Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Yahoo hijack about:config keyword- I'm stuck

20 May 2014   #1
shokan2

Windows 7 Pro 64bit
 
 
Yahoo hijack about:config keyword- I'm stuck

I caught some malware yesterday (Spigot definitely one of them) which causes hotlinks on some pages in Firefox to redirect to Yahoo search results pages. After running Adwcleaner, it looked like Spigot and a number of other things were removed.

The Yahoo problem remains however. I cleared cookies, and also went to about:config from the address field. There, entered keyword and reset "keyword URL" (in bold).

The Yahoo problem remains still.

about:config currently has these Yahoo lines:

browser.contentHandlers.types.0.title;My Yahoo!

browser.contentHandlers.types.0.uri;http://add.my.yahoo.com/rss?url=%s

browser.search.order.2;Yahoo

browser.search.param.yahoo-fr;moz35

browser.search.param.yahoo-fr-cjkt;moz35

browser.search.param.yahoo-fr-ja;mozff

THIS ONE IN BOLD
extensions.wrc.SearchRules.yahoo.com.style;.WRCN {display:none} .sm-hd .WRCN, .sm-links .WRCN, .res h3 > .WRCN {display:inline !important; background: url("IMAGE") right no-repeat}

THIS ONE IN BOLD
extensions.wrc.SearchRules.yahoo.com.url;^http(s)?\:\/\/((.)+\.)?search\.yahoo\.com\/(.)*

gecko.handlerService.schemes.mailto.0.name;Yahoo! Mail

gecko.handlerService.schemes.mailto.0.uriTemplate;https://compose.mail.yahoo.com/?To=%s

THIS ONE IN BOLD
startpage.ntsearch_url;http://search.yahoo.com/search?fr=spigot-nt-ff&ei=utf-8&ilc=12&type=888596&p={searchTerms}



The keyword entry now shows these lines:

THIS ONE IN BOLD
avg.install.disableKeywordSearch;false

THIS ONE IN BOLD
browser.keywordURLPromptDeclined;1

keyword.enabled;true



Any advice on how to go from here to get rid of Yahoo? I don't know what to do with the Yahoo results in about:config. The context menu does not have 'delete' when right-clicking on any of them. Modify, toggle etc. a few others..

edit: nothing suspicious in Firefox Addons Extensions, btw.


My System SpecsSystem Spec
.
20 May 2014   #2
ThrashZone

Win-7-Pro64bit 7-H-Prem-64bit
 
 

Hi see if this tool helps,
Mini Tool Test for pchf
Please upload as a attachment for the text file not pasting,
Cheers.
My System SpecsSystem Spec
20 May 2014   #3
shokan2

Windows 7 Pro 64bit
 
 

Quote   Quote: Originally Posted by ThrashZone View Post
Hi see if this tool helps,
Mini Tool Test for pchf
Please upload as a attachment for the text file not pasting,
Cheers.
Not possible to upload Minitools report or anything else because Manage Attachments brings up a 404 page in the Manage Attachment box. Along with Yahoo redirect hijacks, I have also been getting 404 pages of various different graphical designs when clicking some hotlinks on some websites. Started at the same time as the Yahoo redirects. The info in the field at the top of the Attachment box has this:

http://cssimg.designermediacdn.com/i...attach/wav.gif

try this, google drive:

https://drive.google.com/file/d/0By1...it?usp=sharing
My System SpecsSystem Spec
.

20 May 2014   #4
ThrashZone

Win-7-Pro64bit 7-H-Prem-64bit
 
 

Safe mode with networking,
Shut down your machine, Unplug-Hold the power button down for 30/45 seconds (Power Drain)
If on a laptop remove the battery then use power drain,
Power up and Tap the F8 key continuously until you see a black page with white text,
Use the down arrow key to toggle to safe mode with networking/ hit the enter key.
Login as usual
Other advanced methods,
http://www.sevenforums.com/tutorials/69585-safe-mode.html
My System SpecsSystem Spec
20 May 2014   #5
shokan2

Windows 7 Pro 64bit
 
 

Quote   Quote: Originally Posted by ThrashZone View Post
Safe mode with networking,
Shut down your machine, Unplug-Hold the power button down for 30/45 seconds (Power Drain)
If on a laptop remove the battery then use power drain,
Power up and Tap the F8 key continuously until you see a black page with white text,
Use the down arrow key to toggle to safe mode with networking/ hit the enter key.
Login as usual
Other advanced methods,
http://www.sevenforums.com/tutorials/69585-safe-mode.html
Don't have time to try this until tomorrow. What will this procedure do?
My System SpecsSystem Spec
20 May 2014   #6
ThrashZone

Win-7-Pro64bit 7-H-Prem-64bit
 
 

Hi,
It will allow you to download Adwcleaner and post the scan result Here as a text attachment,
Also your other text file,
Then repeat Adwcleaner booting normally and post that scan log as a text attachment,
Cheers.
http://malwaretips.com/blogs/remove-adware-popup-ads/
My System SpecsSystem Spec
21 May 2014   #7
shokan2

Windows 7 Pro 64bit
 
 

Quote   Quote: Originally Posted by ThrashZone View Post
Hi,
It will allow you to download Adwcleaner and post the scan result Here as a text attachment,
Also your other text file,
Then repeat Adwcleaner booting normally and post that scan log as a text attachment,
Cheers.
http://malwaretips.com/blogs/remove-adware-popup-ads/
I've decided to reformat with new Win installation. The old laptop is full of stuff I don't need anyway. Thanks for your help.
My System SpecsSystem Spec
21 May 2014   #8
ThrashZone

Win-7-Pro64bit 7-H-Prem-64bit
 
 

Probably the most straight forward process
Cheers.
My System SpecsSystem Spec
Reply

 Yahoo hijack about:config keyword- I'm stuck




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Kernel-Power ID 41 , Category 63 , Keyword 2 while playing games
Started having this problem yesterday , while I was playing AC3 , the screen itself just turns black and everything is unresponsible , and after a few seconds , the PC restarted itself. Here's the data : ___________________________________________________________ - System - Provider ...
BSOD Help and Support
BSOD Random Crashes error keyword 0x8000000000000002
Hi My pc was new last July and since then I've been getting random BSODs for the last 6 months. It has occured when I'm using Adobe Photoshop, Lightroom but has also crashed when the PC has simply been sitting idle. There is no patterns to the crashes. It often wont happen for a few weeks at a...
BSOD Help and Support
Combined Microsoft and Yahoo U.S. search share stuck at 28 percent
ComScore: Combined Microsoft and Yahoo U.S. search share stuck at 28 percent | ZDNet
News
Windows Live Mail - Keyword Spam Filtering
Edit: Nevermind, i found it. It's under tools > message rules. Sorry guys. I remember in outlook express i could define keywords for removing spam. I could set a preference like, if an email has "rolex" or "viagra" in it's subject line to be moved or deleted. I can't find that in Windows Live...
Browsers & Mail
Yaa! DLL Hijack Auditor: For Microsoft DLL hijack vulnerability
Not sure if anyone has posted on this tool (or similar tools) yet, but security Exploded makes incredible tools, especially Anti Rootkit tools and Root kit detection tools, so I was happy to learn about this: rmhsCBMIJnA
System Security


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 22:05.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App