First picture has been added 3 times and each of the other 2 pictures have been added 2 times!

Tried to delete additional files but to no avail. After clicking on X button, a dialog came up and asked me where I am sure or not, but my confirmation didn't make any change! I had encounter this problem in other sites too. Is it related to FF or what?

Hi,

Even though search.yahoo.com is a legitimate search engine - you may be dealing with search.yahoo.com redirect virus, malware that you will of course need to get rid of.

Go to the 3-bar menu (or 'Tools') => Addons => Extensions and look for any unfamiliar or suspicious looking extensions.

When you find any : remove them.

Do the same in your system's Control Panel.

However : most malware will be 'hiding' somewhere , so let's run malware scans (even though you already have run some) :

Further information can be found in this article : https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware?cache=no

Run most or all of the listed malware scanners. They all work differently - what one program doesn't pick up, the other might.

Also see : https://www.bleepingcomputer.com/virus-removal/remove-search.yahoo.com-search-results-redirect

And : https://www.pcrisk.com/removal-guides/8835-search-yahoo-com-redirect

If that doesn't help you get rid of it, please let us know.

I found no unfamiliar extension, addon or program.

In the past days, I ran all of those malware scanners for several times, but that malware still is there!!!

As you see in the picture, in search options of mine exist 2 different yahoo search engine. Legitimate one has a purple icon and it's name is "Yahoo". Malware one has no icon and it's name is "Yahoo! Search Engine".

Also as you can see in another picture, I have found several "Yahoo" entries in registry!!! Yahoo is no part of Microsoft and I have never installed anything relating to Yahoo, but those entries exist in places that changing them violates Windows Policy!!!

So how can I get rid of this malware which seems to be new?

can you try adwcleaner too? https://toolslib.net/downloads/viewdownload/1-adwcleaner/

philipp said

can you try adwcleaner too? https://toolslib.net/downloads/viewdownload/1-adwcleaner/

Malware scanners removed legitimate one instead of the malware! Adwcleaner found a lot of things, most of which were not malware, for example it had detected many files of "Advanced SystemCare Ultimate" !!! After unchecking files of familiar programs, cleaned the rest. Then I had to restart and my windows wouldn't come up! Windows repaired itself and booted up. Adwcleaner has erased whatever that would change FireFox's search settings on exit, but malware still exist where it was! I mean that illegitimate search engine in search settings and above-mentioned registry entries still exist! Meaning that it may revive! So how to cure this ill situation?!?

Hi again  !

In Options => Search => under 'One-Click Search Engines' : is that 'Yahoo! Search Engine' listed there as well  ?

If so : would you please remove it and see if that will make a difference  ?

Hi esmetozerbezan, if you select "Yahoo! Search Engine" in the One-click box and click the Remove button, does it return at the next startup?

If it returns:

Could you check for alien script files in your Firefox program folder? In particular, in these locations (varies for 32-bit / 64-bit):

• C:\Program Files\Mozilla Firefox\defaults\pref
• C:\Program Files (x86)\Mozilla Firefox\defaults\pref

Caution: Do not double-click script files! The default action for a script file it to execute as a Windows system script. (Typically this would just not work, but why risk it.)

Make sure Windows is showing hidden files: https://support.microsoft.com/en-us/help/14201/windows-show-hidden-files

A file named channel-prefs.js is normal. Any other file in this folder is suspicious -- for example, dsengine.js (added by Lavasoft/AdAware Web Companion). Remove any such files to a neutral location for further analysis at your leisure.

The regular Yahoo search plugin apparently is being removed from the built-in search plugins, so it will now need to be added on. If it is one of the sites you want to use, here are ways you can do that:

(1) While on Yahoo's search results page, with Firefox's Search Bar visible on the toolbar, click the magnifying glass with the green "+" icon and add the search engine from the drop-down.

(2) Choose from among the many choices in category 15 on this page: http://mycroftproject.com/yahoo-search-plugins.html

(3) For English-language results, I have posted some options here: https://www.userchrome.org/yahooxml.html ; if there are other languages I should add, let me know.

Happy112 said

Hi again  ! In Options => Search => under 'One-Click Search Engines' : is that 'Yahoo! Search Engine' listed there as well  ? If so : would you please remove it and see if that will make a difference  ?

Hi again

This action returned me where I was!!! I mean after using Adwcleaner that deleted some system stuff, default search engine has been returned to "Google" and it wouldn't change on exit but after deleting that malware search engine, this headache returned back!!!

jscher2000 said

Hi esmetozerbezan, if you select "Yahoo! Search Engine" in the One-click box and click the Remove button, does it return at the next startup? If it returns: Could you check for alien script files in your Firefox program folder? In particular, in these locations (varies for 32-bit / 64-bit):

• C:\Program Files\Mozilla Firefox\defaults\pref
• C:\Program Files (x86)\Mozilla Firefox\defaults\pref

Caution: Do not double-click script files! The default action for a script file it to execute as a Windows system script. (Typically this would just not work, but why risk it.) Make sure Windows is showing hidden files: https://support.microsoft.com/en-us/help/14201/windows-show-hidden-files A file named channel-prefs.js is normal. Any other file in this folder is suspicious -- for example, dsengine.js (added by Lavasoft/AdAware Web Companion). Remove any such files to a neutral location for further analysis at your leisure.

---

The regular Yahoo search plugin apparently is being removed from the built-in search plugins, so it will now need to be added on. If it is one of the sites you want to use, here are ways you can do that:

(1) While on Yahoo's search results page, with Firefox's Search Bar visible on the toolbar, click the magnifying glass with the green "+" icon and add the search engine from the drop-down.

(2) Choose from among the many choices in category 15 on this page: http://mycroftproject.com/yahoo-search-plugins.html

(3) For English-language results, I have posted some options here: https://www.userchrome.org/yahooxml.html ; if there are other languages I should add, let me know.

Hi It returned back. In that folder I just found those two js files that you mentioned but I deleted "dsengine.js" . I dislike Yahoo.

So now what?

try to let adwcleaner clean everything - even if you somewhat trust "Advanced SystemCare Ultimate", it is known to sneak in yahoo. also such tuneup tolls often do more harm than good...

philipp said

try to let adwcleaner clean everything - even if you somewhat trust "Advanced SystemCare Ultimate", it is known to sneak in yahoo. also such tuneup tolls often do more harm than good...

Hi Uninstalled "Web Companion" and "Advanced System Care" but those registry entries didn't change!!! Then I ran AdwCleaner for several times and tried to clean all results (except desktop links of Smart Defrag) but it was not able to do that!!!

Error message: ***Caught unhandled unknown exception; terminating

So now what?!?

Hi, try Hitman Pro, install as 1 time only use : https://www.hitmanpro.com/

Please let us know if this solved your issue or if need further assistance.

If need help :

• https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

Post in only 1 forum, then wait. Delete any cracked programs and torrent programs.

Please let us know if this solved your issue or if need further assistance.

Pkshadow said

Hi, try Hitman Pro, install as 1 time only use : https://www.hitmanpro.com/ Please let us know if this solved your issue or if need further assistance.

Both Hitman Pro and AdwCleaner are mentioned (more than once) in the links, provided in my first post in this thread ......

Pkshadow said

Hi, try Hitman Pro, install as 1 time only use : https://www.hitmanpro.com/ Please let us know if this solved your issue or if need further assistance.

Pkshadow said

If need help :

• https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

Post in only 1 forum, then wait. Delete any cracked programs and torrent programs. Please let us know if this solved your issue or if need further assistance.

Hi As Happy112 mentioned it before, both of them have been tried already. I should add to it that I have tried both of them for several times but unlike AdwCleaner , they found nothing. Probably this malware is new!

Not giving up just yet ....

Would you be so kind as to let us know which extensions you see listed in Options => Add-ons => Extensions  ?

Happy112 said

Not giving up just yet .... Would you be so kind as to let us know which extensions you see listed in Options => Add-ons => Extensions  ?

The first four extensions have been there from a long time ago. Fifth one has been installed when I was trying all of those malware scanners from your first post.

esmetozerbezan said

The first four extensions have been there from a long time ago. Fifth one has been installed when I was trying all of those malware scanners from your first post.

Thank you  ! Kaspersky showing up while you were running all those scans makes sense, but good for you to disable it - even though a lot of people use Kaspersky for their security software : others (including yours truly) think it is a pain in the toosh. I was hoping that your list would show something that would make me go "Bingo  !" - something like 'Yahoo! Search Engine', but alas ......

'Waiting for that "Aha" moment .....

Happy112 said

esmetozerbezan said

The first four extensions have been there from a long time ago. Fifth one has been installed when I was trying all of those malware scanners from your first post.

Thank you  ! Kaspersky showing up while you were running all those scans makes sense, but good for you to disable it - even though a lot of people use Kaspersky for their security software : others (including yours truly) think it is a pain in the toosh. I was hoping that your list would show something that would make me go "Bingo  !" - something like 'Yahoo! Search Engine', but alas ......

'Waiting for that "Aha" moment .....

As I said before, AdwCleaner has stopped midway of cleaning those files. After that, I managed to successfully remove that malware search engine from search section of FireFox's settings. Then searched for "yahoo" on my HDD. Among results, there was a folder with a name like "yahoo + +" somewhere under FireFox folders, which I deleted it. Also "yahoo-lavasoft.xml" has been found, but there is no trace of it's location!!! Right-click does not work upon this search result!!! Also one of the results has title of this web page and I can not right-click on it too!

So now what? Where and what is that fishy file?!?

can you boot into windows safemode with networking once and see if adwcleaner works uninterrupted there? https://support.microsoft.com/en-us/help/17419/windows-7-advanced-startup-options-safe-mode