MyWebSearch Hijack

waddler_8

Press the windows key + R on your keyboard to open a Run command window.

Copy the code and paste following into the run command. (Do not include code:)

%appdata%\Mozilla\Firefox\Profiles\4ytq0hwq.default

Look for the file prefs.js

• Right click prefs.js and choose copy
• Right click in a blank space inside the folder and choose paste
• A copy of prefs.js should be created
• Right click the file prefs.js & choose edit
• prefs.js will open in notepad
• Highlight & delete the following entries in red only
  

user_pref("extensions.toolbar.mindspark._6oMembers _.hp.enabled", true);
user_pref("extensions.toolbar.mindspark._6oMembers _.initialized", true);
user_pref("extensions.toolbar.mindspark._6oMembers _.installation.contextKey", "");
user_pref("extensions.toolbar.mindspark._6oMembers _.installation.installDate", "2012101218");
user_pref("extensions.toolbar.mindspark._6oMembers _.installation.partnerId", "^AFD^xdm005^YY^gb");
user_pref("extensions.toolbar.mindspark._6oMembers _.installation.partnerSubId", "COHwzab1-7ICFWLHtAod1D4AQA");
user_pref("extensions.toolbar.mindspark._6oMembers _.installation.success", true);
user_pref("extensions.toolbar.mindspark._6oMembers _.installation.toolbarId", "12944D8E-E285-4B37-9725-481DD47535ED");
user_pref("extensions.toolbar.mindspark._6oMembers _.lastActivePing", "1350061234722");
user_pref("extensions.toolbar.mindspark._6oMembers _.options.defaultSearch", true);
user_pref("extensions.toolbar.mindspark._6oMembers _.options.homePageEnabled", true);
user_pref("extensions.toolbar.mindspark._6oMembers _.options.keywordEnabled", true);
user_pref("extensions.toolbar.mindspark._6oMembers _.options.tabEnabled", true);
user_pref("extensions.toolbar.mindspark.hp.enabled ", true);
user_pref("extensions.toolbar.mindspark.hp.enabled .guid", "heroicplay@mindspark.com");
user_pref("extensions.toolbar.mindspark.lastInstal led", "heroicplay@mindspark.com");

• Click file > save and close the notepad file
• Close & restart firefox

shakeitright

I am far from an expert,but when I had this problem it was with Firefox 15,never had it since upgrading to 16,glancing at your last log I see you have both Firefox 15 and 16 installed,just clutching at straws might this be the problem,try uninstalling 15 and see what happens.Feel free to ignore if I,m spouting crap

montymud

waddler_8 I did as you instructed however the problem remains. Shakeitright thank you for your help but waddler_8 has been helping me for many days and taken me thorugh many processes so I am going to continue only with any further instructions by waddler_8 but I do appreciate your help so thank you.

waddler_8

• Right click SystemLook.exe & choose "Run as Administrator" to run it.
• Copy the content of the following codebox into the main textfield:

  :contents
  C:\Users\Abbie\AppData\Roaming\Mozilla\Firefox\Profiles\4ytq0hwq.default\prefs.js
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Post this log in your next reply.

montymud

SystemLook 30.07.11 by jpshortstuff
Log created at 23:42 on 14/11/2012 by Abbie
Administrator - Elevation successful

========== contents ==========

C:\Users\Abbie\AppData\Roaming\Mozilla\Firefox\Profiles\4ytq0hwq.default\prefs.js - Opened succesfully.

# Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the application is running,
* the changes will be overwritten when the application exits.
*
* To make a manual change to preferences, you can visit the URL about:config
*/

user_pref("Smartbar.SearchFromAddressBarSavedUrl", "http://search.alot.com/web?src_id=31155&client_id=486181e4d67418c548dc0808&camp_id=5106&install_time=2012-08-31T17:09:16Z&pr=auto&tb_version=1.0.19000(G)&q=");
user_pref("accessibility.browsewithcaret", true);
user_pref("accessibility.typeaheadfind.flashBar", 0);
user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1352885967);
user_pref("app.update.lastUpdateTime.background-update-timer", 1352892008);
user_pref("app.update.lastUpdateTime.blocklist-background-update-timer", 1352886087);
user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1352934616);
user_pref("app.update.lastUpdateTime.search-engine-update-timer", 1352935029);
user_pref("browser.cache.disk.capacity", 1048576);
user_pref("browser.cache.disk.smart_size.first_run", false);
user_pref("browser.cache.disk.smart_size_cached_value", 1048576);
user_pref("browser.download.lastDir", "C:\\Users\\Abbie\\Pictures");
user_pref("browser.fullscreen.autohide", false);
user_pref("browser.migration.version", 6);
user_pref("browser.pagethumbnails.storage_version", 2);
user_pref("browser.places.smartBookmarksVersion", 4);
user_pref("browser.preferences.advanced.selectedTabIndex", 1);
user_pref("browser.rights.3.shown", true);
user_pref("browser.search.useDBForOrder", "");
user_pref("browser.startup.homepage_override.buildID", "20121024073032");
user_pref("browser.startup.homepage_override.mstone", "16.0.2");
user_pref("browser.syncPromoViewsLeft", 0);
user_pref("browser.tabs.warnOnClose", false);
user_pref("browser.taskbar.lastgroupid", "E7CF176E110C211B");
user_pref("distribution.euballot.bookmarksProcessed", true);
user_pref("extensions.OneClickDownload.filter", "filter:1,3");
user_pref("extensions.autoDisableScopes", 0);
user_pref("extensions.blocklist.pingCountTotal", 74);
user_pref("extensions.blocklist.pingCountVersion", 6);
user_pref("extensions.bootstrappedAddons", "{}");
user_pref("extensions.databaseSchema", 13);
user_pref("extensions.enabledAddons", "{4ED1F68A-5463-4931-9384-8FFF5ED91D92}:3.4.0,{972ce4c6-7e08-4474-a285-3208198ce6fd}:16.0.2");
user_pref("extensions.hotfix.lastVersion", "20121019.01");
user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"{4ED1F68A-5463-4931-9384-8FFF5ED91D92}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\McAfee\\\\SiteAdvisor\",\"mtime\":1352913533927},\"{D19CA586-DD6C-4a0a-96F8-14644F340D60}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Common Files\\\\McAfee\\\\SystemCore\",\"mtime\":1346504610845}}},{\"name\":\"app-global\",\"addons\":{\"{972ce4c6-7e08-4474-a285-3208198ce6fd}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\",\"mtime\":1352471740697}}}]");
user_pref("extensions.lastAppVersion", "16.0.2");
user_pref("extensions.lastPlatformVersion", "16.0.2");
user_pref("extensions.pendingOperations", false);
user_pref("extensions.shownSelectionUI", true);
user_pref("extensions.ui.dictionary.hidden", true);
user_pref("extensions.ui.lastCategory", "addons://discover/");
user_pref("extensions.ui.locale.hidden", true);
user_pref("gfx.direct3d.prefer_10_1", true);
user_pref("idle.lastDailyNotification", 1352835158);
user_pref("intl.charsetmenu.browser.cache", "UTF-8, us-ascii, ISO-8859-15, windows-1251, windows-1252");
user_pref("network.cookie.prefsMigrated", true);
user_pref("places.database.lastMaintenance", 1352835162);
user_pref("places.history.expiration.transient_current_max_pages", 104858);
user_pref("pref.browser.homepage.disable_button.restore_default", false);
user_pref("privacy.sanitize.migrateFx3Prefs", true);
user_pref("searchreset.backup.browser.search.defaultenginename", "");
user_pref("searchreset.backup.browser.startup.homepage", "");
user_pref("security.OCSP.enabled", 0);
user_pref("security.csp.enable", false);
user_pref("security.warn_viewing_mixed", false);
user_pref("services.sync.clients.lastSync", "0");
user_pref("services.sync.clients.lastSyncLocal", "0");
user_pref("services.sync.globalScore", 0);
user_pref("services.sync.migrated", true);
user_pref("services.sync.nextSync", 0);
user_pref("services.sync.tabs.lastSync", "0");
user_pref("services.sync.tabs.lastSyncLocal", "0");
user_pref("storage.vacuum.last.index", 1);
user_pref("storage.vacuum.last.places.sqlite", 1351811937);
user_pref("toolkit.startup.last_success", 1352935349);
user_pref("toolkit.telemetry.prompted", 2);
user_pref("toolkit.telemetry.rejected", true);
user_pref("urlclassifier.keyupdatetime.https://sb-ssl.google.com/safebrowsing/newkey", 1354214049);
user_pref("xpinstall.whitelist.add", "");
user_pref("xpinstall.whitelist.add.36", "");


-= EOF =-

waddler_8

Just to clarify, when you open Firefox, the first page you see is a search page for MyWebSearch - is that correct?

There doesn't appear to be anything MyWebSearch related in any of your Firefox settings now. As a very last resort we can reset Firefox, but first start it in Firefox's own safe mode and see what happens.

Instructions on how to do that are here: http://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode#w_how-to-start-firefox-in-safe-mode

montymud

No when I open it the first thing I see is the firefox homepage. It is when I try to run a search from that page that mywebsearch hijacks

waddler_8

Okay, we'll look at possible 3rd party add-ons causing it. Start it in Firefox safe mode & see if the same happens.

montymud

I'm going to go all girly now and say YIPPEEEE you did it. I just cannot thank you enough for all of your help and perseverence over the last few days. Thank you ENORMOUSLY! :T :beer:

waddler_8

That doesn't solve it as such, but proves that an add-on is causing it.