Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

How do I remove "bestwaytosearch.com"

  • 22 replies
  • 4 have this problem
  • 4 views
  • Paskiausią atsakymą parašė IBulti

more options

Hi,

Each time I start Firefox I get a warning pop-up from malwarebytes advising me of an outbound request from Firefox to a malicious site "bestwaytosearch.com". I have checked the home page settings and reset it, checked the search engines along with add-in and extensions. I have also cleared the history and browsing cache but just can not get rid of it.

Yes I can exclude it but that would only mask the problem.

Regards Ian

Hi, Each time I start Firefox I get a warning pop-up from malwarebytes advising me of an outbound request from Firefox to a malicious site "bestwaytosearch.com". I have checked the home page settings and reset it, checked the search engines along with add-in and extensions. I have also cleared the history and browsing cache but just can not get rid of it. Yes I can exclude it but that would only mask the problem. Regards Ian

Chosen solution

Did you check the search engines in "Options/Preferences > Search"?

In Firefox Safe mode these changes are effective:

  • all extensions are disabled (about:addons)
  • default theme is used (no persona)
  • userChrome.css and userContent.css are ignored (chrome folder in profile folder)
  • default toolbar layout is used
  • JavaScript JIT compilers are disabled
  • hardware acceleration is disabled (Options > Advanced > General)
  • plugins are not affected
  • preferences are not affected

Try to delete the search.json file and possible search-metadata.json and search.sqlite files in the Firefox profile folder to reset the search engines to the default.

Firefox will rebuild the search.json file from the default search engines in the "browser\searchplugins" folder in the Firefox program folder and the searchplugins folder in the Firefox profile folder.

You can try to create a new profile as a test to check if your current profile is causing the problem.

See "Creating a profile":

If the new profile works then you can transfer files from a previously used profile to the new profile, but be cautious not to copy corrupted files to avoid carrying over problems.

Skaityti atsakymą kartu su kontekstu 👍 1

All Replies (20)

more options

Further information can be found in the Troubleshoot Firefox issues caused by malware article.

more options

Thank you for the reply. I have followed these steps already unfortunately has not resolved the issue.

more options

That is very odd. Did you try all of the scanners?

Check the programs that are on your computer

Windows: Start > Control Panel > Uninstall Programs. Mac: Open the "Applications" folder. Linux: Check your user manual.

Go thru the list. If you find something that you don't know what it is, use a web search.

more options

You can open the about:config page via the location/address bar and search for prefs that refer to bestwaytosearch.com. You can reset user set (bold) prefs via the right-click context menu to the default value.

You can remove all data stored in Firefox from a specific domain via "Forget About This Site" in the right-click context menu of an history entry ("History > Show All History" or "View > Sidebar > History") or via the about:permissions page.

Using "Forget About This Site" will remove all data stored in Firefox from that domain like bookmarks, cookies, passwords, cache, history, and exceptions, so be cautious and if you have a password or other data from that domain that you do not want to lose then make sure to backup this data or make a note.

You can't recover from this 'forget' unless you have a backup of the involved files.

It doesn't have any lasting effect, so if you revisit such a 'forgotten' website then data from that website will be saved once again.

more options

Hi,

Two good replies but unfortunately have not helped. I have already checked for installed programs that was one of the first things. The about config did not reveal anything (thank you I did not know about this) The only thing in the history was my searches to find out how to remove this problem. Attached is an image of the alert I get.

Thanks for the help.

more options

I want you to follow these directions Carefully ! !

Close all other programs

Open the Windows side bar. In the search bar, type regedit. When that entry shows up, start it. Let the program open.

At the top of the window is a search bar. Enter; bestwaytosearch Searching may take some time. If the search finds this someplace, right click the " tree branch " ( see clip ) and delete that branch ONLY. Now press F3 to continue the search. Repeat until done. Then reboot the computer.

more options

Thanks FredMcD, I am afraid I have already tried that and it was not found.

more options

You can give this program a try:

Note that the screenshot shows firefox.exe in the updated folder. This means that Firefox has updated of was updating when Malware bytes noticed this problem. To finish the update Firefox should be moving the files in this folder to the main Firefox Firefox program folder. So it is possible that something went wrong with updating or you didn't install a Firefox version from the Mozilla server or this is a false positive and Malware bytes did a reverse DNS look up to resolve an IP.


Do a clean reinstall and delete the Firefox program folder before (re)installing a fresh copy of the current Firefox release.

If possible uninstall your current Firefox version to cleanup the Windows registry and settings in security software.

  • Do NOT remove "personal data" when you uninstall your current Firefox version, because this will remove all profile folders and you lose personal data like bookmarks and passwords including data in profiles created by other Firefox versions.

Remove the Firefox program folder before installing that newly downloaded copy of the Firefox installer.

  • (32 bit Windows) "C:\Program Files\Mozilla Firefox\"
  • (64 bit Windows) "C:\Program Files (x86)\Mozilla Firefox\"

Your bookmarks and other personal data are stored in the Firefox profile folder and won't be affected by an uninstall and (re)install, but make sure NOT to remove personal data when you uninstall Firefox as that will remove all Firefox profile folders and you lose your personal data.


more options

Hi cor-el,

Many thanks for your help.

Well I did all that but as you can see from the new screen shot it was unsuccessful.

more options

Some troublesome extensions can be very innocently named. To rule those out as potential culprits, have you tested in Firefox's Safe Mode? That's a standard diagnostic tool to deactivate extensions and some advanced features of Firefox. More info: Diagnose Firefox issues using Troubleshoot Mode.

You can restart Firefox in Safe Mode using either:

  • "3-bar" menu button > "?" button > Restart with Add-ons Disabled
  • Help menu > Restart with Add-ons Disabled

Not all add-ons are disabled: Flash and other plugins still run

After Firefox shuts down, a small dialog should appear. Click "Start in Safe Mode" (not Reset).

Any difference?

more options

Hi scher2000,

In "safe mode" it would appear that I do not get the warning. You may be on to something at last.

What next?

more options

Do you want to post a list of your extensions for comment, or do you want to try the elimination test where you disable everything you don't expect to use for the next 24 hours and then see if that gets rid of the unwanted retrieval?

You can disable nonessential or unrecognized extensions on the Add-ons page. Either:

  • Ctrl+Shift+a
  • "3-bar" menu button (or Tools menu) > Add-ons

In the left column, click Extensions. Then, if you don't plan to use it for the next 24 hours, disable.

Often a link will appear above at least one disabled extension to restart Firefox. You can complete your work on the tab and click one of the links as the last step.


To post your list of extensions, you can copy/paste from this page (3 ways to get there):

  • "3-bar" menu button > "?" button > Troubleshooting Information
  • (menu bar) Help > Troubleshooting Information
  • type or paste about:support in the address bar and press Enter

Extensions are in the third table on the page.

It might be equally messy, but there is a button in the upper left of the page to copy the page to the clipboard instead of selecting.

more options

Hi jscher2000

Well I have disabled all "Add-ons" but did not fix the issue. In "Safe Mode" it does still seem to have fixed it.

Thanks for your help. If you have Teamviewer I could let you have a look.

more options

This appears to be a third-party application interfering with the web-browser or it could be a plugin, i also recommend getting a Anti-Virus Such as AVG

more options

Do you use a custom theme? On the Add-ons page, you would check the Appearance category.

Do you recall ever creating a userContent.css or userChrome.css file to customize Firefox's UI or various web pages?

There might be other Safe Mode differences that are slipping my mind.

more options

Hi jscher2000,

No I use the standard settings (too difficult for me to mess with). This is now starting to really BUG ME!

FireMod,

Thanks but I most defiantly have A/V installed and very active.

more options

Do you want to post your extension list for review?

more options

Chosen Solution

Did you check the search engines in "Options/Preferences > Search"?

In Firefox Safe mode these changes are effective:

  • all extensions are disabled (about:addons)
  • default theme is used (no persona)
  • userChrome.css and userContent.css are ignored (chrome folder in profile folder)
  • default toolbar layout is used
  • JavaScript JIT compilers are disabled
  • hardware acceleration is disabled (Options > Advanced > General)
  • plugins are not affected
  • preferences are not affected

Try to delete the search.json file and possible search-metadata.json and search.sqlite files in the Firefox profile folder to reset the search engines to the default.

Firefox will rebuild the search.json file from the default search engines in the "browser\searchplugins" folder in the Firefox program folder and the searchplugins folder in the Firefox profile folder.

You can try to create a new profile as a test to check if your current profile is causing the problem.

See "Creating a profile":

If the new profile works then you can transfer files from a previously used profile to the new profile, but be cautious not to copy corrupted files to avoid carrying over problems.

more options

Follow cor-el instructions to create a new blank profile. Use it but make no changes. Is the problem still there?

more options

Thank you all,

This last procedure led me to the solution. I found that even though the extension was deleted from within Firefox it had not been deleted from the profile. I found that in the default profile directory (default is the normal profile I have) there is an "searchplugins" folder there there 2 .xml files one of which was the onesearch.xml and the other mozilla-support.xml. I re-named the onesearch.xml to onesearch.xm, re-started Firefox and hey presto problem gone.

Brilliant guys and many thanks for the help.

  1. 1
  2. 2