Malware - urlseek20.vmn.net

Contributors

*Change style?

Blog Administration

< Dynamically selecting a tab in flash forms | Windows authentication failed for local SQL server 2005 instance >

Tuesday, March 17. 2009

Malware - urlseek20.vmn.net

Over the years I have used PDF creator to create PDF documents on-the-fly. Since then other similar products would appear higher on the google searches (cute PDF, primo pdf etc) that essentially delivered similar results for the same price - free (of course!) - and I switched to different products on different computers. However, PDFForge was myfavorite.

About 6 months after buying a new computer, I decided to track down and install PDF Creator. This time it came with a search toolbar that I chose not to install. Shortly thereafter, when using a tabbed flash form, I was taken to urlseek20.vmn.net with a "404" error every time I clicked a tab. Interestingly this happened only in Firefox (I have 3.0.7) and not in IE.

Given that it had never happened before, I started killing processes that seemed suspicious. I also downloaded and installed Spybot, AdAware and some other tools recommended for removing malware. Running these programs did not reveal any infection.

Removal: Out of desperation I started removing programs that I wasn't using starting with the newest installs. Removing the PDFforge toolbar (from Add/remove programs) seems to fix this instantly. I hope it does not reinstall itself again. It remains to be seen! If this is indeed the case, I hope they will identify and fix it ASAP. Their website assures me that their software is "100% clean" as certified by "soft82.com". Who knows?!

Hopefully this post helps others in the same boat. Removing malware is cumbersome to say the least.

Posted by Victor Raj in OpenSource at 08:44 | Comments (54) | Trackback (1)

Trackbacks

Trackback specific URI for this entry

PingBack

Weblog: www.brucepro.net
Tracked: Mar 19, 01:08

Comments

Display comments as (Linear | Threaded)

Thank you so much for posting this! I too have used PDF Creator for ages and recently found my 404 errors being redirected to this search page. I thought it was something about my ISP since they are partnered with Yahoo, until I found it redirecting from my own website that has a custom 404 page. Only your post provided the effective solution. Like you, I selected No to installing the searchbar, but it apparently did anyway. When I uninstalled it, I told PDFforge they should be ashamed of themselves for this spyware. In their uninstall survey, I blasted them for it. So thank you so much for posting this! As you hoped, it has helped at least one person. : )

#1 Jo on 2009-03-17 20:48

Thanks for this information. I was looking everywhere how to remove this ulseek20 and you helped me.

#1.1 Rukas on 2009-03-19 12:34

I love the internet. Uninstalling pdfforge fixed my problem as well.

#1.2 Paul on 2009-06-18 20:00

...thanks. My was at youtube download. F:u@£ 404. It took me 3h to find it

#1.3 mike on 2010-04-25 13:37

Oh, I downloaded PDFcreator today, chose not to install the toolbar, but it did install it anyway, along with the 404 hijacker. It redirects the 404 in both IE and Firefox. So I ran HijackThis and in five minutes i was returned to my Google 404 which is normal as I use Google public DNS (8.8.8.8 and 8.8.4.4). Yahoo! obviously is making these routines available, and the software writers are bundling this crapware in because they pay for it. Just search for "pdf" in the HijackThis log and you'll know what to remove. Why these writers, who work for free, refuse to work for private companies beats me because they obviously need the money which is why they commit these criminal acts.

#1.4 John Adams on 2010-06-11 23:54

well dear friend. i need help
urlseek90.vmn.net/ is blocking every program i delleted every toolbar there is i do not have an pdf creator so whats the next step. trying pctools spyware dont work reg mech dont work. malware dont work i cant go to my favorites because this F@king urlseek90.vmn.net/ blocks it all

please help me

#1.5 Elroy (Homepage) on 2011-02-07 12:11

Thank you! This has been bugging me for weeks!

Goodbye PDFforge!! Forever, period. This kind of browser hijacking has always pissed people off - what the heck were they thinking?

#2 Tony on 2009-03-18 13:12

Thanks! Noticed it today..google found you.

#3 Bob on 2009-03-19 00:57

I have this trouble too; however, I wish I would have found your post before I ran all kinds of Spyware programs trying to get rid of it. One of them, perhaps Hijack This, deleted part of the registry, so now I cannot delete or install a new copy to repair the damage. Somehow, I am going to try to fix the registry. I guess I'll install it on an old computer I have and make sure all the key values are the same. Do you have any other ideas?
Cyndy

#4 Cyndy (Homepage) on 2009-03-19 10:45

Now you see why I was not too excited about using the "Hijack this" strategy. It is quite cumbersome and can be risky (as you found out!). I'm sure you visited the malware removal site linked in the post (http://www.malwareremoval.com). If you didn't you may want to. Other than that, there is little else I can do to help. My arrival at this solution was quite by accident. And it seems to have helped a few people already.

#4.1 Victor on 2009-03-19 11:04

Thanks!! Exact same issue for me and uninstalling the pdfforge toolbar seems to have fixed it.

#5 Mike on 2009-03-26 00:32

Thanks for this post - I've been going insane trying to find the cause of this. I've run every virus scan I could get hold of and nothing seemed to make a difference.

#5.1 Robert on 2010-03-02 07:34

Thanks... Good find !

#6 Matt on 2009-04-04 15:21

Thanks for this post - I've been going insane trying to find the cause of this. I've run every virus scan I could get hold of and nothing seemed to make a difference.

Turns out I'd rather stupidly assumed that PDF creator was trustworthy since I'd never had a problem before. CutePDF it is from now on

#7 Jon (Homepage) on 2009-04-06 12:38

Hi Jon,

Are you suggesting that even after uninstalling PDFforge you still have sypware on your computer because you've left PDF creator.

I agree with one of the comments here, it's really too useful to let go of.

#7.1 Peter on 2009-07-01 05:06

There is no need to remove PDF creator. I didn't. Just lose the toolbar.

#7.1.1 Victor Raj on 2009-07-01 05:26

I had removed this thing before and something reinstalled it. It may have been the PDFCreator but I cannot be sure.

#8 Jim Sanchez on 2009-04-13 12:16

Many Thanks, I was one minute away from running a full reinstall.

#9 Anonymous on 2009-04-13 21:29

Thank you very much.
I installed PDF download as a firefox add on. After that the same thing happened. This will cure my firefox problem

#10 Fireashes on 2009-04-13 23:35

Thank you
I had the same issue. After unistalling pdfforge not redirects to http://urlseek20.vmn.net/ when I go to a non exiting page

#11 Anonymous on 2009-04-14 20:05

I've uninstalled PDFforge... so what!?!
I'm still getting the damned redirection.

#12 eac on 2009-04-15 14:57

This has been reported on the pdfForge forum too.
http://www.pdfforge.org/node/2540

#12.1 Victor Raj on 2009-04-15 17:27

Yep, got me too... removed the "search settings plugin" which supposedly "helps protect your default search settings" and the problem went away..

blooming cheeky considering the opt out... oh well i'm happy again now because i've got my 404s back (though quite why i missed them i'm not sure- mainly the principle of the thing!) and still got PDFCreator - it's too useful to let go

Seb

#13 Seb on 2009-04-16 14:16

thank you for the trick! I have had this problem for months and couldn't find the cause!

#14 david on 2009-04-23 04:21

Many thanks guys for the solution to this problem... i am so glad that the redirect to urlseek20.vmn.net is gone!! i owe you all a beer!

#15 pat on 2009-04-25 14:19

I found this page through google it seems it is helping a lot of people here(good!) but unfortunately I don't use that PDF software...I still can't find the cause.

#16 T (Homepage) on 2009-04-28 14:38

Thank you. This is a great help!

#17 Lou on 2009-05-04 07:09

Thanks very much for the proper direction!
Yet, I have to add up that (a) the 404 redirection problem occurs in both IE & Firefox and (b) you don't need to uninstall PDFCreator completely but only disable/uninstall the "Search Settings Plugin" in Firefox (Tools->Add-ons - Extensions tab) and/or "Search Settings module for IE" in IE (Tools->Manage Add-ons). Note: Restart is required on both browsers to complete.

#18 Manos on 2009-05-06 07:42

Thank you for the additional input. I still use PDF Creator - just not the toolbar.

#18.1 Victor on 2009-05-06 08:19

Thank you Manos for the Help.
I disabled mine in IE8
IE8/Tools/Manage Add-ons/Toolbars and Extensions/Disable: Spigot Inc.

#18.2 JBrady on 2010-07-22 20:01

Thanks man I removed the s*** from my pc I use Foxit PDF all in one creator reader and editor and it was free.

#19 Pixel (Homepage) on 2009-05-07 02:19

thanks a lot !!!

#20 Anonymous on 2009-05-13 03:55

hi
i searched the folder with my installed programs for the text-passage:"urlseek40" and it has been found in the file "toolbar.xml" within the folder "oovootb" oovoo is a webcam video fone software...
i opened the file and found: toolbarname="ooVoo Toolbar".
so it could be the oovoo-toolbar too. i will uninstall it.

#21 clemens on 2009-05-13 06:16

Thanks! I am sure this will be useful for those who hadn't installed PDF Creator.

#21.1 Victor Raj on 2009-05-13 07:42

Thanks Victor! It annoyed me as well. Uninstalling pdfforge did indeed the trick.

Ronald

#22 Ronald on 2009-05-14 07:45

Thanks a million! Your post saved alot of time getting to the bottom of the issue.

Just left PDFForge a complaint about the software distributing mallware. Doubt it will make any difference though!

#23 Andrew Thomson (Homepage) on 2009-05-19 08:35

Thanks too guys. Man that was an annoying bastard. I curse those programmers.

#24 jones on 2009-05-30 09:55

It worked for me, too. Here is how: Go to TOOLS > Add-Ons. Search for PDF Creator Toolbar. UNINSTALL. !?/^& the PDF Creators for slyly incorporating Browser-Hijack tool. Shame on you !?/^& Now listen to my symphonies.

#25 Franz Joseph Hayden on 2009-05-31 08:57

Unfortunately, the latest version of AVG installs its own security toolbar, and it ALSO hijacks the browser 404 page. You can fix this two ways:
1. The nice way is to click on the AVG logo dropdown in their toolbar, click on Options, and uncheck "Let AVG make suggestion on browser navigation errors (404/DNS).
2. The other way, the one I vastly prefer, is to annihilate the AVG browser plugin altogether, permanently fixing this issue; in IE, select Tools > Manage Addons > Enable or Disable Addons. Then select the AVG Toolbar (there may be two plugins shown) and click disable on both. Problem solved, and MANY thanks to Victor Raj for nudging me in the right direction with this issue.

#26 Rob Lyon (Homepage) on 2009-06-07 21:36

Many thanks!

#27 Alberto tapia on 2009-06-14 12:52

I don't know if you really have to remove the programs (maybe you do), but the simple solution that just worked for me is (can I use a link? http://www.advicenators.com/qview.php?q=546794). From that page, their advice (summarized):

Windows Vista, Windows XP and Windows 2000 removal instructions:

Click on Windows Start button, choose Settings > Control Panel > Add or Remove Programs. Find "Search Settings" and click Remove. In Vista, Remove is referred to as Uninstall.

#28 Ralde on 2009-06-19 14:36

Thanks for the blog, really useful.

One thing that intrigues me is why Yahoo would partner with such a company, I mean one that installs spyware/malware on your computer, are they really that desperate?

#29 Peter on 2009-07-01 05:25

thank you for posting this, worked forme

#30 Don on 2009-07-30 00:42

10x Man, This malewar drove me crazy.. my browser jumped pages like crazy.. i had no idea it was a pdf forge "extra suprize"

cheers
sagive

#31 sagive (Homepage) on 2009-08-03 19:27

this drove me crazy as well..... thank uuuu..

#32 bang41 (Homepage) on 2009-08-09 07:16

See http://computerboom.blogspot.com/2009/09/solved-remove-httpurlseek40vmnnet-from.html for instructions on how to remove urlseek40.vmn.net/search.php redirect.

#33 John Sampson on 2009-09-21 01:13

That fixed it for me as well! Thanks for the info.

#34 Ro Sahas on 2009-09-23 14:56

That's for the info, this was exactly the problem.
I was able to keep PDF creator installed and remove the Search Addon from within FF3.5.3

#35 George on 2009-09-29 23:18

So glad I found this. I installed ooVoo yesterday and was suddenly faced with a 'urlseek40' error when I tried to launch Google. After reading this thread, found through Bing, I tried launching Google again (in FF) and this time, checked the url that came back with the error...and sure enough, found ooVoo in the address. I checked my program list, found the toolbar that had installed with the app, uninstalled it and I'm good to go. Thanks again!

#36 Monique on 2010-03-16 15:28

sehr gut.

#37 Anna ge on 2010-09-12 22:01

I apparently had this bit of trash myself, onliy it came in the form of Bittorrent toolbar. Hmph. take that, unnecessary software that I never wanted in the first friggin place.

#38 Timber Wolf on 2011-02-26 20:28

I am using also Pdf creator for a long time and I am very pleased of the program.
Also i have recently installed version 0.9.7 of the software with the browser toolbar component.
I think that this toolbar it is very useful to search anything, on yahoo, ebay and amazon.
It gives the opportunity to connect to ebay website automaticall that from my point of view is very good because I am an ebay client.
Having less free time, this toolbar is giving me the opportunity to quickly access ebay, amazon and to seek necessary information on yahoo search.
Like other search toolbars, web page image results are visable in a search tray for easy review of not only the visual images of the site but also the written headlines.
This is not spyware or adware.

Searching through other threads I found these links that I think can help everyone

http://www.spigot.com/uninstall.html
http://www.spigot.com/network_error_assistant.html

#39 cris on 2011-07-07 05:49

Goodbye PDFforge! sehr gut. 100% =)

#40 Andrew on 2011-08-09 04:24

do u have to remove the pdf?

#41 jhon blog on 2011-09-27 11:53

The author does not allow comments to this entry