikipedia.org/wiki/Searchqu
.........
Removing Searchqu from Google Chrome
Step 1. Press ctrl+shift+del in Chrome, and clear your private data, cookies etc
Step 2. Click on Tools (the spanner icon, top right) > Options > Basics then click the Manage Search Engines button. If the nasty is in there, remove it by clicking X on the right side when you highlight it. It will probably have a name like Web Search.
.........
Hard to believe, but this scumware is distributed not only by shady fly-by-night software sites, but also by some of the largest and ostenibly most trustworthy around, including cnet, which, to its credit, displays numerous negative review which say ie ""DANGER DO NOT INSTALL"
.........
Postscript Dec 2011
I posted something about Ilivid, searchqu and malware on Wikipedia. It was deleted with a warning indicating it was rather naughty to say whatever I said. Can't have been very complimentary!
Subscribe to:
Posts (Atom)