• Content
  • Comments (4)
  • Related articles
Nov
19
2012

How to remove redirect to www.v9.com in Firefox browser Monday, 19 November 2012

Suddenly, out of nowhere i got redirects to http://www.v9.com/ on all favorites links under Mozilla Firefox. After several minutes of checking everything even if Kaspesky Internet Security did not report anything unusual i finally managed to descover that in Add-ons tab > Extensions it was a new extension: PROXY Tool 1.0.1 by V9GDP. After removing this add-on and browser restart everything returned to normal. In any case the point is that the malware is disguised under that addon, while most guides say “find anything related to search-results redirect and click remove button”. It may be the case that you can not open addons page, in this case, open a new tab and type in address bar [about:addons].

 

For Internet Explorer just disable de addon named [ Proxy Help ] in Tools > Manage Add-ons > Toolbars and Extensions. If is not there make sure you select [ Show: All add-ons ]. To permanently remove tha add-on locate and delete de [ Newtabs_v9.dll ] file.

 

Name: Proxy Help
Publisher: Beijing ELEX Technology Co.,Ltd
Type: Browser Helper Object
Version: 1.0.0.1
File date:
Date last accessed: 30 ‎noiembrie ‎2012, ‏‎12:20
Class ID: {F386E548-C533-472E-8C61-C026FB14FEA9}
Use count: 5
Block count: 2
File:  Newtabs_v9.dllOriginal filename: Newtabs.dll
Folder: C:\Windows\SysWOW64\Newtabs_v9.dll

 

4 Comments

  1. karen says:

    i always check my extensions in chrome or add-ons each time my browser up-date them selfs or when i do the updating from the browsers.

    today when i checked for updates in my FF browser, it upgraded to FF 17.0.
    but before that , yesterday i noticed that when i clicked on a new tab in my google chrome (ya i like to play with other browsers),
    it looked just like the screen shots that you provided here.

    but any ways i noticed that after FF updated that the “PROXY Tool 1.0.1 by V9GDP” was installed with out my say so, so i removed it , like how you said to here . then i went to my google chrome and noticed also that it was installed in my list of extensions , but the name on it was just “PROXY Tool 1.0.1″ , and the creator name was goofy looking , now i’m wondering if this tool is istalled in my IE 8.

    so what now ?, any advice ?. i will save this link to this post of yours

    • Q says:

      For IE8 you have Tools > Manage Add-ons … check every Addon type, see if is something there, but is not mandatory to have it in IE too. Anyway thanks for your confirmation, now is crystal clear that the malware is hidden under PROXY named addon no matter what browser is used. I even checked on Firefox > Get Add-ons to see if there is such addon there to download / install. I found nothing with some name and same author.

      • Karen says:

        its me again, here is an update of what else i had to do to get rid of it . it was also in my IE browser, but it was under a different name , i went to IE, click on manage add-on’s , then i went and looked and the name it called it self .
        this part is a copy and past .
        —–
        Proxy Help
        Publisher: Beijing ELEX Technology Co.,Ltd
        Type: Browser Helper Object
        Version: 1.0.0.1
        File date:
        Date last accessed: Today, November 20, 2012, 4 minutes ago
        Class ID: {F386E548-C533-472E-8C61-C026FB14FEA9}
        Use count: 1
        Block count: 2
        File: Newtabs_v9.dll
        Folder: C:\WINDOWS\system32
        —————–

        i then had to disable it in IE, cuz i could not just remove it, strange, so then i went to my add and remove software , there was a program listed there named “newtabs uninstall” . so i hit the un-install button ,

        then as a last step(so i hope) i used this program “MalWare bytes Anti-maleware” it found 5 items , so i had it remove it , then i had to restart my pc, i did another scan with the same program and then it found nothing, i then used spybot search and distroy, and it found nothing .
        the only last thing i can use and i might do this later , is a program called “HitMan Pro”
        http://www.surfright.nl/en/home/

        well thats all for now …… i have one question, how did it get on my PC in the first place ?.

Post a Comment

Your email is never published nor shared. Required fields are marked *

*
*

Sorry but there are no similar articles at this time.