X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

How to deal with rogue diverter www.bywill.net in Google.

Posted

When desired site is clicked in Google www.bywill.net appears in the destination window instead of the site address listed and a different site is displayed. This happens with IE as well as Firefox. Repeated searches by McAfee disclose no viruses. They suggested site blocking but this only stops bywell displaying its chosen site.

Chosen solution

Hi Geoff, please do the following.

Download the free version of Malwarebytes from http://www.malwarebytes.org/products/malwarebytes_free and run a full system scan to eliminate malware as the culprit as is often the case.

Next:

  1. Go to about:config again and then in the filter at the top, type: bywell

  2. For every entry which appears with that name in it, right click it and choose "Reset".

  3. Close Firefox and then restart it again to complete the removal.


If all else fails...

  1. Click "Help" | "Restart with add-ons disabled".

  2. Checkmark "Reset all user preferences to Firefox defaults"

  3. Click "Make Changes and restart".

This will remove all your customizations and add-ons and restore Firefox to a virgin state.

Read this answer in context 7

Additional System Details

Sites Affected

http://www.bywill.net

Installed Plug-ins

  • Picasa plugin
  • Next Generation Java Plug-in 1.6.0_24 for Mozilla browsers
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • McAfee MSC FF plugin DLL
  • McAfee Virtual Technician plugin for Mozilla (Gecko Version: 1.8b1)
  • 4.0.60310.0
  • Windows Presentation Foundation (WPF) plug-in for Mozilla browsers
  • Adobe PDF Plug-In For Firefox and Netscape "9.4.4"
  • Npdsplay dll
  • DRM Store Netscape Plugin
  • DRM Netscape Network Object

Application

  • User Agent: Mozilla/5.0 (Windows NT 5.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

More Information

Xircal 334 solutions 3835 answers

Helpful Reply

To revert to Google as your preferred search engine, please do the following.


  • In the location bar, type about:config and hit Enter.
  • In the filter at the top, type: keyword.URL
  • Double click it and remove whatever's in there and replace it with http://www.google.com/search?q=


The URL to add in "keyword.URL" becomes a link in this post, so right click it and choose "Copy Link Location" to copy it to the Windows clipboard. Then hit CTRL+V to paste it. Saves you having to type the whole thing.


To reset your home page, do the following.


  • Go to the site you want to set as your homepage.
  • Click the orange Firefox button and go to Options | Options | General (Firefox 4.0.x and above).
  • Go to Tools | Options | General (Previous version of Firefox).
  • Make sure it says "Show My Homepage" in the first dropdown menu.
  • Click the button called "Use Current Pages" to set the homepage to the one you have on the screen.

After you complete the above steps, install this add-on to prevent another search engine from modifying your preferences: https://addons.mozilla.org/en-US/firefox/addon/browserprotect/


If the problem persists, then you probably have the Google Redirect Virus on your system. In that particular case, follow instructions here to remove it: http://deletemalware.blogspot.com/2010/02/remove-google-redirect-virus.html

Question owner

Thank you Xircal. Unfortunately the procedure fell at the first hurdle. Entered about:config and the message 'Navigation to the web page was canceled' appeared. Retyped the entry as suggested as something to try with the same result. Hope you might have a better suggestion.

Question owner

Ignore my previous message. Iam doing better now that I am in Firefox instead of Internet Explorer. However I don't quite understand the section beginning 'The URL to add.... ' Right clicking 'keyword.URL' and the google address does not elicit a 'Copy Link Location' option so there I am stuck. Incidentally I am 83 so please be tolerant.

Xircal 334 solutions 3835 answers

Hi Geoff,

OK, I'll try and explain it a bit better.

First of all though, do you have "AVG Safe Search" installed? This blocks the use of the Enter key after you type in a web address. If so, click the orange Firefox button, go to Add-ons, then Extensions and then disable it in there.

The location bar is where you normally type in a web address or "URL". The latter is an acronym for "Universal Resource Locator" which is web parlance for 'home address'.

So, you type in about:config in the location bar and then hit Enter. This loads a list of all the configuration values in Firefox. To isolate the one we want, we use the filter at the top. In there, you type: keyword.URL

This isolates that single value. Next, double click it as shown in the screenshot to get the dialog box (a dialog box is a window where you can type something in).

Next, delete the contents and replace it with http://www.google.com/search?q=

Then close about:config.

When I mentioned right clicking the URL (the link) and choosing "Copy Link Location", this is just a way of copying a web link so that you don't have to type the whole thing when you want to paste it somewhere.

If you're still not clear about something, please say.

Question owner

Thanks again, Xircal, for your time and patience. Completed the routine including downloading Browser Protect but, alas, bywell.net still reigns. What it has done in IE to protect itself indicates a very cunning mind at work. McAfee have just come up with a comprehensive plan to counter it which I will now try with fingers crossed.

Xircal 334 solutions 3835 answers

Chosen Solution

Hi Geoff, please do the following.

Download the free version of Malwarebytes from http://www.malwarebytes.org/products/malwarebytes_free and run a full system scan to eliminate malware as the culprit as is often the case.

Next:

  1. Go to about:config again and then in the filter at the top, type: bywell

  2. For every entry which appears with that name in it, right click it and choose "Reset".

  3. Close Firefox and then restart it again to complete the removal.


If all else fails...

  1. Click "Help" | "Restart with add-ons disabled".

  2. Checkmark "Reset all user preferences to Firefox defaults"

  3. Click "Make Changes and restart".

This will remove all your customizations and add-ons and restore Firefox to a virgin state.

Question owner

As my acquaintance with Firefox only started two days ago decided to go for the ultimate solution and the indications are that it has worked. Two sites that have consistently given trouble were OK but only time will tell. Thanks again.

Xircal 334 solutions 3835 answers

Well, that's good to hear.

Could you please click the "Solved It" button next to the post which solved the problem for you? This will help others searching for a solution to the same question.

I'll leave your post enabled for email updates so that if the problem recurs, all you need do is post in this thread again and I'll get an email from Mozilla.


There are some tips here in case they're of any use to you: https://support.mozilla.com/en-US/home

Question owner

Did as you requested but "an error in making your vote" message came up. As the button has disappeared think it probably registered. Will log in again and repeat the procedure if the button is still there.

Xircal 334 solutions 3835 answers

It seems to have worked now, but thanks for the tip.

1merlin1 0 solutions 5 answers

OK, I know this is probably a lame question, but where is the "Location Bar" and from what screen do I do this? Malwarebites, (which I purchased because it didn't catch this redirect so I bought it thinking the full version was better), still didn't catch this.

Please don't think I'm being funny, I don't know what you're referring to.

1merlin1 0 solutions 5 answers

From what screen do I do this?

Next:

   Go to about:config again and then in the filter at the top, type: bywell
   For every entry which appears with that name in it, right click it and choose "Reset".
   Close Firefox and then restart it again to complete the removal.
Xircal 334 solutions 3835 answers

@ 1merlin1, the location bar is where you type a web address. See Location bar (Watch the movie)

You type about:config in the location bar. See screenshot for an example.

In the filter at the top, you type bywell instead of keyword.URL which you see in the screenshot. This will list all the entries with that word in it. In the second screenshot on the right, I've isolated all the entries with the word "google" in them.

To return an entry to its default value, you right click it and choose "Reset" from the menu.

Question owner

Xircal. Regret to report that bywill.net is back with a vengeance. Practically every Google entry I select is now redirected. Please note the correct spelling but this is not the problem with 1merlin1's reconfiguring. When I tried it nothing containing bywill was displayed. Geoff.

Xircal 334 solutions 3835 answers

Hi Geoff, please go to about:config again and then to keyword.URL

Right click it and choose "Copy Value".

Close about:config, come back to your post here and then right click and choose Paste from the menu.

Modified by Xircal

Question owner

Xircal. Tried to oblige but nothing happened! The fact that there is no value displayed might have something to do with that.

Xircal 334 solutions 3835 answers

OK, then double click it and copy/paste the following URL: http://www.google.com/search?q=

Question owner

Xircal As requested http://www.google.com/search?q=

Xircal 334 solutions 3835 answers

So what happened? Is it still going to bywill?

Question owner

Not at the moment but the problem has become intermittent so will give it a day or two before rejoicing. Will let you know what happens.