Re: - Yahoo ups the ante, hijacks browsers through Adobe Reader 7

One has to be a bit careful when deleting *everything* in the "Downloaded Objects" file. For instance, doing so could delete the ActiveX control QuickTime needs to display .mov files imbedded in web pages, to name one.


--

Jon R. Kennedy
Charlotte, NC, USA
jkennedy2@xxxxxxxxxxxxxxx

"Amanda Wang [MSFT]" <v-amanwa@xxxxxxxxxxxxxxxxxxxx> wrote in message news:9YyULUAQFHA.1564@xxxxxxxxxxxxxxxxxxxxxxxx 
Hi Mike,

Thanks for your post.

My understanding on this issue is that there is a Yahoo browser hijacker on
your computer and it is through Adobe Reader. Now if you mistype a URL,
instead of the Microsoft error msg suggesting an alternative URL, you get
Yahoo's search engine. If I have misunderstood your concern, please feel
free to let me know.

Based on my experience, you can perform the following steps to remove the
traces of Yahoo search:

Step 1: delete related entries from registry

Note: Before changing the registry, you need to backup the registry first.

1. Start-> Run-> enter "regedit"
2. Go to Edit-> Find-> enter " yahoo"
3. Delete the related entries

Step 2: let's delete all the cookies, temporary files, downloaded objects
and plug-ins to see if it helps.

Deleting Cookies
============

1. Click Start, click Search and click For Files or Folders

2. Type "Cookies" (without the quotation marks) and click Search Now

3. Delete files in the cookie directory

Deleting Temporary Files
==================

1. Open Internet Explorer

2. Click Tools, click Internet Options and click Delete Files button in the
General tab

Deleting Downloaded Objects
=====================

1. Open Internet Explorer

2. Click Tools, click Internet Options and click settings button in the
General tab.

3. Press View Objects.

4. Remove all the Objects there.

Removing Plug-Ins in Internet Explorer
==============================

1. Close all Internet Explorer windows.

2. Open a Windows Explorer window by right Click My Computer and choose
Explore.

3. Locate the following folder:
C:\Program Files\Internet Explorer\PLUGINS

4. Remove all the files in this folder.

If the problem is still exists, please follow these steps to troubleshoot
the issue:

Step 3: Refer to the following article to perform a Clean Boot
======================
310353 - How to Perform a Clean Boot in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310353

The main steps are as following:

Please follow this suggestion to narrow down this problem:

1. Click Start, click Run, and then in the Open box, type "MSCONFIG"
(without the quotation marks). Click OK.

2. In the System Configuration Utility (MSConfig) window, click to select
the Selective Startup button.

3. Click to clear the check mark from the "Load startup items" below
Selective Startup.

4. Click the Services tab, click to check the "Hide All Microsoft Services"
box, and remove all the check marks from the remained Non-Microsoft
Services. *note that please make sure that you do not uncheck the Microsoft
services.

5. Click OK to close the MSConfig window. Click Yes when you are asked to
restart your computer in order to enable the changes.

6. After restarting, please check whether this issue will reoccur.

If this issue does NOT reoccur following the Selective Startup, please
continue these steps to find the exact cause:

1. Click Start, click Run, in the Open box type "MSCONFIG" (without the
quotation marks), and click OK.

2. In the System Configuration Utility (MSConfig) window, click the Startup
tab or the Services tab.

3. Add one check mark at a time to the entries under the Startup tab or the
Services tab, and then restart each time to see if the additional entry
reproduces the original problem.

Step 4: Remove all suspicious items from the registry
===============================
WARNING: Using Registry Editor incorrectly can cause serious problems that
may require you to reinstall Windows. Microsoft cannot guarantee that
problems resulting from the incorrect use of Registry Editor can be solved.
Use Registry Editor at your own risk.

1. Find and delete the following registry key.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects
2. Find and delete the all the sub keys in the following registry key
(don't delete the following registry key).
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension

Step 5: Clean Adware/Spyware
================================
Please download and launch at least two tools below to remove
Adware/Spyware again to make sure that there won't be any Spyware/Adware on
the system. (Please launch these tools under Safe Mode)

Ad-Aware:
http://www.lavasoft.de/software/adaware/

Spybot:
http://www.spykiller.com/index4.asp?ref=2400

HijackThis direct Download:
http://download.softpedia.com:8080/ANTIVIRUS/hijackthis.zip

CWShredder direct Download:
http://209.133.47.200/~merijn/files/CWShredder.exe

Note: The third-party product discussed is manufactured by a vendor
independent of Microsoft; we make no warranty, implied or otherwise,
regarding this product's performance or reliability.

Step 6: Uninstall Acrobat Reader
===========================

You mentioned:

After installing Adobe Reader 7, I noticed it also installed the Yahoo
toolbar.
Yahoo is hijacking browsers through Adobe Reader (Acrobat).

Therefore, if the issue persists after performing the above steps, I
suggest that you uninstall Acrobat Reader and check the issue again.

I understand the steps above may be a little bit complicated and
time-consuming. Please taking your time in trying my suggestions and let me
know the result at you earliest convenience. If anything is unclear, please
feel free to let me know. I will be glad to help.

Thanks & Regards

Amanda Wang[MSFT]

Microsoft Online Partner Support

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
Business-Critical Phone Support (BCPS) provides you with technical phone
support at no charge during critical LAN outages or "business down"
situations. This benefit is available 24 hours a day, 7 days a week to all
Microsoft technology partners in the United States and Canada.

This and other support options are available here:
BCPS:
https://partner.microsoft.com/US/technicalsupport/supportoverview/40010469
Others: https://partner.microsoft.com/US/technicalsupport/supportoverview/

If you are outside the United States, please visit our International
Support page:
http://support.microsoft.com/default.aspx?scid=%2finternational.aspx.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.


.

Loading