Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

It seems like I contacted some kind of chrome hijacker which changes my homepages to start.qone8.com and qvo6.com. This always happens when I connect with my google chrome account.
I removed the file from the system with SpyHunter, but after logging in again into chrome, the system got the infection again.
I really have no clue what to do in such cases and I do not have any knowledge regarding digital security, I would appreciate any suggestion on this problem

Thanks in advance!

share|improve this question

migrated from security.stackexchange.com Oct 9 '13 at 19:38

This question came from our site for Information security professionals.

12 Answers 12

up vote 2 down vote accepted

Been working on this infection for the better part of two days and finally just won. Run Combofix, ADWCleaner, and then MalwareBytes. Run them again to make sure they come back clean (if you are pressed for time, i suppose you don't have to check again, but i strongly recommend checking again). the home page of firefox, chrome, and IE will still be pointing to start.qone8.com/blahblahblah

Remove firefox. Remove chrome. Restart. Reinstall firefox, chrome, and test it out. They are fine again.

IE: Programs and Features, Turn Windows Features On or Off. Remove the check box from your flavor of IE. Remove the shortcuts from your start menu (if they are in there still).

Restart.

Programs and Features, Turn Windows Features On or Off. Put the check box back in front of your version of Internet Explorer. Once re-installed, click on the start button, type in iexplore, the top listing should have the icon, right click, paste to start menu.

This was what worked here. Hope it works for you. No combination of resetting the browsers, disabling toolbars/extensions/search providers had any effect in our experience removing this pesky little sucker.

share|improve this answer

Sounds like you may be re-syncing the problem.

You might want to try going into Chrome's settings, and under the Sign In section there's a link to Manage your synced data on Google Dashboard.

On the dashboard page, there's a button titled Stop and Clear that will cause your browser stop syncing and clear all existing saved data.

If, at that point, you can log in and not have the problem resurface, you'll know that was the culprit.

share|improve this answer
    
+1 for re-syncing –  Bujanca Mihai Oct 19 '13 at 20:29

there is nothing special about this adware. Search for "qone8" and remove its references from registry. Recreate your browser shortcuts on desktop, start menu and start menu programs list. Check browser settings and remove the qone8 url if its in home page, or new tab page, or bookmarks, or addons/plugins/extensions, or search engines list.

share|improve this answer

For tips on how to remove Qvo6, see this: http://deletemalware.blogspot.com/2013/04/qvo6-removal-how-to-uninstall.html

For tips on how to remove Qone8, see this: http://malwaretips.com/blogs/remove-start-qone8-virus/

share|improve this answer

I had to deal with this some time back. The sneaky thing about this hijacker is... it changes all your browser link URLs to point at your site, and once you've done the usual (cleared out suspecious extentions, reset firefox and so on), you're going to have to rightclick and edit the link to the browsers on the system - all of them, to remove stop them pointing at the Qvo6 site. Seriously annoying that I didn't catch that earlier.

share|improve this answer

Okay, here's what I did:

Backuped whatever data I needed and was synced (bookmarks, etc)
Stopped sync and cleared
Ran Malwaredytes and SpyBot (both are real good- cleared all)
Reset the home page to blank page.

No more problems :)

share|improve this answer

This virus has changed... It now hijacks the start menu shortcuts. Navigate to %appdata%/Microsoft/Windows/Start Menu/Programs and change your internet explorer shortcuts.

share|improve this answer
1  
Thank you for your response, however my question explicitly said that the problem was on google chrome when I logged into my chrome account. However it might help users who have this problem with IE –  Bujanca Mihai Oct 18 '13 at 10:44

Alternatively, you may follow this manual guide that is absolutely free http://www.system-tips.net/guide-to-fix-browser-redirection-and-remove-browser-hijackers/ This will help you understand how to get rid of start.qone8.com manually.

share|improve this answer

I just

removed the chrome shortcut from my desktop / taskbar / start menu

then I found the chrome.exe in program files and then right clicked then send to desktop (create shortcut)

this solved the problem for me

the corruption was with the shortcut target not the browser.

share|improve this answer
    
As I said, in my case the corruption happened when logging into the google chrome. SpyBot and MalwareBytes solved it –  Bujanca Mihai Oct 19 '13 at 20:29

Read a lot about these two nasty browser hijackers. Just go to your browsers' settings and choose add-on/extensions. Search for anything that is related to qvo6 or qzone8 (and also any other suspiciuos file names) and remove them.

  1. Again from the setting, change your homepage back to normal (that is if it has been changed).
  2. Open Control Panel and search for any program or file with the same name and remove them.

Open your Windows Explorer and search again for any left file or folder containing ask search or ask toolbar in their name.

I suggest you also read this step-by-step ask toolbar removal guide.

share|improve this answer

I think it's better to try and remove it manually, however you still might need to do a scan just to be sure everything is gone.

There are a lot of free antivirus software on the internet, you just need to choose a reliable one. When I had to deal with Qvo6 I followed the instructions from here.

I hope it helps you too!

share|improve this answer

My recommendation for you to remove qone8.com browser hijacker is that you follow this guide

share|improve this answer
    
superuser.com/users/261321/chrisatenix wrote: While we were in the process of attempting to fix this problem, we found the link to this search guide. It doesn't mention that the solution costs money. The solution we provided doesn't. –  Kevin Panko Oct 11 '13 at 3:41
    
No, it doesn't. You don't need to buy the program. Don't even scan PC with it. Just click "Tools" and "Reset browser settings". This will remove qone8.com –  user234931 Oct 19 '13 at 16:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.