Malware - urlseek20.vmn.net

Contributors

*Change style?

Blog Administration

< Dynamically selecting a tab in flash forms | Windows authentication failed for local SQL server 2005 instance >

Malware - urlseek20.vmn.net

Tuesday, March 17. 2009

Over the years I have used PDF creator to create PDF documents on-the-fly. Since then other similar products would appear higher on the google searches (cute PDF, primo pdf etc) that essentially delivered similar results for the same price - free (of course!) - and I switched to different products on different computers. However, PDFForge was myfavorite.

About 6 months after buying a new computer, I decided to track down and install PDF Creator. This time it came with a search toolbar that I chose not to install. Shortly thereafter, when using a tabbed flash form, I was taken to urlseek20.vmn.net with a "404" error every time I clicked a tab. Interestingly this happened only in Firefox (I have 3.0.7) and not in IE.

Given that it had never happened before, I started killing processes that seemed suspicious. I also downloaded and installed Spybot, AdAware and some other tools recommended for removing malware. Running these programs did not reveal any infection.

Removal: Out of desperation I started removing programs that I wasn't using starting with the newest installs. Removing the PDFforge toolbar (from Add/remove programs) seems to fix this instantly. I hope it does not reinstall itself again. It remains to be seen! If this is indeed the case, I hope they will identify and fix it ASAP. Their website assures me that their software is "100% clean" as certified by "soft82.com". Who knows?!

Hopefully this post helps others in the same boat. Removing malware is cumbersome to say the least.

Posted by Victor Raj in OpenSource at 08:44 | Comments (43) | Trackback (1)

Trackbacks

Trackback specific URI for this entry

PingBack

Weblog: www.brucepro.net
Tracked: Mar 19, 01:08

Comments

Display comments as (Linear | Threaded)

Thank you so much for posting this! I too have used PDF Creator for ages and recently found my 404 errors being redirected to this search page. I thought it was something about my ISP since they are partnered with Yahoo, until I found it redirecting from my own website that has a custom 404 page. Only your post provided the effective solution. Like you, I selected No to installing the searchbar, but it apparently did anyway. When I uninstalled it, I told PDFforge they should be ashamed of themselves for this spyware. In their uninstall survey, I blasted them for it. So thank you so much for posting this! As you hoped, it has helped at least one person. : )

#1 Jo on 2009-03-17 20:48 (Reply)

Thanks for this information. I was looking everywhere how to remove this ulseek20 and you helped me.

#1.1 Rukas on 2009-03-19 12:34 (Reply)

I love the internet. Uninstalling pdfforge fixed my problem as well.

#1.2 Paul on 2009-06-18 20:00 (Reply)

Thank you! This has been bugging me for weeks!

Goodbye PDFforge!! Forever, period. This kind of browser hijacking has always pissed people off - what the heck were they thinking?

#2 Tony on 2009-03-18 13:12 (Reply)

Thanks! Noticed it today..google found you.

#3 Bob on 2009-03-19 00:57 (Reply)

I have this trouble too; however, I wish I would have found your post before I ran all kinds of Spyware programs trying to get rid of it. One of them, perhaps Hijack This, deleted part of the registry, so now I cannot delete or install a new copy to repair the damage. Somehow, I am going to try to fix the registry. I guess I'll install it on an old computer I have and make sure all the key values are the same. Do you have any other ideas?
Cyndy

#4 Cyndy (Homepage) on 2009-03-19 10:45 (Reply)

Now you see why I was not too excited about using the "Hijack this" strategy. It is quite cumbersome and can be risky (as you found out!). I'm sure you visited the malware removal site linked in the post (http://www.malwareremoval.com). If you didn't you may want to. Other than that, there is little else I can do to help. My arrival at this solution was quite by accident. And it seems to have helped a few people already.

#4.1 Victor on 2009-03-19 11:04 (Reply)

Thanks!! Exact same issue for me and uninstalling the pdfforge toolbar seems to have fixed it.

#5 Mike on 2009-03-26 00:32 (Reply)

Thanks... Good find !

#6 Matt on 2009-04-04 15:21 (Reply)

Thanks for this post - I've been going insane trying to find the cause of this. I've run every virus scan I could get hold of and nothing seemed to make a difference.

Turns out I'd rather stupidly assumed that PDF creator was trustworthy since I'd never had a problem before. CutePDF it is from now on

#7 Jon (Homepage) on 2009-04-06 12:38 (Reply)

Hi Jon,

Are you suggesting that even after uninstalling PDFforge you still have sypware on your computer because you've left PDF creator.

I agree with one of the comments here, it's really too useful to let go of.

#7.1 Peter on 2009-07-01 05:06 (Reply)

There is no need to remove PDF creator. I didn't. Just lose the toolbar.

#7.1.1 Victor Raj on 2009-07-01 05:26 (Reply)

I had removed this thing before and something reinstalled it. It may have been the PDFCreator but I cannot be sure.

#8 Jim Sanchez on 2009-04-13 12:16 (Reply)

Many Thanks, I was one minute away from running a full reinstall.

#9 Anonymous on 2009-04-13 21:29 (Reply)

Thank you very much.
I installed PDF download as a firefox add on. After that the same thing happened. This will cure my firefox problem

#10 Fireashes on 2009-04-13 23:35 (Reply)

Thank you
I had the same issue. After unistalling pdfforge not redirects to http://urlseek20.vmn.net/ when I go to a non exiting page

#11 Anonymous on 2009-04-14 20:05 (Reply)

I've uninstalled PDFforge... so what!?!
I'm still getting the damned redirection.

#12 eac on 2009-04-15 14:57 (Reply)

This has been reported on the pdfForge forum too.
http://www.pdfforge.org/node/2540

#12.1 Victor Raj on 2009-04-15 17:27 (Reply)

Yep, got me too... removed the "search settings plugin" which supposedly "helps protect your default search settings" and the problem went away..

blooming cheeky considering the opt out... oh well i'm happy again now because i've got my 404s back (though quite why i missed them i'm not sure- mainly the principle of the thing!) and still got PDFCreator - it's too useful to let go

Seb

#13 Seb on 2009-04-16 14:16 (Reply)

thank you for the trick! I have had this problem for months and couldn't find the cause!

#14 david on 2009-04-23 04:21 (Reply)

Many thanks guys for the solution to this problem... i am so glad that the redirect to urlseek20.vmn.net is gone!! i owe you all a beer!

#15 pat on 2009-04-25 14:19 (Reply)

I found this page through google it seems it is helping a lot of people here(good!) but unfortunately I don't use that PDF software...I still can't find the cause.

#16 T (Homepage) on 2009-04-28 14:38 (Reply)

Thank you. This is a great help!

#17 Lou on 2009-05-04 07:09 (Reply)

Thanks very much for the proper direction!
Yet, I have to add up that (a) the 404 redirection problem occurs in both IE & Firefox and (b) you don't need to uninstall PDFCreator completely but only disable/uninstall the "Search Settings Plugin" in Firefox (Tools->Add-ons - Extensions tab) and/or "Search Settings module for IE" in IE (Tools->Manage Add-ons). Note: Restart is required on both browsers to complete.

#18 Manos on 2009-05-06 07:42 (Reply)

Thank you for the additional input. I still use PDF Creator - just not the toolbar.

#18.1 Victor on 2009-05-06 08:19 (Reply)

Thanks man I removed the s*** from my pc I use Foxit PDF all in one creator reader and editor and it was free.

#19 Pixel (Homepage) on 2009-05-07 02:19 (Reply)

thanks a lot !!!

#20 Anonymous on 2009-05-13 03:55 (Reply)

hi
i searched the folder with my installed programs for the text-passage:"urlseek40" and it has been found in the file "toolbar.xml" within the folder "oovootb" oovoo is a webcam video fone software...
i opened the file and found: toolbarname="ooVoo Toolbar".
so it could be the oovoo-toolbar too. i will uninstall it.

#21 clemens on 2009-05-13 06:16 (Reply)

Thanks! I am sure this will be useful for those who hadn't installed PDF Creator.

#21.1 Victor Raj on 2009-05-13 07:42 (Reply)

Thanks Victor! It annoyed me as well. Uninstalling pdfforge did indeed the trick.

Ronald

#22 Ronald on 2009-05-14 07:45 (Reply)

Thanks a million! Your post saved alot of time getting to the bottom of the issue.

Just left PDFForge a complaint about the software distributing mallware. Doubt it will make any difference though!

#23 Andrew Thomson (Homepage) on 2009-05-19 08:35 (Reply)

Thanks too guys. Man that was an annoying bastard. I curse those programmers.

#24 jones on 2009-05-30 09:55 (Reply)

It worked for me, too. Here is how: Go to TOOLS > Add-Ons. Search for PDF Creator Toolbar. UNINSTALL. !?/^& the PDF Creators for slyly incorporating Browser-Hijack tool. Shame on you !?/^& Now listen to my symphonies.

#25 Franz Joseph Hayden on 2009-05-31 08:57 (Reply)

Unfortunately, the latest version of AVG installs its own security toolbar, and it ALSO hijacks the browser 404 page. You can fix this two ways:
1. The nice way is to click on the AVG logo dropdown in their toolbar, click on Options, and uncheck "Let AVG make suggestion on browser navigation errors (404/DNS).
2. The other way, the one I vastly prefer, is to annihilate the AVG browser plugin altogether, permanently fixing this issue; in IE, select Tools > Manage Addons > Enable or Disable Addons. Then select the AVG Toolbar (there may be two plugins shown) and click disable on both. Problem solved, and MANY thanks to Victor Raj for nudging me in the right direction with this issue.

#26 Rob Lyon (Homepage) on 2009-06-07 21:36 (Reply)

Many thanks!

#27 Alberto tapia on 2009-06-14 12:52 (Reply)

I don't know if you really have to remove the programs (maybe you do), but the simple solution that just worked for me is (can I use a link? http://www.advicenators.com/qview.php?q=546794). From that page, their advice (summarized):

Windows Vista, Windows XP and Windows 2000 removal instructions:

Click on Windows Start button, choose Settings > Control Panel > Add or Remove Programs. Find "Search Settings" and click Remove. In Vista, Remove is referred to as Uninstall.

#28 Ralde on 2009-06-19 14:36 (Reply)

Thanks for the blog, really useful.

One thing that intrigues me is why Yahoo would partner with such a company, I mean one that installs spyware/malware on your computer, are they really that desperate?

#29 Peter on 2009-07-01 05:25 (Reply)

thank you for posting this, worked forme

#30 Don on 2009-07-30 00:42 (Reply)

10x Man, This malewar drove me crazy.. my browser jumped pages like crazy.. i had no idea it was a pdf forge "extra suprize"

cheers
sagive

#31 sagive (Homepage) on 2009-08-03 19:27 (Reply)

this drove me crazy as well..... thank uuuu..

#32 bang41 (Homepage) on 2009-08-09 07:16 (Reply)

See http://computerboom.blogspot.com/2009/09/solved-remove-httpurlseek40vmnnet-from.html for instructions on how to remove urlseek40.vmn.net/search.php redirect.

#33 John Sampson on 2009-09-21 01:13 (Reply)

That fixed it for me as well! Thanks for the info.

#34 Ro Sahas on 2009-09-23 14:56 (Reply)

That's for the info, this was exactly the problem.
I was able to keep PDF creator installed and remove the Search Addon from within FF3.5.3

#35 George on 2009-09-29 23:18 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	Enclosing asterisks marks text as bold (word), underscore are made via _word_. Standard emoticons like :-) and ;-) are converted to images. E-Mail addresses will not be displayed and will only be used for E-Mail notifications To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above:
	Remember Information? Subscribe to this entry
Submitted comments will be subject to moderation before being displayed.