Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I'm infected by www-mysearch.com how to get rid of it?


  • Please log in to reply
23 replies to this topic

#1 Joe Z

Joe Z

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:10:23 PM

Posted 02 February 2016 - 06:48 PM

I've tried the usual stuff, malwarebytes, combofix, rkill, jrt and adwcleaner, none of them are picking this up and getting rid of it.  Any suggestions?  I'm running IE11 and Firefox and it's infected both of them.  Basically when I open my browser I get a fake "bing' page.  I can navigate away from it by typing in a new URL but it's getting annoying and I don't know what else it might be doing.  Thanks in advance for any help.



BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,710 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:08:23 PM

Posted 02 February 2016 - 10:06 PM

Reset Firefox: https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-most-problems

If the above didn't help...

Uninstall Firefox completely using this manual: https://support.mozilla.org/en-US/kb/uninstall-firefox-from-your-computer
NOTE. Use MozBackup: http://mozbackup.jasnapaka.com/ to backup your bookmarks and passwords. Do NOT backup anything else.
Install fresh copy.
 

===========================

 

Reset Internet Explorer.
Download MIcrosoft FixIt file from here: http://go.microsoft.com/?linkid=9646978
You can use ANY browser to download "FixIt" file.
Double click on downloaded MicrosoftFixit50195.msi file to run the fix.
Make sure you follow ALL steps listed there.
Windows 8/8.1/10  users. Reset IE manually: https://support.microsoft.com/kb/923737?wa=wsignin1.0
 


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 Joe Z

Joe Z
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:10:23 PM

Posted 02 February 2016 - 11:15 PM

I tried those and I've still got the issue.  Any other suggestions?



#4 karolisbar

karolisbar

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:06:23 AM

Posted 03 February 2016 - 03:06 AM

I tried those and I've still got the issue.  Any other suggestions?

 

You need to manually change the search provider of Firefox > Options > Search > "One-Click Search Engines" select the Bing that has a check mark and remove it. Then select other search engine.

 

For IE do the same: IE > Options > Manage Add-ons > Search providers > Select the Bing and disable it (or Delete it).

 

Also change your homepage if it has been changed.

 

Then try  to remember what you installed recently and check if its all legit.

 

 

 

 



#5 Joe Z

Joe Z
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:10:23 PM

Posted 03 February 2016 - 06:03 AM

My "homepages" are all set to my regular ones, search providers are set to bing (just a personal preference).  Whatever this thing is it's not showing up in add-ons nor in programs I may have downloaded, none of the previously mentioned removers are picking it up and removing it.  As soon as I open my browser, either IE or Firefox I get the fake Bing page.  None of the tabs work, so you can't switch to videos or pictures etc.  In the center of the page there is an ad that changes each time but advertises "fix your windows".  When I hover over it I can't see what URL it's going to take me to.  The URL of the fake Bing page is:

http://www-mysearch.com/?prd=set_epc&s=G21zswatn1,b7af241f-aba3-44df-8b39-bfe029b23c18,

I can delete this and navigate anywhere I want.   But each time I open my browser that's what comes up



#6 karolisbar

karolisbar

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:06:23 AM

Posted 03 February 2016 - 07:13 AM

My "homepages" are all set to my regular ones, search providers are set to bing (just a personal preference).  Whatever this thing is it's not showing up in add-ons nor in programs I may have downloaded, none of the previously mentioned removers are picking it up and removing it.  As soon as I open my browser, either IE or Firefox I get the fake Bing page.  None of the tabs work, so you can't switch to videos or pictures etc.  In the center of the page there is an ad that changes each time but advertises "fix your windows".  When I hover over it I can't see what URL it's going to take me to.  The URL of the fake Bing page is:

http://www-mysearch.com/?prd=set_epc&s=G21zswatn1,b7af241f-aba3-44df-8b39-bfe029b23c18,

I can delete this and navigate anywhere I want.   But each time I open my browser that's what comes up

Have you tried to check your shortcut target lines?
It should be something similar to this "C:\Program Files (x86)\Mozilla Firefox\firefox.exe".

 

But if there is something at the end.. then it could be it.
 



#7 Joe Z

Joe Z
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:10:23 PM

Posted 03 February 2016 - 07:31 AM

Interesting.  For whatever reasons when I run them from my program files directory they open normally.  If I open them from my shortcuts on my task bar they come up with the bogus bing site.  So, while I could delete the shortcuts that doesn't, at least in my mind, eliminate the possibility of something still lurking on my computer.



#8 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,710 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:08:23 PM

Posted 03 February 2016 - 04:04 PM

Try creating new shortcuts.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#9 karolisbar

karolisbar

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:06:23 AM

Posted 03 February 2016 - 04:22 PM

 

Interesting.  For whatever reasons when I run them from my program files directory they open normally.  If I open them from my shortcuts on my task bar they come up with the bogus bing site.  So, while I could delete the shortcuts that doesn't, at least in my mind, eliminate the possibility of something still lurking on my computer.

 

Just simply press right click on your shortcut's > select properties > and see if your shortcut target is legit and leads to the real browsers executable path and does not have anything similar to www-search.com.
This is why it loads the page when you launch it from a shortcut, and it does not when you launch the browser directly.


 

 

Try creating new shortcuts.

Not the best advice, cause you dont get rid of the infection (:


Edited by karolisbar, 03 February 2016 - 04:24 PM.


#10 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,710 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:08:23 PM

Posted 03 February 2016 - 04:50 PM

No scan indicates any infection present as stated in the initial post.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#11 Joe Z

Joe Z
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:10:23 PM

Posted 03 February 2016 - 06:19 PM

So, I deleted the shortcuts, made new ones, everything seems to be working fine now.  I suppose it was some latent element of the infection. Not really sure.  One interesting thing happened though.  I went to program files, internet explorer, dragged the executable to the task bar, everything fine.  Did the same with Firefox.  When I went to open Firefox from the task bar I got the same mysearch crap.  Deleted the shortcut and started over.  This time I made the shortcut to the desktop.  I worked fine, moved it to the task bar and still works fine.  All good so far.  Going to scan everything again just to make sure.



#12 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,710 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:08:23 PM

Posted 03 February 2016 - 08:18 PM

p22003888.gif


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#13 karolisbar

karolisbar

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:06:23 AM

Posted 04 February 2016 - 02:32 AM

No scan indicates any infection present as stated in the initial post.

Because those scanners didn't caught it.

 

 

So, I deleted the shortcuts, made new ones, everything seems to be working fine now.  I suppose it was some latent element of the infection. Not really sure.  One interesting thing happened though.  I went to program files, internet explorer, dragged the executable to the task bar, everything fine.  Did the same with Firefox.  When I went to open Firefox from the task bar I got the same mysearch crap.  Deleted the shortcut and started over.  This time I made the shortcut to the desktop.  I worked fine, moved it to the task bar and still works fine.  All good so far.  Going to scan everything again just to make sure.

Glad to hear that you fixed your issue.



#14 Joe Z

Joe Z
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:10:23 PM

Posted 04 February 2016 - 03:13 AM

It's back.  Or never went away.  If I have a browser open, IE or Firefox, and I go to the task bar to open another browser window I get the same www-mysearch.com garbage.  It seems I am infected with something still.



#15 Joe Z

Joe Z
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:10:23 PM

Posted 04 February 2016 - 05:44 PM

Still infected with something.  Anyone have any ideas?






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users