Cant get rid of White Smoke browser

hubb

I downloaded some software and checked I wasn't getting anything else but low and behold I have white smoke, a horrible adware encrypted into Google and Explorer. I did all the usual things, uninstalled, all the correct procedure in Google advanced settings and it has gone BUT if I have Google pinned in my task bar, then open it from there it is still there. I have run Mailware bytes antin mailware prog (which has cleaned this king of rubbish for me in the past) but that hasn't even found it. How can it be showing in one instance and not in others. Surely it's either gone or not unless it has left a footprint.

Can anyone please advise how to completely remove any trace of this annoying garbage ?

NiftyDigits

Run the Junkware Removal Tool

Elliott_Fox

You can download something called malwarebytes. The free version should do the job.

NiftyDigits

Elliott_Fox wrote: »

You can download something called malwarebytes. The free version should do the job.

Did you read the whole of the original post?

Elliott_Fox

Ah.. Sorry. Malwarebytes worked for me. There is a good guide here to help:

http://forums.anvisoft.com/viewtopic-45-1291-0.html

waddler_8

NiftyDigits wrote: »

Run the Junkware Removal Tool

As above.

Sample log.

user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://WhiteSmokeNew.OurToolbar.com//xpi\"}");
user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"WhiteSmoke New\"}");
user_pref("CT3289847.smartbar.CTID", "CT3289847");
user_pref("CT3289847.smartbar.Uninstall", "0");
user_pref("CT3289847.smartbar.homepage", "true");
user_pref("CT3289847.smartbar.toolbarName", "WhiteSmoke New ");
user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3289847&CUI=UN42265594992454012&UM=2&SearchSource=13");
user_pref("Smartbar.ConduitSearchEngineList", "WhiteSmoke New Customized Web Search");
user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&SearchSource=2&CUI=UN42265594992454012&UM=2&q=");
user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
user_pref("Smartbar.keywordURLSelectedCTID", "CT3289847");
user_pref("browser.search.defaultthis.engineName", "WhiteSmoke New Customized Web Search");
user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&CUI=UN42265594992454012&UM=2&SearchSource=3&q={searchTerms}");
user_pref("browser.search.selectedEngine", "WhiteSmoke New Customized Web Search");

And/or Adwcleaner.

http://www.bleepingcomputer.com/download/adwcleaner/

Both free and simple to use.

mehera

First course of action - System restore.

This will alter the registry safely back to the state it was before you installed this nasty addition!

hubb

mehera wrote: »

First course of action - System restore.

This will alter the registry safely back to the state it was before you installed this nasty addition!

System restore was not turned on so can't do that. Adware cleaner found it, removed it. When I tried google it was still there so it didn't work. Junkware removal didn't remove it either :-(

hubb

It's ok folks, I uninstalled Chrome and re-installed. It worked.

waddler_8

Always add a new post rather than edit a previous one (post #8) when you have new information, that way people helping will receive a notification & can further assist you if needed.

hubb wrote: »

Adware cleaner found it, removed it. When I tried google it was still there so it didn't work. Junkware removal didn't remove it either

Without seeing the logs created by the tools it's hard to say why they may have failed, but generally ensure you run them with admin privileges (Right click - run as admin).