Archive for March, 2012
I did not have the mywebsearch toolbar, nor one of its nefarious programs listed in my programs menu, and yet my google search from the firefox search engines toolbar (its always next to the navigation toolbar), was still being hijacked or blocked by mywebsearch.
I ran hijackthis, and discovered that access to a file was being blocked. That was the clue that solved this problem. If you see the same problem when you run hijackthis, and the file is “Hosts”, then do this:
Go into C:\windows\system32\drivers\etc. You will see a file named hosts, and a backup file that is named hosts.xxxxx, (the x’s being a bunch of numbers). Just rename the backup file “hosts” (not with quotes obviously), and remove the first hosts file. I didn’t remove it as I was not sure if I was making a mistake, I just renamed the first host file “host.backup”. But obviously it’s not needed, it’s the hijacked file, so you could probably just remove it. If you open “hosts” to see what’s in it, use notepad, and you will see that bing and google are listed there instead of localhost, and they have been given false ip addresses by mywebsearch malware. Unfortunately, my windows 7 wouldn’t just let me edit the Hosts file in notepad and save it. But, my renaming method works just as well. Unfortunately, mywebsearch is still hijacking the search page when I search from the navigation (address) bar. That was resolved with the next solution.
To stop the mywebsearch from hijacking search from the address bar, type config:about into firefox address bar. The cursor is automatically placed into page search, so just type mywebsearch. This will show you all the lines with mywebsearch in it (and maybe some others, ignore the ones that don’t have mywebsearch). Change the line with a boolean choice to false. and the other 2 lines change to http:\\google.com.
mywebsearch will leave your firefox completely now, except for auto fill in the address bar. Clear the appropriate history from the tools bar, or clear everything if in doubt.