Yahoo hijack about:config keyword- I'm stuck


  1. Posts : 108
    Windows 7 Pro 64bit
       #1

    Yahoo hijack about:config keyword- I'm stuck


    I caught some malware yesterday (Spigot definitely one of them) which causes hotlinks on some pages in Firefox to redirect to Yahoo search results pages. After running Adwcleaner, it looked like Spigot and a number of other things were removed.

    The Yahoo problem remains however. I cleared cookies, and also went to about:config from the address field. There, entered keyword and reset "keyword URL" (in bold).

    The Yahoo problem remains still.

    about:config currently has these Yahoo lines:

    browser.contentHandlers.types.0.title;My Yahoo!

    browser.contentHandlers.types.0.uri;http://add.my.yahoo.com/rss?url=%s

    browser.search.order.2;Yahoo

    browser.search.param.yahoo-fr;moz35

    browser.search.param.yahoo-fr-cjkt;moz35

    browser.search.param.yahoo-fr-ja;mozff

    THIS ONE IN BOLD
    extensions.wrc.SearchRules.yahoo.com.style;.WRCN {display:none} .sm-hd .WRCN, .sm-links .WRCN, .res h3 > .WRCN {display:inline !important; background: url("IMAGE") right no-repeat}

    THIS ONE IN BOLD
    extensions.wrc.SearchRules.yahoo.com.url;^http(s)?\:\/\/((.)+\.)?search\.yahoo\.com\/(.)*

    gecko.handlerService.schemes.mailto.0.name;Yahoo! Mail

    gecko.handlerService.schemes.mailto.0.uriTemplate;https://compose.mail.yahoo.com/?To=%s

    THIS ONE IN BOLD
    startpage.ntsearch_url;http://search.yahoo.com/search?fr=spigot-nt-ff&ei=utf-8&ilc=12&type=888596&p={searchTerms}



    The keyword entry now shows these lines:

    THIS ONE IN BOLD
    avg.install.disableKeywordSearch;false

    THIS ONE IN BOLD
    browser.keywordURLPromptDeclined;1

    keyword.enabled;true



    Any advice on how to go from here to get rid of Yahoo? I don't know what to do with the Yahoo results in about:config. The context menu does not have 'delete' when right-clicking on any of them. Modify, toggle etc. a few others..

    edit: nothing suspicious in Firefox Addons Extensions, btw.
      My Computer


  2. Posts : 20,583
    Win-7-Pro64bit 7-H-Prem-64bit
       #2

    Hi see if this tool helps,
    Mini Tool Test for pchf
    Please upload as a attachment for the text file not pasting,
    Cheers.
      My Computer


  3. Posts : 108
    Windows 7 Pro 64bit
    Thread Starter
       #3

    ThrashZone said:
    Hi see if this tool helps,
    Mini Tool Test for pchf
    Please upload as a attachment for the text file not pasting,
    Cheers.
    Not possible to upload Minitools report or anything else because Manage Attachments brings up a 404 page in the Manage Attachment box. Along with Yahoo redirect hijacks, I have also been getting 404 pages of various different graphical designs when clicking some hotlinks on some websites. Started at the same time as the Yahoo redirects. The info in the field at the top of the Attachment box has this:

    http://cssimg.designermediacdn.com/i...attach/wav.gif

    try this, google drive:

    https://drive.google.com/file/d/0By1...it?usp=sharing
    Last edited by shokan2; 20 May 2014 at 18:30. Reason: added
      My Computer


  4. Posts : 20,583
    Win-7-Pro64bit 7-H-Prem-64bit
       #4

    Safe mode with networking,
    Shut down your machine, Unplug-Hold the power button down for 30/45 seconds (Power Drain)
    If on a laptop remove the battery then use power drain,
    Power up and Tap the F8 key continuously until you see a black page with white text,
    Use the down arrow key to toggle to safe mode with networking/ hit the enter key.
    Login as usual
    Other advanced methods,
    https://www.sevenforums.com/tutorials/69585-safe-mode.html
      My Computer


  5. Posts : 108
    Windows 7 Pro 64bit
    Thread Starter
       #5

    ThrashZone said:
    Safe mode with networking,
    Shut down your machine, Unplug-Hold the power button down for 30/45 seconds (Power Drain)
    If on a laptop remove the battery then use power drain,
    Power up and Tap the F8 key continuously until you see a black page with white text,
    Use the down arrow key to toggle to safe mode with networking/ hit the enter key.
    Login as usual
    Other advanced methods,
    https://www.sevenforums.com/tutorials/69585-safe-mode.html
    Don't have time to try this until tomorrow. What will this procedure do?
      My Computer


  6. Posts : 20,583
    Win-7-Pro64bit 7-H-Prem-64bit
       #6

    Hi,
    It will allow you to download Adwcleaner and post the scan result Here as a text attachment,
    Also your other text file,
    Then repeat Adwcleaner booting normally and post that scan log as a text attachment,
    Cheers.
    http://malwaretips.com/blogs/remove-adware-popup-ads/
      My Computer


  7. Posts : 108
    Windows 7 Pro 64bit
    Thread Starter
       #7

    ThrashZone said:
    Hi,
    It will allow you to download Adwcleaner and post the scan result Here as a text attachment,
    Also your other text file,
    Then repeat Adwcleaner booting normally and post that scan log as a text attachment,
    Cheers.
    http://malwaretips.com/blogs/remove-adware-popup-ads/
    I've decided to reformat with new Win installation. The old laptop is full of stuff I don't need anyway. Thanks for your help.
      My Computer


  8. Posts : 20,583
    Win-7-Pro64bit 7-H-Prem-64bit
       #8

    Probably the most straight forward process
    Cheers.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 19:46.
Find Us