Search Engine (Rogue) Extension

[geoffhAMB]

I seemed to have obtained a FORCED Search Engine address,  www.co-uk-q.com.  I suspect I have inadvertently NOT unticked a box when downloading some software - I am usually good at this sort of thing, indeed, I tell my two brothers off when they fall for this!! : (

In Windows 10, Microsoft Edge, I cannot amend this - the options are greyed out, the despicable author(s) behind it have locked it down.  I can upon a page hat says "Download antimalware designed specifically to remove threats like Www.co-Uk-Q.com and (random file).exe (download of fix will start immediately): Download Antimalware to remove Www.co-Uk-Q.com" however, this did not find it.

I then tried the suggested "Wiper Softnow" app, promising it would remove them, it didn't.  Interestingly, a run of AntiMalwarebytes then threw up the WiperSoft code as a PuP!!

I now intend to zap my Windows Installation and rebuild from a Backup.

Apart from wanting to warn people, I also wish to know if anyone has any experience with this Search Engine - or the Scum who write  & support it?

 

 

[Maurice Naggar]

Hi,  @geoffhAMB     

My name is Maurice. I will be helping and guiding you, going forward on this case.   Let me know what first name you prefer to go by.

 

No, I have not heard of this hijack.   Nor of "wiper softnow".   But EDGE should be fixable.   I would like to get a readout report on this system, which an eye to guiding you to get rid of the hijack.

 

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me.

If you will be away for more than 3 consecutive days,  do try to let me know ahead of time, as much as possible.

 

Please only just attach   all report files, etc  that I ask for as we go along.

 

I would appreciate  getting some key details from this machine in order to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

 

Do have patience while the report tool runs.  It may take several minutes.  Just let it run & take its time.  You may want to close your other open windows so that there is a clear field of view.

    Download Malwarebytes Support Tool
    
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.5.3.749.exe  to run the report
        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
    You will be presented with a page stating, "Get Started!"

    Do NOT use the button “Start repair” !
    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
    Please attach the ZIP file in your next reply.

 

Please know I help here as a volunteer.  and that I am not on 24 x 7.

Help on this forum is one to one.   Again, please be sure to ONLY attach report files  with your reply (s)  as we go along.  Do not do a copy / paste into main body.

Thank you,

 

SPECIAL NOTES  on the Windows 10 EDGE browser.

You can start it from a elevated Command prompt  and have it open on some specific safe site.   ( so you can then Delete the Cache and history & even drill thru and if you find the extension, to  turn it off or remove it.

 

Use the keyboard shortcuts to start an elevated command prompt.
Press and hold the Windows-flag key on keyboard & tap the X key
On the fly-out menu, select "Command prompt (Admin)"
Click Yes to confirm

In the Command prompt, Copy and Paste this
start microsoft-edge:https://bing.com

Then do some normal, typical things in Edge.

Like deleting Cache & history:

Then while still in the web browser, press and hold SHIFT + CTRL + DELete keys to start the process to delete all browser cache & history.

 

 

 

Sincerely.

 

[geoffhAMB]

Maurice ….. BIG apologies , BUT, I have now reset my PC - up until several years ago, I tried to make my PC "Anti Trojan/Malware proof".  I realised this was not a sensible move. 

Consequently, I have since decided "I WOULD be attacked" so setup my config to be able to get back up , and running within 2 hours, WITHOUT having to pay Ransomware to anyone )which I would NEVER do) and I now have such a config.

If I get this problem back I shall certainly let you know AND get back to the parent company who caused this issue.

I cannot find much when I search for "Www.co-Uk-Q.com" - I would happily go round to their owner's house and have a right good argument with the git, if I could!!

Many thanks for your help.

Best Regards.

Geoff H.

 

[Maurice Naggar]

Hello Geoff,

You indicate that you have "reset the pc".

I would highly recommend that you insure to have Malwarebytes for Windows Premium.   and also to follow these tips to "beef up" / harden your system.

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera.

Scroll down to the tips section "How do I disable them".

 

If this pc has the Google Chrome browser, or the Brave browser, I suggest you install the Malwarebytes Browser guard for Chrome.

To get & install the Malwarebytes Browser Guard extension for Chrome,

 

Open this link in your Chrome   browser: 

https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

 

Then proceed with the setup.

 

If the pc has Mozilla Firefox, to get & install the Malwarebytes Browser Guard  Firefox extension.

Open this link in your Firefox browser:   

https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

Then proceed with the setup.

That link is for English US.   There are other language version.  Just go to the very bottom right of the page and look at “Change language” list drop down.

.

It is not enough to just have a security program installed. Each pc user needs to practice daily safe computer and internet use.

 

Best  practices & malware prevention:
Follow best practices when browsing the Internet, especially on opening links coming from untrusted sources.
First rule of internet safety: slow down & think before you "click".

Never click links without first hovering your mouse over the link and seeing if it is going to an odd address ( one that does not fit or is odd looking or has typos).

Free games & free programs are like "candy". We do not accept them from "strangers".

Never open attachments that come with unexpected ( out of the blue ) email no matter how enticing.
Never open attachments from the email itself. Do not double click in the email. Always Save first and then scan with antivirus program.

 

 

Pay close attention when installing 3rd-party programs. It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed.
Take great care in every stage of the process and every offer screen, and make sure you know what it is you're agreeing to before you click "Next".

Use a Standard user account rather than an administrator-rights account when "surfing" the web.
See more info on Corrine's SecurityGarden Blog http://securitygarden.blogspot.com/p/blog-page_7.html
Dont remove your current login. Just use the new Standard-user-level one for everyday use while on the internet.

 
Do a Windows Update.

Make certain that Automatic Updates is enabled.
https://support.microsoft.com/en-us/help/12373/windows-update-faq

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

For other added tips, read "10 easy ways to prevent malware infection"

.

I wish you all the best.   I am marking this case for closure.

Stay safe.

Sincerely,

Maurice