Translate into:
(Hint: Use 'j' and 'k' keys to move up and down)
A woman wears a mask as she does her morning exercise outdoors in Fuyang, Anhui province, Jan. 14, 2013. China's environmental watchdog has ordered greater efforts to issue early warnings for air quality. (China Daily/Reuters)
Window cleaners hang from the side of a building on an extremely hazy day in Beijing Oct. 26, 2012. China's heavily polluted capital plans to reduce air pollution levels by 15 percent by 2015 and 30 percent by 2020 by phasing out old cars, relocating factories and planting new forests. (David Gray/Reuters)
Smoking chimneys and the cooling tower of a coal-burning plant stand next to electric pylons on a hazy day in Wuhan, Hubei province, Dec. 6, 2012. China will spend 350 billion yuan ($56 billion) by 2015 to curb air pollution in major cities. (Reuters)
A laborer works atop a building in Hefei on a hazy day, Anhui province, Jan. 14, 2013. Chinese media reports the government had to take urgent action to tackle air pollution. (Reuters)
Vehicles drive on the Third Ring Road on a very hazy winter day in Beijing, Jan. 12, 2013. Microscopic pollutant particles in the air have killed some 8,600 people prematurely in 2012 and cost $1 billion in economic losses in four Chinese cities, according to a study by Beijing University and Greenpeace. (Jason Lee/Reuters)
Vehicles run slowly in heavy fog in Hefei, central China's Anhui province, Jan. 14, 2013. Shares in a Chinese face mask manufacturer soared on January 15 as investors looked for opportunities to cash in on the severe air pollution that has blanketed large swathes of China. (AFP/Getty Images)
A woman helps adjust a mask for her friend outside an amusement park on a hazy day in Beijing, Jan. 12, 2013. Air pollution levels in China's notoriously dirty capital were at dangerous levels, with cloudy skies blocking visibility and warnings issued for people to remain indoors. (Alexander F. Yuan/Associated Press)
A woman checks her phone during polluted weather in Beijing, Jan. 13, 2013. Dense smog shrouded Beijing, with pollution at hazardous levels for a second day and residents were advised to stay indoors. (Ed Jones/AFP/Getty Images)
A woman waits for a bus in Beijing, Jan. 15, 2013. Public anger in China at dangerous levels of air pollution, which blanketed Beijing in acrid smog, spread as state media queried official transparency and the nation's breakneck speed of development. (Ed Jones/AFP/Getty Images)
Buildings are shrouded in haze as pedestrians walk across a bridge above a main road in central Beijing Oct. 27, 2012. China's heavily polluted capital plans to reduce air pollution levels by 15 percent by 2015 and 30 percent by 2020 by phasing out old cars, relocating factories and planting new forests. (David Gray/Reuters)
Cars run on an elevated road as buildings in the background are covered in haze, Beijing, China, Jan. 15, 2013. A succession of heavily polluted days hit Beijing, prompting the government to issue a first-ever orange warning. Heavy pollution and poor visibility led to the cancelation of flights, and several schools banned all outdoor activities. Air quality improved from 'dangerous' to 'unhealthy' on a sixth day of thick, grey skies that limited visibility and sent people to hospital with breathing difficulties. (Diego Azubel/EPA)
A parking attendant stands on a roadside during severe pollution in Beijing, Jan. 12, 2013. Air quality data released via the US embassy twitter feed recorded air quality index levels so hazardous that they were 'Beyond Index'. (Ed Jones/AFP/Getty Images)
A man rides in heavy fog in Hefei, central China's Anhui province Jan. 14, 2013. Shares in a Chinese face mask manufacturer soared on January 15 as investors looked for opportunities to cash in on the severe air pollution that has blanketed large swathes of China. (AFP/Getty Images)
A man on a street on a hazy winter day in central Beijing, Jan. 13, 2013. Air quality in Beijing was the "worst on record", according to environmentalists, as the city's pollution monitoring centre warned residents to stay indoors with pollution 30-45 times above recommended safety levels. (Petar Kujundzic/Reuters)
A man walks along trees on a heavy hazy winter day in central Beijing, Jan. 12, 2013. Microscopic pollutant particles in the air have killed some 8,600 people prematurely in 2012 and cost $1 billion in economic losses in four Chinese cities, according to a study by Beijing University and Greenpeace. (Jason Lee/Reuters)
Traffic gridlock in Hong Kong, Dec. 5, 2012.
Asia is facing epic air pollution and likely to see more than 800,000 people in the region die each year due to exposure to bad air, an environmental group warned. (Philippe Lopez/AFP/Getty Images)
Local residents face a fifth day of heavy smog in Beijing, China, Jan. 14, 2013. Extreme air pollution, well into the range deemed hazardous by both international and newly implemented domestic standards has led to cancelled flights, closed factories and new restrictions on government use of cars.
(Adrian Bradshaw/EPA)
A teacher leads her students in exercise during a break in a classroom on a foggy day in Jinan, Shandong province, Jan. 14, 2013. Heavy fog enveloped a large swathe of east and central China, with the city's residents being advised to stay indoors to avoid the heavily polluted air. (China Daily/Reuters)
Students exercise in a classroom building on a foggy day in Jinan, Shandong province, Jan. 14, 2013. Residents of the area were advised to stay indoors to avoid the heavily polluted air. (China Daily/Reuters)
Friends relax in Tai Mo Shan Country Park in the New Territories, in Hong Kong, China, Nov. 4, 2012. Tai Mo Shan is the highest peak in Hong Kong, with an altitude of 957 meters above the sea level. Despite a very high population density, pollution and other environmental issues common to modern big cities, three-quarters of Hong Kong is countryside.
(Jerome Favre/EPA)
Xuanwu Lake under heavy fog in Nanjing, east China's Jiangsu province on Jan. 14, 2013, and the same view taken during non-polluted weather, March 31, 2012. (AFP/Getty Images)
Heavy smoke from chimneys in Wangjing community, Beijing, Jan. 14, 2013. (AFP/Getty Images)
A farmer turns soil to plant crops as chimneys from the huge state-owned lead smelter are visible behind him in the town of Tianying, Anhui Province, Nov. 19, 2012.
In ramshackle semi-industrial Tianying, a state-owned lead smelter and foundry sits at the centre of town, behind high walls and secure gates that make it look more like a prison than the mainstay of the local economy. (David Gray/Reuters)
A chimney within the grounds of the huge state-owned lead smelter in the town of Tianying, Anhui Province, Nov. 19, 2012. Decades of pollution from it and similar plants - Tianying once accounted for half of China's total lead output - has made much of the town's land uninhabitable and its water undrinkable. (David Gray/Reuters)
Residents plant trees, in an attempt to rejuvenate the soil, in front of the huge state-owned lead smelter in the town of Tianying, Nov. 19, 2012.
(David Gray/Reuters)
A Chinese protester holds up a banner which reads "PX get out of Ningbo, get out of China" as they march in Zhejiang province's Ningbo city, protesting the proposed expansion of a petrochemical factory, Oct. 28, 2012. (AP Photo/Ng Han Guan)
A woman rides past old fishing boats on her motorcycle in Qingdao city, Shandong province, China, May 14, 2012. Reports state that excessive fishing, ocean pollution and the high price of diesel have caused a sharp decline in fishery resources, nearly paralyzing the industry in East China.
(Wu Hong/EPA)
Chinese villager, Wang Xiuzhen, 54, of Xiangnan Village shows her dust covered hands from the thick dust particles that permeate her home originating from a nearby chemical plant in Zekou Town, Qianjiang City of Hubei Province, China, Jan. 14 2013. Wang says her home is always covered in dust no matter how often she cleans. She suffers from heart and breathing problems due to the pollution from the chemical plant that is just separated from the village by a narrow river. Villagers in a small town of Hubei Province have been grappling with severe air, water and noise pollution on a daily basis over the past two years. (How Hwee Young/EPA)
Thick grime and dust, a result of pollution from a nearby chemical plant, covers the window panes of a house as a villager of Xiangnan Village cooks in her home in Zekou Town, Jan. 15, 2013.
China's Xinhua news reported Jan. 4, 2013 that more than 60 cancer deaths in various villages of Zekou Town have been caused by the heavy pollution from the chemical industry park nearby. (How Hwee Young/ EPA)
Li Wuyi, of Xiangnan Village, cares for her husband Xie Xianwen, who has lung cancer in the terminal stages in their home, Jan. 14, 2013. She believes his cancer was caused by the pollution from the chemical plant nearby and now he can't even rest properly as constant noise pollution from the factories deprive him of sleep. (How Hwee Young/EPA)
Xie Pingying, of Xiangnan Village, covers her ears from the noise pollution caused by a chemical plant just outside their village in Zekou Town, Qianjiang City, Jan. 14,
2013. Xie says the constant noise from the chemical plant causes her immense stress and that she also suffers from heart, throat and eye problems due to the pollution. More than 20 chemical plants were built around the villages of Dongtan, Xiangnan, Zhoutan, Sunguai, Qingnian and others over the past two years resulting in huge increases in noise, air and water pollution. (How Hwee Young/EPA)
He Cai-er of Xiangnan Village, who suffered a cerebral infarction, which she believes was caused by pollution from a nearby chemical plant, behind her CT scans at home in Zekou Town, Qianjiang City, Jan. 15, 2013. Many villagers in the area complain of intensifying respiratory, heart, skin and circulatory illnesses caused by the pollution and a large spike in cancer diagnoses and deaths since the factories were built. (How Hwee Young/ EPA)
Dong Chongxin, of Dongtan Village, washes lotus roots in a polluted river across from the Jinhuarun Chemical Industry plant in Zekou Town, Qianjiang City of Hubei Province, China, Jan. 15, 2013. Dong used to breed fish in fishing ponds by the river but now the water is so polluted from discharge from the chemical plant that all the fish have died and the ponds are now just muddy swamps where only lotus roots will grow. (How Hwee Young/EPA)
A Chinese villager of Xiangnan Village wipes dust from a picture frame of his grandson who has been sent away from the village to escape the pollution from nearby chemical plants,
Jan. 15, 2013. (How Hwee Young/EPA)
Wang Xinyu, of Xiangnan Village, walks home with an empty basket because produce from area farmland is adversely affected by pollution from a nearby chemical plant in Zekou Town, Jan. 14,
2013. Many villagers complain of intensifying respiratory, heart, skin and circulatory illnesses caused by the pollution in addition to a large spike in cancer diagnoses and deaths since the factories were built. (How Hwee Young/EPA)
Diseased vegetables, due to pollution from the nearby Jinhuarun Chemical Industry plant, at a farm in Hannan Village, Jan. 14, 2013. Villagers in a small town of Hubei Province have been grappling with severe air, water and noise pollution on a daily basis over the past two years. (How Hwee Young/EPA)
Dried meats hang outside the Jinhuarun Chemical Industry plant in an industrial park in Zekou Town, Qianjiang City of Hubei Province, Jan. 14, 2013. In addition to the negative effects on food crops, many villagers complain of intensifying respiratory, heart, skin and circulatory illnesses caused by the pollution. (How Hwee Young/EPA)
A villager from Dongtan Village displays cotton grown from polluted fields caused by a nearby chemical plant in their village and normal cotton grown outside of the village in Zekou Town, Jan. 14, 2013. (How Hwee Young/EPA)
People walk past Jinhuarun Chemical Industry plant in Zekou Town, Jan. 14, 2013. More than 20 chemical plants were built around the villages of Dongtan, Xiangnan, Zhoutan, Sunguai, Qingnian and others over the past two years resulting in huge increases in noise, air and water pollution. (How Hwee Young/EPA)
Chinese villager, Dong Wuyong, of Dongtan Village, suffers from a skin rash on her face that has become more serious over the years due to pollution from a nearby chemical plant in Zekou Town, Qianjiang City, Jan. 15,
2013. (How Hwee Young/EPA)
Chinese villager, Dong Aicun, of Dongtan Village, adjusts flowers by the grave of her mother, Huang Hongmei, who died from throat cancer last year in Zekou Town, Qianjiang City, Jan. 15, 2013. (How Hwee Young/EPA)
Workers clean the heavily polluted Nanming River in Guiyang, southwest China's Guizhou province, Nov. 17, 2012.
China will start assessing the "social risk" of major projects, after anti-pollution protests forced a series of industrial ventures to be cancelled. (AFP/Getty Images)
Workers clean the heavily polluted Nanming River in Guiyang, southwest China's Guizhou province. (AFP/Getty Images)
Chinese anti-riot police outside the city government office in Zhejiang province's Ningbo city, Oct. 28, 2012, where residents had gathered to protest the proposed expansion of a petrochemical factory. Thousands of protesters marched, shouting for fellow citizens to join them in demanding that the government halt the expansion of a petrochemical factory because of pollution fears. (Ng Han Guan/Associated Press)
Chinese anti-riot police form a barrier outside the city government office in Zhejiang province's Ningbo city, where residents had gathered to protest the proposed expansion of a petrochemical factory, Oct. 28, 2012. (Ng Han Guan/Associated Press)
Protesters hold up a defaced picture of the Ningbo city mayor, Liu Qi, outside the city government office in Zhejiang province's Ningbo city, Oct. 28, 2012, where residents had gathered to protest the proposed expansion of a petrochemical factory fearing the worst for its negative effects on the environment. (Ng Han Guan/Associated Press)
- NYTimes.com
- NYTimes.com
- NYTimes.com
- guardian.co.uk
- guardian.co.uk
You can read all 0 archived comments .
0 comments so far...
Boston Globe Media Partners, LLChttp ://ww.yujiang123456,hanbang.org.cn:81为什么进不去啊_百度知道
http ://ww.yujiang123456,hanbang.org.cn:81为什么进不去啊
我有更好的答案
我也进不去.听老师说有很多家长都进去了.但是我尝试了很多台电脑都进不去.
怎么进不去呢
肯定有毒了吧！
其他1条回答
为您推荐：
其他类似问题
org的相关知识
换一换
回答问题，赢新手礼包
个人、企业类
违法有害信息,请在下方选择后提交
色情、暴力
我们会通过消息、邮箱等方式尽快将举报结果通知您。Firefox hijacked by hao123
Support Forum
This thread was closed and archived.
14 replies
have this problem
30708 views
7/21/14, 8:48 PM
Everytime i open firefox which defaulted to , it prompted
instead, I've use malware tools and other solution provided on internet but none of that work, please assist
Everytime i open firefox which defaulted to google.com, it prompted http://www.hao123.com/?tn=_hao_pg instead, I've use malware tools and other solution provided on internet but none of that work, please assist
Chosen solution
Scan with Latest TDSSKiller. But it returns 0 threat. I ve tried a lot of malware/adware detect tools, non of them really fixed the hijacking.
Then I manually scaned machine with SysInternal's Autorun(thanks's jscher2000's reminder), and deleted a lot of unwanted entries. One of them named "QVOD Shenzhen" in preload dll tab looks suspicious. It is in user\appdata folder.
Can't delete that dll directly, so I renamed it to another name, then deleted the dll entry from AutoRun, and rebooted to F8 safe mode to delete the dll.
[Note: if not delete the entry, the dll will be loaded in safe mode. hence prevent from deleting the dll.
That explains why homepage was hijacked in windows safe mode]
rebooted to normal mode, both IE and Firefox's home pages are back to blank. that means the clean up works !
So the temp solution is to
1. try to reset home page through regular way.
2. if 1 failes, try to create a BAT file to point to firefox
3. if 2 works, then it is a shortcut hijacking
4. run TDSSKiller to see any infestation
5. if TDSSkill returns 0 threat,
try to locate "qvod" dll in Appdata folder
6. run AutoRun to find any "qvod" related entries and delete
7. reboot to F8 safe mode to delete the dll.
[Note: uninstall qvod won't solve the hao-123 page hijacking]
Additional System Details
Installed Plug-ins
The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
Shockwave Flash 14.0 r0
QvodInsert
YunWebDetect
Google Update
QvodShareModule
Adobe PDF Plug-In For Firefox and Netscape 10.1.10
5.1.20513.0
RealJukebox Netscape Plugin
RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In
RealPlayer(tm) HTML5VideoShim Plug-In
RealPlayer(tm) LiveConnect-Enabled Plug-In
RealPlayer Download Plugin
Next Generation Java Plug-in 1.6.0_32 for Mozilla browsers
NPRuntime Script Plug-in Library for Java(TM) Deploy
The plug-in allows you to open and edit files using Microsoft Office applications
Office Authorization plug-in for NPAPI browsers
Application
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/ Firefox/30.0
More Information
Top 10 Contributor
7298 solutions
59418 answers
Is this site listed as your home page in the Options dialog? If it is, can you successfully change it or does Firefox not allow you to change it?
If Firefox will not allow you to change it, check the Windows Control Panel, Uninstall a Program, for something named SearchProtect and remove it.
If Firefox will allow you to change it, do you get the correct home page when you use either of these:
Click the home icon on the toolbar
Open a new window (Ctrl+n)
If you get the wrong page, it's probably an add-on. More on that in a second message.
If you get the right page, that's good. If it changes back after the next time you exit and restart Firefox, check this article:
(especially the part about a user.js file).
If the home page setting was correct and the home icon works fine, but the desktop icon still gives you the bad page, check to make sure your icon wasn't modified. Right-click the shortcut, choose Properties, and the Shortcut tab. The "Target" should be the following, no more, no less (for 64-bit Windows):
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
Is this site listed as your home page in the Options dialog? If it is, can you successfully change it or does Firefox not allow you to change it?
* [[Startup, home page and download settings]]
If Firefox will not allow you to change it, check the Windows Control Panel, Uninstall a Program, for something named SearchProtect and remove it.
If Firefox will allow you to change it, do you get the correct home page when you use either of these:
* Click the home icon on the toolbar
* Open a new window (Ctrl+n)
If you get the wrong page, it's probably an add-on. More on that in a second message.
If you get the right page, that's good. If it changes back after the next time you exit and restart Firefox, check this article: [[How to fix preferences that won't save]] (especially the part about a user.js file).
If the home page setting was correct and the home icon works fine, but the desktop icon still gives you the bad page, check to make sure your icon wasn't modified. Right-click the shortcut, choose Properties, and the Shortcut tab. The "Target" should be the following, no more, no less (for 64-bit Windows):
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
Top 10 Contributor
7298 solutions
59418 answers
Bad extensions often are installed externally to Firefox. I suggest starting here:
Open the Windows Control Panel, Uninstall a Program. Click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. Take out as much trash as possible here.
Then, in Firefox, open the Add-ons page using either:
Ctrl+Shift+a
"3-bar" menu button (or Tools menu) & Add-ons
In the left column, click Extensions. Then, if in doubt, disable (or Remove, if possible) unrecognized and unwanted extensions.
Often a link will appear above at least one disabled extension to restart Firefox. You can complete your work on the tab and click one of the links as the last step.
Finally, you can "mop up" remaining issues with the scanning/cleaning tools listed in our support article: .
Are you able to get control of your home page?
Bad extensions often are installed externally to Firefox. I suggest starting here:
Open the Windows '''Control Panel''', Uninstall a Program. Click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. Take out as much trash as possible here.
Then, in Firefox, open the '''Add-ons page''' using either:
* Ctrl+Shift+a
* "3-bar" menu button (or Tools menu) & Add-ons
In the left column, click Extensions. Then, if in doubt, disable (or Remove, if possible) unrecognized and unwanted extensions.
Often a link will appear above at least one disabled extension to restart Firefox. You can complete your work on the tab and click one of the links as the last step.
Finally, you can "mop up" remaining issues with the scanning/cleaning tools listed in our support article: [[Troubleshoot Firefox issues caused by malware]].
Are you able to get control of your home page?
Top 10 Contributor
16256 solutions
146724 answers
http://malwaretips.com/blogs/remove-hao123-virus/
1 solutions
Helpful Reply
After removing all add-ons and extensions in firefox, seting the history to "no remember history" and homepage to "blank". hao123 is still hijacking homepage.
After reseting Firefox in "help" menu, Firefox auto starts with clean homepage. But is hijacked again after normal exit of Firefox.
Reinstall Firefox doesn't help.
Enter Windows safe mode (without network). still seeing hao123 in the startup address. of cause, it can't display wihout network. But address bar's hao123 url, indicates that the homepage is hijacked.
Looking at the Firefox -General tab,
the homepage textbox is blank and " history" is "never remember".
IE also gets infested too. but Google chrome remains untouched.
All malware adware detectors don't find this virus. No "hao123-client", "search protected", "conduit" or "qvod" is found on machine. Regist Table, hardware virtual drivers, services are manually scaned and reviewed. Which indicated "hao123" has improved its hijack methods.
Hao123 hijack is different this time. I guess hao123 hijacks home page via modifying "last closing session URL" and "start with last session " function in Firefox.
Just guessing.
I need some hints to remove this bad bug.
Thanks in advance
After removing all add-ons and extensions in firefox, seting the history to "no remember history" and homepage to "blank". hao123 is still hijacking homepage.
After reseting Firefox in "help" menu, Firefox auto starts with clean homepage. But is hijacked again after normal exit of Firefox.
'''Reinstall '''Firefox doesn't help.
Enter Windows '''safe mode '''(without network). still seeing hao123 in the startup address. of cause, it can't display wihout network. But address bar's hao123 url, indicates that the homepage is hijacked.
Looking at the Firefox -General tab,
the homepage textbox is blank and " history" is "never remember".
IE also gets infested too. but Google chrome remains untouched.
All '''malware adware detectors '''don't find this virus. No "hao123-client", "search protected", "conduit" or "qvod" is found on machine. Regist Table, hardware virtual drivers, services are manually scaned and reviewed. Which indicated "hao123" has improved its hijack methods.
Hao123 hijack is different this time. I guess hao123 hijacks home page via modifying "last closing session URL" and "start with last session " function in Firefox.
Just guessing.
I need some hints to remove this bad bug.
Thanks in advance
Top 10 Contributor
7298 solutions
59418 answers
Hi hao123infested, could you test:
Click Home icon or Press Alt+Home or Ctrl+n Keyboard Shortcuts
This should load the home page set in Options. Do you get the correct home page or the unwanted home page?
(A) Correct
Your Firefox shortcut may be hijacked. right-click it and check its Properties to make sure the unwanted URL is not included in the Target (this is set on the Shortcut tab).
(B) Unwanted
You may have a self-hiding extension or hijacked connection setting.
(1) Self-hiding extensions are visible in Firefox's Safe Mode. That's a standard diagnostic tool to deactivate extensions and some advanced features of Firefox. More info: .
You can restart Firefox in Safe Mode using either:
"3-bar" menu button & "?" button & Restart with Add-ons Disabled
Help menu & Restart with Add-ons Disabled
Not all add-ons are disabled: Flash and other plugins still run
After Firefox shuts down, a small dialog should appear. Click "Start in Safe Mode" (not Reset).
Anything new on the Add-ons page? Either:
Ctrl+Shift+a
"3-bar" menu button (or Tools menu) & Add-ons
In the left column, click Extensions. Anything unexpected or suspicious on the list?
(2) You can check your connection setting here:
"3-bar" menu button (or Tools menu) & Options & Advanced & Network mini-tab & "Settings" button
The default is "Use system proxy settings" but you also can try "No proxy" to see whether that helps.
Hi hao123infested, could you test:
'''Click Home icon or Press Alt+Home or Ctrl+n Keyboard Shortcuts'''
This should load the home page set in Options. Do you get the correct home page or the unwanted home page?
(A) Correct
Your Firefox shortcut may be hijacked. right-click it and check its Properties to make sure the unwanted URL is not included in the Target (this is set on the Shortcut tab).
(B) Unwanted
You may have a self-hiding extension or hijacked connection setting.
(1) Self-hiding extensions are visible in Firefox's Safe Mode. That's a standard diagnostic tool to deactivate extensions and some advanced features of Firefox. More info: [[Troubleshoot Firefox issues using Safe Mode]].
You can restart Firefox in Safe Mode using either:
* "3-bar" menu button & "?" button & Restart with Add-ons Disabled
* Help menu & Restart with Add-ons Disabled
Not all add-ons are disabled: Flash and other plugins still run
After Firefox shuts down, a small dialog should appear. Click "Start in Safe Mode" (''not'' Reset).
Anything new on the Add-ons page? Either:
* Ctrl+Shift+a
* "3-bar" menu button (or Tools menu) & Add-ons
In the left column, click Extensions. Anything unexpected or suspicious on the list?
(2) You can check your connection setting here:
"3-bar" menu button (or Tools menu) & Options & Advanced & Network mini-tab & "Settings" button
The default is "Use system proxy settings" but you also can try "No proxy" to see whether that helps.
1 solutions
ALT-Home or homepage icon still points to "blank" page, which is my home page. So the answer is partially 'A'.
Firefox icon is clean. Even start Firefox from windows start menu's
"search application and file" box. Hao123 is still haunting.
I guess hao123 hijacks last session and history record in a stealth way. but some how sessionstore.js is clean.
ALT-Home or homepage icon still points to "blank" page, which is my home page. So the answer is partially 'A'.
Firefox icon is clean. Even start Firefox from windows start menu's
"search application and file" box. Hao123 is still haunting.
I guess hao123 hijacks last session and history record in a stealth way. but some how sessionstore.js is clean.
Modified August 26, 2014 at 8:05:31 PM PDT by hao123infested
Top 10 Contributor
7298 solutions
59418 answers
It's hard to think of where it's coming from if it's not in the usual places.
Are there specific factors leading you to believe it is somehow related to restoring your previous session? For example, is Restore Previous Session grayed out on the History menu? What if, after you exit Firefox, you rename sessionstore.js to sessionstore.old to prevent it from being used. Does that make any difference?
Is the problem limited to Firefox or does it occur in Internet Explorer as well (after making sure the Target is clean in its shortcut)?
It's hard to think of where it's coming from if it's not in the usual places.
Are there specific factors leading you to believe it is somehow related to restoring your previous session? For example, is Restore Previous Session grayed out on the History menu? What if, after you exit Firefox, you rename sessionstore.js to sessionstore.old to prevent it from being used. Does that make any difference?
Is the problem limited to Firefox or does it occur in Internet Explorer as well (after making sure the Target is clean in its shortcut)?
1 solutions
Here is what I found: It is a combination of 1)shortcut hijacking, 2)unwanted backdoor, and 3)virus.
1. hao123 hijack Firefox short cut.
a) if I create a short cut from "c:\program files\Mozilla firefox\firefox.exe" ,
the newly created short cut is hijacked right away/ infested.
b) if I uninstall firefox and reinstall it, the shortcut created by installation package is hijacked too.
c) if I mouse double click on executable "c:\program files\Mozilla firefox\firefox.exe", the firefox window starts with hao123.
Note: in a) and b)
shortcut property is clean.
But , if I create a BAT file with command
[start \d "c:\program files\mozilla firefox\" firefox.exe]. Then run the BAT file,
hao123 is not display as homepage.
2. infestation involved backdoor to
First. I block hao123 from network router, so infested firefox won't open the hao123 page, and instead with network not available page. Then use SysInternal -- TCPViewer tool to trace infested firefox.
It shows that BAT file started firefox doesn't make http connections to sites at start up.(Firefox has blank home page).
But hao123 infested firefox makes http requests to a list of Unknown IPs.
61.135.185.*
220.181.23.*
123.125.112.*
119.75.208.*
whois service indicates these unknown IPs belongs to , which owns . These IPs doesn't related to baidu's internet search services, which use 180.76.*.* network.
I assume Unknown IPs associates with
So I block these unknown IPs in firewall an network router.
A folder name "QvodPlayer" is re-created in C drive after is deleted. And a function is hooking on shortcut creation api. still trying to trace down what application is behind it. Given that I don't have "hao123-client", "search protected", "conduit" or "qvod" installed,
the folder and hooker are signs of virus
Temporal solution is that:
and the list of unknown IPs in firewall or Network router
2. create a BAT file with command [start \d "c:\program files\mozilla firefox\" firefox.exe] to start firefox.
Thanks jscher2000's suggestion. It is shortcut hijacking, but it is an improved version of shortcut hijacking : with backdoor and virus.
Here is what I found: It is a combination of 1)shortcut hijacking, 2)unwanted backdoor, and 3)virus.
'''1. hao123 hijack Firefox short cut. '''
a) if I create a short cut from "c:\program files\Mozilla firefox\firefox.exe" ,
the newly created short cut is hijacked right away/ infested.
b) if I uninstall firefox and reinstall it, the shortcut created by installation package is hijacked too.
c) if I mouse double click on executable "c:\program files\Mozilla firefox\firefox.exe", the firefox window starts with hao123.
Note: in a) and b)
shortcut property is clean.
But , if I create a '''BAT''' file with command
['''start \d "c:\program files\mozilla firefox\" firefox.exe''']. Then run the BAT file,
hao123 is not display as homepage.
'''2. infestation involved backdoor to BAIDU.com'''
First. I block hao123 from network router, so infested firefox won't open the hao123 page, and instead with network not available page. Then use SysInternal -- TCPViewer tool to trace infested firefox.
It shows that BAT file started firefox doesn't make http connections to sites at start up.(Firefox has blank home page).
But hao123 infested firefox makes http requests to a list of Unknown IPs.
61.135.185.*
220.181.23.*
123.125.112.*
119.75.208.*
whois service indicates these unknown IPs belongs to '''Baidu.com''', '''which owns hao123.com'''. These IPs doesn't related to baidu's internet search services, which use 180.76.*.* network.
I assume Unknown IPs associates with hao123.com only.
So I block these unknown IPs in firewall an network router.
'''3. virus'''
A folder name "QvodPlayer" is re-created in C drive after is deleted. And a function is hooking on shortcut creation api. still trying to trace down what application is behind it. Given that I don't have "hao123-client", "search protected", "conduit" or "qvod" installed,
the folder and hooker are signs of virus
'''Temporal solution is that:'''
1. block hao123.com and the list of unknown IPs in firewall or Network router
2. create a BAT file with command [start \d "c:\program files\mozilla firefox\" firefox.exe] to start firefox.
Thanks jscher2000's suggestion. It is shortcut hijacking, but it is an improved version of shortcut hijacking : with backdoor and virus.
Modified August 26, 2014 at 8:42:02 PM PDT by hao123infested
Top 10 Contributor
7298 solutions
59418 answers
A root that will frustrate clean-up efforts. TDSSKiller and some others rootkit-specific cleaners are suggested in that case.
Microsoft's Autoruns tool can help by collating data from the registry, startup folders, and other areas to show what runs at startup.
A root that will frustrate clean-up efforts. TDSSKiller and some others rootkit-specific cleaners are suggested in that case.
Microsoft's Autoruns tool can help by collating data from the registry, startup folders, and other areas to show what runs at startup. http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
Top 10 Contributor
16256 solutions
146724 answers
Do a malware check with several malware scanning programs on the Windows computer.
Please scan with all programs because each program detects different malware.
All these programs have free versions.
Make sure that you update each program to get the latest version of their databases before doing a scan.
Malwarebytes' Anti-Malware:
AdwCleaner:
SuperAntispyware:
Microsoft Safety Scanner:
Windows Defender:
Spybot Search & Destroy:
Kasperky Free Security Scan:
You can also do a check for a rootkit infection with TDSSKiller.
Anti-rootkit utility TDSSKiller:
"Spyware on Windows":
Do a malware check with several malware scanning programs on the Windows computer.
Please scan with all programs because each program detects different malware.
All these programs have free versions.
Make sure that you update each program to get the latest version of their databases before doing a scan.
*Malwarebytes' Anti-Malware:&br&http://www.malwarebytes.org/mbam.php
*AdwCleaner:&br&http://www.bleepingcomputer.com/download/adwcleaner/&br&http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml
*SuperAntispyware:&br&http://www.superantispyware.com/
*Microsoft Safety Scanner:&br&http://www.microsoft.com/security/scanner/en-us/default.aspx
*Windows Defender:&br&http://windows.microsoft.com/en-us/windows/using-defender
*Spybot Search & Destroy:&br&http://www.safer-networking.org/en/index.html
*Kasperky Free Security Scan:&br&http://www.kaspersky.com/security-scan
You can also do a check for a rootkit infection with TDSSKiller.
*Anti-rootkit utility TDSSKiller:&br&http://support.kaspersky.com/5350?el=88446
*"Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked
1 solutions
Chosen Solution
Scan with Latest TDSSKiller. But it returns 0 threat. I ve tried a lot of malware/adware detect tools, non of them really fixed the hijacking.
Then I manually scaned machine with SysInternal's Autorun(thanks's jscher2000's reminder), and deleted a lot of unwanted entries. One of them named "QVOD Shenzhen" in preload dll tab looks suspicious. It is in user\appdata folder.
Can't delete that dll directly, so I renamed it to another name, then deleted the dll entry from AutoRun, and rebooted to F8 safe mode to delete the dll.
[Note: if not delete the entry, the dll will be loaded in safe mode. hence prevent from deleting the dll.
That explains why homepage was hijacked in windows safe mode]
rebooted to normal mode, both IE and Firefox's home pages are back to blank. that means the clean up works !
So the temp solution is to
1. try to reset home page through regular way.
2. if 1 failes, try to create a BAT file to point to firefox
3. if 2 works, then it is a shortcut hijacking
4. run TDSSKiller to see any infestation
5. if TDSSkill returns 0 threat,
try to locate "qvod" dll in Appdata folder
6. run AutoRun to find any "qvod" related entries and delete
7. reboot to F8 safe mode to delete the dll.
[Note: uninstall qvod won't solve the hao-123 page hijacking]
'''Scan with Latest TDSSKiller. But it returns 0 threat.''' I ve tried a lot of malware/adware detect tools, non of them really fixed the hijacking.
Then I manually scaned machine with SysInternal's Autorun(thanks's jscher2000's reminder), and deleted a lot of unwanted entries. One of them named "QVOD Shenzhen" in preload dll tab looks suspicious. It is in user\appdata folder.
Can't delete that dll directly, so I renamed it to another name, then deleted the dll entry from AutoRun, and rebooted to F8 safe mode to delete the dll.
[Note: if not delete the entry, the dll will be loaded in safe mode. hence prevent from deleting the dll.
That explains why homepage was hijacked in windows safe mode]
rebooted to normal mode, both IE and Firefox's home pages are back to blank. that means the clean up works !
So the temp solution is to
1. try to reset home page through regular way.
2. if 1 failes, try to create a BAT file to point to firefox
3. if 2 works, then it is a shortcut hijacking
4. run TDSSKiller to see any infestation
5. if TDSSkill returns 0 threat,
try to locate "qvod" dll in Appdata folder
6. run AutoRun to find any "qvod" related entries and delete
7. reboot to F8 safe mode to delete the dll.
[Note: uninstall qvod won't solve the hao-123 page hijacking]
0 solutions
Yes mine was completely shortcut hijacking, but google chrome didnt get infected (Impressive)!
I try all above but in the end things turn okay when i run the AutoRun & find the qvod shenzen, happen to be in my browser helper objects, i guess this how it "hijack" my browsers. Then I delete all this Qvod entries.
Yes uninstall qvod won't solve the page hijack.
Thank you so much @hao123infested!!
Yes mine was completely shortcut hijacking, but google chrome didnt get infected (Impressive)!
I try all above but in the end things turn okay when i run the AutoRun & find the qvod shenzen, happen to be in my browser helper objects, i guess this how it "hijack" my browsers. Then I delete all this Qvod entries.
Yes uninstall qvod won't solve the page hijack.
Thank you so much @hao123infested!!
0 solutions
Hello, there is video guide how to remove hao123
&Youtube link removed&
May be it will be helpful
Hello, there is video guide how to remove hao123
&Youtube link removed&
May be it will be helpful
Modified October 14, 2014 at 6:10:59 PM PDT by James
458 solutions
3599 answers
PCFixHelp:
This is a solved and now closed thread. Please do not advertise programs here.
PCFixHelp:
This is a solved and now closed thread. Please do not advertise programs here.
Portions of this content are & by individual mozilla.org contributors. Content available under a .