How to remove hohosearch from Firefox for good?
Hy everyone, 2 days ago i installed a bad program which destroyed my entire system. At first Bitdefender warned me that is a dangerous file. But i needed the program so much , the comments arownd were so promicing .. and so - i turned off the Bitdefender antivirus.
During the installation, i saw that it tries to install a lot of stuff - unrelated to what i wanted - like browser addons, video converters, pc optimizers, bitcoin miners etc - was a hole bundle of them maybe 8 or 10, many pages), i declined everything - and by the end - the decline button was disabled - basically it was forcing me to install some bullshit program. Because of that, I close down the installation. Nothing to worry right? I immediately checked the task manager - nothing strange.. just the usual programs running..
But surprise!! It got installed anyway - in the background somehow - after not more that 8-10 minutes. ( I received a windows notification). I do this all the time. But i felt this was different - I freaked out - i navigated to the Downloads folder, in order to scan the install. I figured that by doing this, the antivirus was able to detect the way virus worked - the pattern of action - and remove it even after it was installed . I've done this a couple of times before and it worked like a charm.
But another surprise - which is more curious - the virus Deleted his own install, form the Downloads folder!! Both of them, because i download'it twice. So i was not be able to track it down.
Using IOBIT software - I uninstalled all the 7 or so - recent programs that i recognize as not being mine. Deep detection registers all of that. Iobit has even a extra antivirus which wasn't able to detect anything more.
This takes like 10-13 minutes. At the 15 minute mark Bitdefender turned on the protection automatically as previously set.. He also detected some corrupt files, and after a deep scan and some fixes - i got the message - the system is clean.
Except was not - Chrome and Firefox had this hohosearch as first page. I bought SpyHunter, which after almost 3 hour deep scan, was able to find 4000 or so - corrupt entities including HoHoSearch and Yes-search, and some other names hard to memorize - which were specifically targeting the browsers and the internet experience. After clicking " Fix all the issues " - my System crashed. I wasn't able to open any browser, no system explore, no task manager. I cliched everything, but nothing happened. 4-5 restarts. Nothing. I figured that SpyHunter is very good at identifying and fixing - but is so much better at breaking. Even after i imported the previously saved registers and have done 2 system restores nothing worked. Something was badly corupted.
All the above happened on a windows 7 professional. I decided to install a fresh copy of Windows 10 and with that, I formatted the entire hardware. SO there is Nothing to tie back to the first system.
Now Chrome works as expected. The first time i opened Firefox - it works as expected. Next, I logged into my account, to get the bookmarks.
But after the system was synchronized: Surprise - the hohoSearch is back again!!
HoHoSearch it's not present in Adons, It's not present In Extensions. But now, I know for sure that is somehow saved in the Firefox profile on the cloud - and it got on my system again - after synchronization.
This time is not that bad - i mean is not spreadable - is just a small chunk of the bundle with which it came. The Crome browser still works fine. But please, can you show me how to rely get rid of it in Firefox??
It has a uninstall button on the bottom right as you can see in the image attached below.. But I don't trust that.
Just because it will not bother me with the hohosearch first page next time i open Firefox - it doesn't necessarily mean it's out.
Maybe is recording my entire search experience. No way to tell. Considering what hassle i gone trough on windows - 3 antivirus software finding different stuff each, and no one being able to nail the hole thing... It's reasonable to be skeptic at this point.
So this is why i asked this question here. The people who build this are rely smart and rely dangerous.
I don't trust their "too easy to find" uninstall button, and i need expert help to tell me what should i do. To asure that is rely out. I usualy help myself - but deleting my Firefox profile from the cloud - is not an option at this point.
I tried to give you as much info as i could. Thank you in taking the time to read and respond to my question.
Chosen solution
Just a couple of comments in passing. SpyHunter is something I try to avoid. I am not sure I like its policies or some of the sites that promote it, and I think some of the free options and software can be as good.
Formatting the hdd & installing Win10 fresh should be a pretty failsafe and foolproof method of getting rid of malware, but of course there is then the cost of that. Using the free upgrades from Win7 etc to 10 will not always get rid of malware. I inherited a malware riddled Win7 laptop, even after removing what I thought was all the malware and upgrading to Win10 it still had problems for a while.
I note you are a firebug user. Have you kept up with the tools now built in to Firefox.
- https://developer.mozilla.org/docs/Tools
- https://developer.mozilla.org/en-US/docs/Tools/Settings#Choose_DevTools_theme
Some of these are not on by default in the Standard Release or may take time before they are even included.
Perhaps you will confirm Philipp's solution worked ?
Read this answer in context 👍 2All Replies (4)
hello, could you go to the firefox menu ≡ > help ? > troubleshooting information, copy the contents of that page and paste them here into a reply on the forum? this might give us a clue what is going on...
Application Basics
Name: Firefox Version: 47.0.1 Build ID: 20160623154057 Update Channel: release User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0 OS: Windows_NT 10.0 x86 Multiprocess Windows: 0/1 (Disabled) Safe Mode: false
Crash Reports for the Last 3 Days
All Crash Reports
Extensions
Name: ColorZilla Version: 2.8.2 Enabled: true ID: {6AC85730-7D0F-4de0-B3FA-21142DD85326}
Name: FireFile Version: 0.9.2.1-signed.1-signed Enabled: true ID: firefile@strebitzer.at
Name: Firefox Hello Version: 1.3.2 Enabled: true ID: loop@mozilla.org
Name: Multi-process staged rollout Version: 1.0 Enabled: true ID: e10srollout@mozilla.org
Name: Open Bookmarks in New Tab Version: 2.0.2016021001 Enabled: true ID: openbookmarkintab@piro.sakura.ne.jp
Name: Pocket Version: 1.0.2 Enabled: true ID: firefox@getpocket.com
Name: RescueTime Version: 3.0.224 Enabled: true ID: rescuetime_firefox@rescuetime.com
Name: Web Developer Version: 1.2.5.1-signed.1-signed Enabled: true ID: {c45c406e-ab73-11d8-be73-000a95be3b12}
Name: Firebug Version: 2.0.17 Enabled: false ID: firebug@software.joehewitt.com
Graphics
Adapter Description: NVIDIA GeForce GT 730 Adapter Drivers: nvd3dumx,nvwgf2umx,nvwgf2umx,nvwgf2umx nvd3dum,nvwgf2um,nvwgf2um,nvwgf2um Adapter RAM: 2048 Asynchronous Pan/Zoom: none Device ID: 0x1287 Direct2D Enabled: true DirectWrite Enabled: true (10.0.10586.0) Driver Date: 2-1-2016 Driver Version: 10.18.13.5940 GPU #2 Active: false GPU Accelerated Windows: 1/1 Direct3D 11 (OMTC) Subsys ID: 3e561642 Supports Hardware H264 Decoding: Yes Vendor ID: 0x10de WebGL Renderer: Google Inc. -- ANGLE (NVIDIA GeForce GT 730 Direct3D11 vs_5_0 ps_5_0) windowLayerManagerRemote: true AzureCanvasAccelerated: 0 AzureCanvasBackend: direct2d 1.1 AzureContentBackend: direct2d 1.1 AzureFallbackCanvasBackend: cairo
Important Modified Preferences
accessibility.lastLoadDate: 1467528300 accessibility.loadedInLastSession: true accessibility.typeaheadfind: true browser.cache.disk.capacity: 358400 browser.cache.disk.filesystem_reported: 1 browser.cache.disk.smart_size.first_run: false browser.cache.frecency_experiment: 4 browser.download.importedFromSqlite: true browser.places.smartBookmarksVersion: 7 browser.sessionstore.upgradeBackup.latestBuildID: 20160623154057 browser.startup.homepage: http://d2ucfwpxlh3zh3.cloudfront.net/?ts=AHEqBnArAnEmB0..&v=20160629&uid=72B9B597E282774FDE93B3D1C3B0CFED&ptid=amz&mode= browser.startup.homepage_override.buildID: 20160623154057 browser.startup.homepage_override.mstone: 47.0.1 browser.tabs.warnOnClose: false dom.apps.reset-permissions: true dom.mozApps.used: true extensions.lastAppVersion: 47.0.1 gfx.crash-guard.d3d11layers.appVersion: 47.0.1 gfx.crash-guard.d3d11layers.deviceID: 0x1287 gfx.crash-guard.d3d11layers.driverVersion: 10.18.13.5940 gfx.crash-guard.d3d11layers.feature-d2d: true gfx.crash-guard.d3d11layers.feature-d3d11: true gfx.crash-guard.status.d3d11layers: 2 gfx.crash-guard.status.d3d9video: 2 media.benchmark.vp9.fps: 119 media.benchmark.vp9.versioncheck: 1 media.gmp-eme-adobe.abi: x86-msvc-x64 media.gmp-eme-adobe.lastUpdate: 1467527292 media.gmp-eme-adobe.version: 17 media.gmp-gmpopenh264.abi: x86-msvc-x64 media.gmp-gmpopenh264.lastUpdate: 1467527293 media.gmp-gmpopenh264.version: 1.5.3 media.gmp-manager.buildID: 20160623154057 media.gmp-manager.lastCheck: 1467527284 media.gmp-widevinecdm.abi: x86-msvc-x64 media.gmp-widevinecdm.lastUpdate: 1467527299 media.gmp-widevinecdm.version: 1.4.8.866 media.gmp.storage.version.observed: 1 media.hardware-video-decoding.failed: false network.cookie.prefsMigrated: true network.predictor.cleaned-up: true places.history.expiration.transient_current_max_pages: 104858 plugin.disable_full_page_plugin_for_types: application/pdf plugin.importedState: true privacy.donottrackheader.enabled: true services.sync.declinedEngines: services.sync.engine.prefs.modified: false services.sync.lastPing: 1467527293 services.sync.lastSync: Sun Jul 03 2016 12:47:11 GMT+0300 (GTB Standard Time) services.sync.numClients: 3 ui.osk.debug.keyboardDisplayReason: IKPOS: Touch screen not found.
Important Locked Preferences
JavaScript
Incremental GC: true
Accessibility
Activated: false Prevent Accessibility: 0
Library Versions
NSPR Expected minimum version: 4.12 Version in use: 4.12
NSS Expected minimum version: 3.23 Basic ECC Version in use: 3.23 Basic ECC
NSSSMIME Expected minimum version: 3.23 Basic ECC Version in use: 3.23 Basic ECC
NSSSSL Expected minimum version: 3.23 Basic ECC Version in use: 3.23 Basic ECC
NSSUTIL Expected minimum version: 3.23 Version in use: 3.23
Experimental Features
thanks, this site was set as the default homepage in firefox which got transferred to your new installation through sync. the only thing you'll have to do to get rid of it in firefox is to set a different homepage: How to set the home page
Chosen Solution
Just a couple of comments in passing. SpyHunter is something I try to avoid. I am not sure I like its policies or some of the sites that promote it, and I think some of the free options and software can be as good.
Formatting the hdd & installing Win10 fresh should be a pretty failsafe and foolproof method of getting rid of malware, but of course there is then the cost of that. Using the free upgrades from Win7 etc to 10 will not always get rid of malware. I inherited a malware riddled Win7 laptop, even after removing what I thought was all the malware and upgrading to Win10 it still had problems for a while.
I note you are a firebug user. Have you kept up with the tools now built in to Firefox.
- https://developer.mozilla.org/docs/Tools
- https://developer.mozilla.org/en-US/docs/Tools/Settings#Choose_DevTools_theme
Some of these are not on by default in the Standard Release or may take time before they are even included.
Perhaps you will confirm Philipp's solution worked ?