X
Tap here to go to the mobile version of the site.

Support Forum

How do I remove "bestwaytosearch.com"

Posted

Hi,

Each time I start Firefox I get a warning pop-up from malwarebytes advising me of an outbound request from Firefox to a malicious site "bestwaytosearch.com". I have checked the home page settings and reset it, checked the search engines along with add-in and extensions. I have also cleared the history and browsing cache but just can not get rid of it.

Yes I can exclude it but that would only mask the problem.

Regards Ian

Hi, Each time I start Firefox I get a warning pop-up from malwarebytes advising me of an outbound request from Firefox to a malicious site "bestwaytosearch.com". I have checked the home page settings and reset it, checked the search engines along with add-in and extensions. I have also cleared the history and browsing cache but just can not get rid of it. Yes I can exclude it but that would only mask the problem. Regards Ian

Chosen solution

Did you check the search engines in "Options/Preferences > Search"?

In Firefox Safe mode these changes are effective:

  • all extensions are disabled (about:addons)
  • default theme is used (no persona)
  • userChrome.css and userContent.css are ignored (chrome folder in profile folder)
  • default toolbar layout is used
  • JavaScript JIT compilers are disabled
  • hardware acceleration is disabled (Options > Advanced > General)
  • plugins are not affected
  • preferences are not affected

Try to delete the search.json file and possible search-metadata.json and search.sqlite files in the Firefox profile folder to reset the search engines to the default.

Firefox will rebuild the search.json file from the default search engines in the "browser\searchplugins" folder in the Firefox program folder and the searchplugins folder in the Firefox profile folder.

You can try to create a new profile as a test to check if your current profile is causing the problem.

See "Creating a profile":

If the new profile works then you can transfer files from a previously used profile to the new profile, but be cautious not to copy corrupted files to avoid carrying over problems.

Read this answer in context 1

Additional System Details

Installed Plug-ins

  • CANON iMAGE GATEWAY Album Plugin Utility Module for IJ
  • Foxit Reader Plug-In For Firefox and Netscape
  • Plugin for Glance screen sharing service
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Next Generation Java Plug-in 11.31.2 for Mozilla browsers
  • Plug-in for detecting Nero Kwik Media.
  • Shockwave Flash 17.0 r0
  • 5.1.30514.0
  • WildTangent Games App V2 Presence Detector

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0

More Information

FredMcD
  • Top 10 Contributor
4246 solutions 59405 answers

Further information can be found in the Troubleshoot Firefox issues caused by malware article.

Further information can be found in the [[Troubleshoot Firefox issues caused by malware]] article.

Question owner

Thank you for the reply. I have followed these steps already unfortunately has not resolved the issue.

Thank you for the reply. I have followed these steps already unfortunately has not resolved the issue.
FredMcD
  • Top 10 Contributor
4246 solutions 59405 answers

That is very odd. Did you try all of the scanners?

Check the programs that are on your computer

Windows: Start > Control Panel > Uninstall Programs. Mac: Open the "Applications" folder. Linux: Check your user manual.

Go thru the list. If you find something that you don't know what it is, use a web search.

That is very odd. Did you try all of the scanners? Check the programs that are on your computer '''Windows:''' Start > Control Panel > Uninstall Programs. '''Mac:''' Open the "Applications" folder. '''Linux:''' Check your user manual. Go thru the list. If you find something that you don't know what it is, use a web search.
cor-el
  • Top 10 Contributor
  • Moderator
17476 solutions 157949 answers

You can open the about:config page via the location/address bar and search for prefs that refer to bestwaytosearch.com. You can reset user set (bold) prefs via the right-click context menu to the default value.

You can remove all data stored in Firefox from a specific domain via "Forget About This Site" in the right-click context menu of an history entry ("History > Show All History" or "View > Sidebar > History") or via the about:permissions page.

Using "Forget About This Site" will remove all data stored in Firefox from that domain like bookmarks, cookies, passwords, cache, history, and exceptions, so be cautious and if you have a password or other data from that domain that you do not want to lose then make sure to backup this data or make a note.

You can't recover from this 'forget' unless you have a backup of the involved files.

It doesn't have any lasting effect, so if you revisit such a 'forgotten' website then data from that website will be saved once again.

You can open the <b>about:config</b> page via the location/address bar and search for prefs that refer to <b>bestwaytosearch.com</b>. You can reset user set (bold) prefs via the right-click context menu to the default value. You can remove all data stored in Firefox from a specific domain via "Forget About This Site" in the right-click context menu of an history entry ("History > Show All History" or "View > Sidebar > History") or via the about:permissions page. Using "Forget About This Site" will remove all data stored in Firefox from that domain like bookmarks, cookies, passwords, cache, history, and exceptions, so be cautious and if you have a password or other data from that domain that you do not want to lose then make sure to backup this data or make a note. You can't recover from this 'forget' unless you have a backup of the involved files. It doesn't have any lasting effect, so if you revisit such a 'forgotten' website then data from that website will be saved once again.

Question owner

Hi,

Two good replies but unfortunately have not helped. I have already checked for installed programs that was one of the first things. The about config did not reveal anything (thank you I did not know about this) The only thing in the history was my searches to find out how to remove this problem. Attached is an image of the alert I get.

Thanks for the help.

Hi, Two good replies but unfortunately have not helped. I have already checked for installed programs that was one of the first things. The about config did not reveal anything (thank you I did not know about this) The only thing in the history was my searches to find out how to remove this problem. Attached is an image of the alert I get. Thanks for the help.
FredMcD
  • Top 10 Contributor
4246 solutions 59405 answers

I want you to follow these directions Carefully ! !

Close all other programs

Open the Windows side bar. In the search bar, type regedit. When that entry shows up, start it. Let the program open.

At the top of the window is a search bar. Enter; bestwaytosearch Searching may take some time. If the search finds this someplace, right click the " tree branch " ( see clip ) and delete that branch ONLY. Now press F3 to continue the search. Repeat until done. Then reboot the computer.

I want you to follow these directions '''Carefully ! !''' '''Close all other programs''' Open the Windows side bar. In the search bar, type '''regedit.''' When that entry shows up, start it. Let the program open. At the top of the window is a search bar. Enter; '''bestwaytosearch''' Searching may take some time. If the search finds this someplace, right click the " tree branch " ( see clip ) and delete that branch ONLY. Now press F3 to continue the search. Repeat until done. Then reboot the computer.

Question owner

Thanks FredMcD, I am afraid I have already tried that and it was not found.

Thanks FredMcD, I am afraid I have already tried that and it was not found.
cor-el
  • Top 10 Contributor
  • Moderator
17476 solutions 157949 answers

You can give this program a try:

Note that the screenshot shows firefox.exe in the updated folder. This means that Firefox has updated of was updating when Malware bytes noticed this problem. To finish the update Firefox should be moving the files in this folder to the main Firefox Firefox program folder. So it is possible that something went wrong with updating or you didn't install a Firefox version from the Mozilla server or this is a false positive and Malware bytes did a reverse DNS look up to resolve an IP.


Do a clean reinstall and delete the Firefox program folder before (re)installing a fresh copy of the current Firefox release.

If possible uninstall your current Firefox version to cleanup the Windows registry and settings in security software.

  • Do NOT remove "personal data" when you uninstall your current Firefox version, because this will remove all profile folders and you lose personal data like bookmarks and passwords including data in profiles created by other Firefox versions.

Remove the Firefox program folder before installing that newly downloaded copy of the Firefox installer.

  • (32 bit Windows) "C:\Program Files\Mozilla Firefox\"
  • (64 bit Windows) "C:\Program Files (x86)\Mozilla Firefox\"

Your bookmarks and other personal data are stored in the Firefox profile folder and won't be affected by an uninstall and (re)install, but make sure NOT to remove personal data when you uninstall Firefox as that will remove all Firefox profile folders and you lose your personal data.


You can give this program a try: *AdwCleaner:<br>http://www.bleepingcomputer.com/download/adwcleaner/<br>http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml Note that the screenshot shows firefox.exe in the updated folder. This means that Firefox has updated of was updating when Malware bytes noticed this problem. To finish the update Firefox should be moving the files in this folder to the main Firefox Firefox program folder. So it is possible that something went wrong with updating or you didn't install a Firefox version from the Mozilla server or this is a false positive and Malware bytes did a reverse DNS look up to resolve an IP. ---- Do a clean reinstall and delete the Firefox program folder before (re)installing a fresh copy of the current Firefox release. *Download the full Firefox installer and save the file to the desktop<br>https://www.mozilla.org/en-US/firefox/all/ If possible uninstall your current Firefox version to cleanup the Windows registry and settings in security software. *Do NOT remove "personal data" when you uninstall your current Firefox version, because this will remove all profile folders and you lose personal data like bookmarks and passwords including data in profiles created by other Firefox versions. Remove the Firefox program folder before installing that newly downloaded copy of the Firefox installer. *(32 bit Windows) "C:\Program Files\Mozilla Firefox\" *(64 bit Windows) "C:\Program Files (x86)\Mozilla Firefox\" *It is important to delete the Firefox program folder to remove all the files and make sure that there are no problems with files that were leftover after uninstalling. *http://kb.mozillazine.org/Uninstalling_Firefox Your bookmarks and other personal data are stored in the Firefox profile folder and won't be affected by an uninstall and (re)install, but make sure NOT to remove personal data when you uninstall Firefox as that will remove all Firefox profile folders and you lose your personal data. ---- *http://kb.mozillazine.org/Profile_folder_-_Firefox *http://kb.mozillazine.org/Profile_backup *http://kb.mozillazine.org/Standard_diagnostic_-_Firefox#Clean_reinstall

Question owner

Hi cor-el,

Many thanks for your help.

Well I did all that but as you can see from the new screen shot it was unsuccessful.

Hi cor-el, Many thanks for your help. Well I did all that but as you can see from the new screen shot it was unsuccessful.
jscher2000
  • Top 10 Contributor
8695 solutions 71066 answers

Some troublesome extensions can be very innocently named. To rule those out as potential culprits, have you tested in Firefox's Safe Mode? That's a standard diagnostic tool to deactivate extensions and some advanced features of Firefox. More info: Troubleshoot Firefox issues using Safe Mode.

You can restart Firefox in Safe Mode using either:

  • "3-bar" menu button > "?" button > Restart with Add-ons Disabled
  • Help menu > Restart with Add-ons Disabled

Not all add-ons are disabled: Flash and other plugins still run

After Firefox shuts down, a small dialog should appear. Click "Start in Safe Mode" (not Reset).

Any difference?

Some troublesome extensions can be very innocently named. To rule those out as potential culprits, have you tested in Firefox's Safe Mode? That's a standard diagnostic tool to deactivate extensions and some advanced features of Firefox. More info: [[Troubleshoot Firefox issues using Safe Mode]]. You can restart Firefox in Safe Mode using either: * "3-bar" menu button > "?" button > Restart with Add-ons Disabled * Help menu > Restart with Add-ons Disabled Not all add-ons are disabled: Flash and other plugins still run After Firefox shuts down, a small dialog should appear. Click "Start in Safe Mode" (''not'' Reset). Any difference?

Question owner

Hi scher2000,

In "safe mode" it would appear that I do not get the warning. You may be on to something at last.

What next?

Hi scher2000, In "safe mode" it would appear that I do not get the warning. You may be on to something at last. What next?
jscher2000
  • Top 10 Contributor
8695 solutions 71066 answers

Do you want to post a list of your extensions for comment, or do you want to try the elimination test where you disable everything you don't expect to use for the next 24 hours and then see if that gets rid of the unwanted retrieval?

You can disable nonessential or unrecognized extensions on the Add-ons page. Either:

  • Ctrl+Shift+a
  • "3-bar" menu button (or Tools menu) > Add-ons

In the left column, click Extensions. Then, if you don't plan to use it for the next 24 hours, disable.

Often a link will appear above at least one disabled extension to restart Firefox. You can complete your work on the tab and click one of the links as the last step.


To post your list of extensions, you can copy/paste from this page (3 ways to get there):

  • "3-bar" menu button > "?" button > Troubleshooting Information
  • (menu bar) Help > Troubleshooting Information
  • type or paste about:support in the address bar and press Enter

Extensions are in the third table on the page.

It might be equally messy, but there is a button in the upper left of the page to copy the page to the clipboard instead of selecting.

Do you want to post a list of your extensions for comment, or do you want to try the elimination test where you disable everything you don't expect to use for the next 24 hours and then see if that gets rid of the unwanted retrieval? You can disable nonessential or unrecognized extensions on the Add-ons page. Either: * Ctrl+Shift+a * "3-bar" menu button (or Tools menu) > Add-ons In the left column, click Extensions. Then, if you don't plan to use it for the next 24 hours, disable. Often a link will appear above at least one disabled extension to restart Firefox. You can complete your work on the tab and click one of the links as the last step. ---- To post your list of extensions, you can copy/paste from this page (3 ways to get there): * "3-bar" menu button > "?" button > Troubleshooting Information * (menu bar) Help > Troubleshooting Information * type or paste about:support in the address bar and press Enter Extensions are in the third table on the page. It might be equally messy, but there is a button in the upper left of the page to copy the page to the clipboard instead of selecting.

Question owner

Hi jscher2000

Well I have disabled all "Add-ons" but did not fix the issue. In "Safe Mode" it does still seem to have fixed it.

Thanks for your help. If you have Teamviewer I could let you have a look.

Hi jscher2000 Well I have disabled all "Add-ons" but did not fix the issue. In "Safe Mode" it does still seem to have fixed it. Thanks for your help. If you have Teamviewer I could let you have a look.
user1192079 0 solutions 19 answers

This appears to be a third-party application interfering with the web-browser or it could be a plugin, i also recommend getting a Anti-Virus Such as AVG

This appears to be a third-party application interfering with the web-browser or it could be a plugin, i also recommend getting a Anti-Virus Such as [http://www.avg.com/us-en/thank-you?product=avc&build=ppc_avc-welcomecmp AVG]
jscher2000
  • Top 10 Contributor
8695 solutions 71066 answers

Do you use a custom theme? On the Add-ons page, you would check the Appearance category.

Do you recall ever creating a userContent.css or userChrome.css file to customize Firefox's UI or various web pages?

There might be other Safe Mode differences that are slipping my mind.

Do you use a custom theme? On the Add-ons page, you would check the Appearance category. Do you recall ever creating a userContent.css or userChrome.css file to customize Firefox's UI or various web pages? There might be other Safe Mode differences that are slipping my mind.

Question owner

Hi jscher2000,

No I use the standard settings (too difficult for me to mess with). This is now starting to really BUG ME!

FireMod,

Thanks but I most defiantly have A/V installed and very active.

Hi jscher2000, No I use the standard settings (too difficult for me to mess with). This is now starting to really BUG ME! FireMod, Thanks but I most defiantly have A/V installed and very active.
jscher2000
  • Top 10 Contributor
8695 solutions 71066 answers

Do you want to post your extension list for review?

Do you want to post your extension list for review?
cor-el
  • Top 10 Contributor
  • Moderator
17476 solutions 157949 answers

Chosen Solution

Did you check the search engines in "Options/Preferences > Search"?

In Firefox Safe mode these changes are effective:

  • all extensions are disabled (about:addons)
  • default theme is used (no persona)
  • userChrome.css and userContent.css are ignored (chrome folder in profile folder)
  • default toolbar layout is used
  • JavaScript JIT compilers are disabled
  • hardware acceleration is disabled (Options > Advanced > General)
  • plugins are not affected
  • preferences are not affected

Try to delete the search.json file and possible search-metadata.json and search.sqlite files in the Firefox profile folder to reset the search engines to the default.

Firefox will rebuild the search.json file from the default search engines in the "browser\searchplugins" folder in the Firefox program folder and the searchplugins folder in the Firefox profile folder.

You can try to create a new profile as a test to check if your current profile is causing the problem.

See "Creating a profile":

If the new profile works then you can transfer files from a previously used profile to the new profile, but be cautious not to copy corrupted files to avoid carrying over problems.

Did you check the search engines in "Options/Preferences > Search"? In Firefox Safe mode these changes are effective: *all extensions are disabled (about:addons) *default theme is used (no persona) *userChrome.css and userContent.css are ignored (chrome folder in profile folder) *default toolbar layout is used *JavaScript JIT compilers are disabled *hardware acceleration is disabled (Options > Advanced > General) *plugins are not affected *preferences are not affected ---- Try to delete the search.json file and possible search-metadata.json and search.sqlite files in the Firefox profile folder to reset the search engines to the default. *http://kb.mozillazine.org/Profile_folder_-_Firefox Firefox will rebuild the search.json file from the default search engines in the "browser\searchplugins" folder in the Firefox program folder and the searchplugins folder in the Firefox profile folder. You can try to create a new profile as a test to check if your current profile is causing the problem. See "Creating a profile": *https://support.mozilla.org/kb/profile-manager-create-and-remove-firefox-profiles *http://kb.mozillazine.org/Standard_diagnostic_-_Firefox#Profile_issues If the new profile works then you can transfer files from a previously used profile to the new profile, but be cautious not to copy corrupted files to avoid carrying over problems. *http://kb.mozillazine.org/Transferring_data_to_a_new_profile_-_Firefox
FredMcD
  • Top 10 Contributor
4246 solutions 59405 answers

Helpful Reply

Follow cor-el instructions to create a new blank profile. Use it but make no changes. Is the problem still there?

Follow '''cor-el''' instructions to create a '''new blank''' profile. Use it but make no changes. Is the problem still there?

Question owner

Thank you all,

This last procedure led me to the solution. I found that even though the extension was deleted from within Firefox it had not been deleted from the profile. I found that in the default profile directory (default is the normal profile I have) there is an "searchplugins" folder there there 2 .xml files one of which was the onesearch.xml and the other mozilla-support.xml. I re-named the onesearch.xml to onesearch.xm, re-started Firefox and hey presto problem gone.

Brilliant guys and many thanks for the help.

Thank you all, This last procedure led me to the solution. I found that even though the extension was deleted from within Firefox it had not been deleted from the profile. I found that in the default profile directory (default is the normal profile I have) there is an "searchplugins" folder there there 2 .xml files one of which was the onesearch.xml and the other mozilla-support.xml. I re-named the onesearch.xml to onesearch.xm, re-started Firefox and hey presto problem gone. Brilliant guys and many thanks for the help.