Yoog Search Malware Removal

[Mr.Steve]

Hi Everyone,

First, I want to point out that not a single method currently posted online that I am aware of works when trying to remove Yoog Search Malware. I tried every single one (which takes a lot of time) and they all failed, so this tells me either experts are not taking this serious or they are presently unable to select a generic system for its removal that works.

I am happy to say that I did finally remove Yoog Search Malware from my system and although it seems a long winded way, when compared to the time used in trying alternative ways it proves to be one of the more efficient ways in the long run. It also finds many Malware programs that my current security software missed and therefore was well worth it.

Steps 1 - Open Firefox and click Bookmarks/Organise Bookmarks.

Step 2 - Click Import and Backup and select

[AdvancedSetup]

Hi Steve,

Well I guess you didn't ask me. B)

No need to go through all that hassle and no need to remove Firefox or profile at all.

After an MBAM quick scan alone the file should be killed off but the user.js file for FireFox needs to be modified to remove it.

Make sure Firefox is closed first.

Normally that file is located in a path like this.

C:\Documents and Settings\your name\Application Data\Mozilla\Firefox\Profiles\random name.default\

prefs.js

You can edit it with Notepad. Look for something like this

user.js : user_pref("browser.search.selectedEngine", "Yoog Search");

user_pref("keyword.URL", "

http://www10.yoog.com/search.php?q="

);

user_pref("keyword.enabled", true);

Then replace it with something like this

user.js : user_pref("browser.search.selectedEngine", "Google");

user_pref("keyword.URL", "

http://www.google.nl/search?hl=nl&q="

);

user_pref("keyword.enabled", true);

That will restore the search url back to Google Netherlands

As for IE you should also be able to click on the down arrow for the IE Search and choose

Change Search Defaults

and if it's listed there remove it.

But the actual infection that caused it should now be gone with an MBAM scan. Currently it just does not modify the .js file or reset the IE setting on its own but is scheduled to in the future.

[schecter]

How do you display the application data folder? I applied the settings to display hidden files but every time I access documents and settings my folder is empty.

[schecter]

I ran malware for a quick scan and full system scan and removed all potentially harmful spyware on my computer and found the prefs.js file and edited it to what you put here and saved it but every time I turn firefox back on yoog is still there. I go back to the pefs.js file and it's back to yoog again like I never changed it.

[AdvancedSetup]

There could be a new modified version out now. Please post your MBAM and HJT logs in the HJT Forum and someone will assist you further.