how to remove yoog search engine?

[bursuc17]

i think this might be some kind of worm or something since i didn't install it. i use firefox and opera web browsers latest versions,and this yoog search engine replaced the google search engine in both browsers or any other search engine i assing as default.in firefox it creates/edits files USER.js and PREFS.js and Yoog Search.xml and in opera it edits the search.ini file.i deleted the files i uninstalled the browsers and installed againthe damn thing stays there no matter what i do.spyware doctor says everything is ok.don't know what else to do.So if any of you can help me with this i would really appreciate.

user.js : user_pref("browser.search.selectedEngine", "Yoog Search");
user_pref("keyword.URL", "http://www10.yoog.com/search.php?q=");
user_pref("keyword.enabled", true);


prefs.js : # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the application is running,
* the changes will be overwritten when the application exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1228584837);
user_pref("app.update.lastUpdateTime.background-update-timer", 1228584836);
user_pref("app.update.lastUpdateTime.blocklist-background-update-timer", 1228584837);
user_pref("app.update.lastUpdateTime.search-engine-update-timer", 1228584837);
user_pref("browser.search.selectedEngine", "Yoog Search");
user_pref("browser.startup.homepage_override.mstone", "rv:1.8.1.18");
user_pref("extensions.lastAppVersion", "2.0.0.18");
user_pref("intl.charsetmenu.browser.cache", "UTF-8");
user_pref("keyword.URL", "http://www10.yoog.com/search.php?q=");
user_pref("network.cookie.prefsMigrated", true);
user_pref("urlclassifier.tableversion.goog-black-enchash", "1.65485");
user_pref("urlclassifier.tableversion.goog-black-url", "1.25401");
user_pref("urlclassifier.tableversion.goog-white-domain", "1.484");
user_pref("urlclassifier.tableversion.goog-white-url", "1.371");


Yoog Search.xml :
- <SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/">
<ShortName>Yoog Search</ShortName>
<InputEncoding>UTF-8</InputEncoding>
<Url type="text/html" template="http://www10.yoog.com/search.php?q={searchTerms}" />
</SearchPlugin>

[Hemiod]

user.js : user_pref("browser.search.selectedEngine", "Google");
user_pref("keyword.URL", "http://www.google.co.uk/search?hl=en&q=");
user_pref("keyword.enabled", true);

That will restore the search url back to Google.

I have same problem but i cannot find the yoog's DLL or XML that overwrite the Mozilla user preferences i need your to find it

http://www.360n.com/remove_yoog.htm << For IE not Firefox

[bursuc17]

it's in the application data folder ,by default it's invisible and it's in C:Documents and settings\yourpc\.Look in the mozilla folder,you will find all those files in there,but editing them as you said won't do it i already tryed that when i left the first post in here, you edit the files and the next time you restart the browser it all the same again , it must be some DLL or other file in the system folder that overwrites the files to the yoog settings again.excuse my english

[bursuc17]

IE doesn't do it for me , i don't use it and i had it disabled the first thing after reinstalling xp

[Hemiod]

yeah, I think we need to find the file call Globaladsolution for firefox :(

[johnwill]

Uninstall Firefox totally, and remove the Mozilla folder from Program Files and also under your profile.

Install Firefox again.

[bursuc17]

ok ,now i think i got it.took me a while but my browsers are "clean" now.you were right about the globaladsolution file.you must locate and delete a file named : cont_globaladsolution-remove.exe from your system32 folder and then remove nsglobadlsolution.dll from Progfiles\mozilla\components folder. uninstall mozilla delete mozilla folder from C:\progfiles and from c:\documents and settings\yourpc\app data\ . and last but i'm not sure it has anithing to do with this yoog search engine,delete any kavo0.dll tavo0.dll KAVO0.DLL TAVO0.DLL,i found them in my system32 folder and if you find them too then it definetly has something to do with the yoog search

[Hemiod]

Hmmm i cannot finds these files :S

[twlvvman]

bursuc17 You are the King. I followed you directions. The file on my computer was cont_adsoftinc_remove.exe and the dll was nsadsoftinc.dll. Removing these files and removing the references to yoog from the registry fixed the problem. I did not need to reinstall firefox.

Thanks for the help

Twlvvman

[Mr.Steve]

Hi,

I have this Yoog Malware also and I have tried everything to get rid of it, including the above advice which did not work. I do suspect however it might be because the strings are different on my machine and although I tried to compensate for the difference it did not work.

I am also having two other problems that might be related to this Yoog search malware that attaches itself to Firefox.

1: I cannot see the admin/Application Data folder on my hard drive (or as it happens the Local Folder) even after I click folder options/ show hidden folders (as well as doing this via windows explorer).

2: When I do change my folder options to view hidden files it just resets itself immediately on opening a folder no matter what I do - It just will not store the saved view options.

I am also constantly getting some search engine page (no name) on any error 404 pages I get, which will not let me use the back button to escape them. The only way to return to where I was is by going back to the beginning and starting over; which is a nightmare if I am logged into a website I’m working on and hit a broken link triggering this error 404 message and no way back.

Please help guys, I have been searching and trying different remedies for nearly a day. I have managed to delete this yoog file several times but it just keeps coming back.

Thanks - Steve


Im running windows XP with SP2 via bootcamp on my Imac machine. I recently did an upgrade to winXPSP3 (in october) and it totally screwed my antivirus system (Zone Alarm) - it would not let me surf with maximum protection and kept cutting my internet connection off. So I decided to reinstall and since turned automatic updates off.

[twlvvman]

Steve, I can't help much with the imac. I suspect that is part of the problem with viewing the files or I have seen other malware that will prevent you from viewing the admin areas. I know you don't want to hear it, but a clean install may be your best answer.

One other thing I found on getting rid of the yoog. It wasn't showing up in my search engine list, but was still defaulting to it on a url line search. I had to remove the user.js file from C:\Documents and Settings\currentuser\Application Data\Mozilla\Firefox\Profiles\2mqbo42t.default to finish cleaning up the problem.

Twlvvman

[GILiad]

Thanks bursuc17 & twlvvman. In my case it was cont-adsite-remove.exe, adsite.exe & nscC.dll

[Mr.Steve]

Hi Everyone,

First, I want to point out that not a single method currently posted online that I am aware of works when trying to remove Yoog Search Malware. I tried every single one (which takes a lot of time) and they all failed, so this tells me either experts are not taking this serious or they are presently unable to select a generic system for its removal that works.

I am happy to say that I did finally remove Yoog Search Malware from my system and although it seems a long winded way, when compared to the time used in trying alternative ways it proves to be one of the more efficient ways in the long run. It also finds many Malware programs that my current security software missed and therefore was well worth it.

Step 1 - Open Firefox and click Bookmarks/Organise Bookmarks.

Step 2 - Click Import and Backup and select ‘Backup’. Choose the destination for saving this file and click ‘Save’.

Only Do Steps 1 and 2 if you want to save all your current ‘Bookmarks’ and ‘Bookmark Folders’ otherwise you can skip this part.

Step 3 - Uninstall Mozilla Firefox - Control Panel/Add Remove Programs/Mozilla/Uninstall.

Step 4 – Now remove all traces of Mozilla Firefox from your system - My Computer/C:/Documents and Settings/Admin *or whatever your System Username is*/Application Data *(if this is hidden click folder options and tick the box that says show hidden folders*/Mozilla/Delete this folder if it is still there.

Step 5 - Remove any other Mozilla Files - Click Start (bottom left corner) and click 'Search'/click 'Search All Files and Folders'/Type in 'Mozilla' in the section that says 'all or part of the file name'/then click 'More Advanced Options' and tick both 'Search System Folders' and 'Search Hidden Files and Folders'/*Click Search and Wait*

Step 6 - Once the Search has finished, locate the Mozilla files listed and delete them from your system, this includes any Mozilla Files that may be in a different programs such as a Photo Editor.

Step 7 - When all traces of Mozilla have been deleted from your PC (be sure to empty your ‘Recycle Bin’) then restart your system.

Step 8 - Download the following programs from these locations if you do not already have them, install them one by one and ensure you update them online. Do not run them yet; just ensure they are up to date.
• AdAware
• SuperAntispyware
• Spybot Search & Destroy
• Malwarebytes' Anti-Malware

Step 9 – Temporarily turn off your internet connection and disable your current Anti Virus/Spyware programs so they do not interfere with the new programs we will run.

Step 10 – Run the programs in the order above, ensuring that you follow each step carefully including any back up requests and re-boots. *I only used the first three to clean my system*

Step 11 – After rebooting your system, you can uninstall these programs if you wish.

Step 12 – Turn on your Anti Virus/Spyware programs and reconnect to the Internet. Re-install Mozilla.

Step 13 – Once Mozilla Firefox is on check to ensure the Yoog Malware has gone and then import your ‘Saved Bookmarks’ by following Steps 1 and 2 but this time choosing ‘Import’ instead of ‘Backup’.

Your System should now be clean from the Yoog Malware as well as any other Malware your current security software may have missed. I hope this helped.

One more thing - I do not know if this is relevant but I have ‘Corel’ Paint Shop Pro on my system which I updated recently. There was a Mozilla file embedded in this software (which I removed when purging my system of everything Mozilla) and I wondered if this was a possible hiding place for Yoog? There was no logical reason why this software program used for basic photo editing should contain a file related to a browser, none that I can see anyway.

I hope this helped – Steve

[bursuc17]

i'm not a specialist in pc's or something like that but my guess is that we'll be hearing from Mr.Steve becouse i think that importing your old bookmarks was a good idea.Anyway i got the yoog search engine back in my browsers again now,don't have a clue how and that is what pisses me off that.On the whole web you won't find a single line of text that tells you how you get infected with this.

[bursuc17]

here ,i hope this will help ,put this in a text named foldersettings file save it rename the extension from .txt to .reg open it and you will be able to use the SHOW HIDDEN FILES AND FOLDERS again.


Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]
"Text"="@shell32.dll,-30499"
"Type"="group"
"Bitmap"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,\
48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,34,00,00,\
00
"HelpID"="shell.hlp#51131"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30501"
"Type"="radio"
"CheckedValue"=dword:00000002
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51104"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30500"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51105"

[GILiad]

Hi All,

I observe that this Yoog search engine came up after the auto update of Mozilla. So I suggest that we set the update to ask first before update.

[johnwill]

I've updated FF for every update, and I've never seen this thing appear. I really doubt that has anything to do with it.

[bursuc17]

i don't think the updates had somethink to do with this search engine either.i updated every time there was a new ipdate avaible,and a update is supposed to increase security in the browser not to inject worms viruses etc.for firefox there is an addon that you could use to prevent the future apparition of this search engine again,you need to set it right becouse it will block any scripts from every web page you visit and that it's not always good.

https://addons.mozilla.org/en-US/fir...script&cat=all

[Mr.Steve]

Hi Guys,

I can confirm that since I carried out the procedure as described in my earlier post, the 'Yoog Search' has not re-appeared. As a bonus my machine is working faster and I still have the software I downloaded to carry out regular in depth scans.

So, it does work.

I do not think it came from a Mozilla update. My suspects are either 'Real Player' (install and/or update) or a 'Corel Paintshop Pro (X)' update, which I carried out and incidentally found a file related to Mozilla inside the 'Corel' folder.

Hope I have helped someone else and I am pleased to be rid of it.

Steve

[peterjohnsia]

tnx bursuc17... your idea helps me alot... i did what you said.. delete some file in system32.. uninstall mozilla, delete the mozilla's remaining file in progfile and reinstall mozilla again.. after the reinstallation the yoog search engine is gone..... im trying to fix my Ie7 both.. my ie7 and mozilla has same prob.with yoog..