0

I recently got malware installed on my PC that contained software that infected my google chrome, by hijacking my default search engine. I tried:

  1. Removing newly installed programs from PC, using windows utility.
  2. Using Microsoft essentials and hitman pro to fully scan my computer (removed 3 malware of which one was a program and the other adware)
  3. Removing the newly created extension in google chrome.

I tried to change my search engine back to default but I states that the administrator of the program has rights to change the search engine. I then:

  1. Reset my chrome, and restarted my PC. Didn't work.
  2. Then went to registry and deleted all traces of slightsearch and any keys relating to default search engine of chrome.

Restarted PC and nothing has changed at all. My home page is working as normal and I can search google when searching using the URL bar then it redirects to slightsearch.

Lastly, this malware even stared showing me ads on my desktop, when not in Chrome. Scanning and removing the malicious files solved this issue, but the search engine issue still exists.

Please help me solve this issue. And with all due respect, please do not give me the usual tips for removing popups or adware, because as already stated I have done all of these steps. Will appreciate any new solutions.

Regards

  • Could be something in your hosts file - redirecting all traffic sent to Google (e.g. when you visit the site, but not when you just type in the URL bar). Worth a look, at least. However, it's generally impossible to tell whether you've cleared every last trace of malware from a system, so the standard recommendation is to restore to a known good state, which often means reinstalling. – Matthew Apr 21 '16 at 11:00
  • I have reinstalled chrome, cleaned my system and done all the other normal steps. Where can I check the host files? – Simon Erasmus Apr 21 '16 at 11:01
  • See support.rackspace.com/how-to/modify-your-hosts-file for some details which cover most Windows versions. If there are any lines that mention Google, that would be suspicious. In a default install, should only be a handful of entries. – Matthew Apr 21 '16 at 11:04
1

Ok so I eventually fixed the problem.

I had to delete files under c:\Windows\System32\GroupPolicyUsers

Checked all the files contained in GroupPolicyUsers and then deleted those that related to chrome and that was messing with my Registry.

Restarted chrome and now all is fixed!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.