New
#1
Yahoo hijack about:config keyword- I'm stuck
I caught some malware yesterday (Spigot definitely one of them) which causes hotlinks on some pages in Firefox to redirect to Yahoo search results pages. After running Adwcleaner, it looked like Spigot and a number of other things were removed.
The Yahoo problem remains however. I cleared cookies, and also went to about:config from the address field. There, entered keyword and reset "keyword URL" (in bold).
The Yahoo problem remains still.
about:config currently has these Yahoo lines:
browser.contentHandlers.types.0.title;My Yahoo!
browser.contentHandlers.types.0.uri;http://add.my.yahoo.com/rss?url=%s
browser.search.order.2;Yahoo
browser.search.param.yahoo-fr;moz35
browser.search.param.yahoo-fr-cjkt;moz35
browser.search.param.yahoo-fr-ja;mozff
THIS ONE IN BOLD
extensions.wrc.SearchRules.yahoo.com.style;.WRCN {display:none} .sm-hd .WRCN, .sm-links .WRCN, .res h3 > .WRCN {display:inline !important; background: url("IMAGE") right no-repeat}
THIS ONE IN BOLD
extensions.wrc.SearchRules.yahoo.com.url;^http(s)?\:\/\/((.)+\.)?search\.yahoo\.com\/(.)*
gecko.handlerService.schemes.mailto.0.name;Yahoo! Mail
gecko.handlerService.schemes.mailto.0.uriTemplate;https://compose.mail.yahoo.com/?To=%s
THIS ONE IN BOLD
startpage.ntsearch_url;http://search.yahoo.com/search?fr=spigot-nt-ff&ei=utf-8&ilc=12&type=888596&p={searchTerms}
The keyword entry now shows these lines:
THIS ONE IN BOLD
avg.install.disableKeywordSearch;false
THIS ONE IN BOLD
browser.keywordURLPromptDeclined;1
keyword.enabled;true
Any advice on how to go from here to get rid of Yahoo? I don't know what to do with the Yahoo results in about:config. The context menu does not have 'delete' when right-clicking on any of them. Modify, toggle etc. a few others..
edit: nothing suspicious in Firefox Addons Extensions, btw.