<![CDATA[Cant remove Private Searches hijacker extension]]>It seems an extension was put on and hides itself as google docs. When thats active everytime I go to search something it autodirects me to privatesearches.org. I can remove the extension by clicking on the extenstion tab and clicking remove, but every time I reopen opera it appears again, i've treid scans on the pc with malwarebytes but it never seems to remove this issue.

]]>https://forums.opera.com/topic/59378/cant-remove-private-searches-hijacker-extensionRSS for NodeWed, 22 Jul 2026 21:14:04 GMTWed, 21 Dec 2022 10:55:36 GMT60<![CDATA[Reply to Cant remove Private Searches hijacker extension on Sun, 25 Dec 2022 23:38:14 GMT]]>@burnout426 Thank you for you explanation! I will use this

]]>https://forums.opera.com/post/297083https://forums.opera.com/post/297083Sun, 25 Dec 2022 23:38:14 GMT<![CDATA[Reply to Cant remove Private Searches hijacker extension on Sun, 25 Dec 2022 20:18:31 GMT]]>@lettuce-x Read the topic above.

]]>https://forums.opera.com/post/297081https://forums.opera.com/post/297081Sun, 25 Dec 2022 20:18:31 GMT<![CDATA[Reply to Cant remove Private Searches hijacker extension on Sun, 25 Dec 2022 15:50:59 GMT]]>f38fbdea-b63a-4f50-b388-ea1a4cb97541-image.png

cbf256a4-f2cf-409f-bb52-c5931957b223-image.png
I don't have any idea why the browser looks like this when I search for anything, can I get some help please?

]]>https://forums.opera.com/post/297065https://forums.opera.com/post/297065Sun, 25 Dec 2022 15:50:59 GMT<![CDATA[Reply to Cant remove Private Searches hijacker extension on Sat, 24 Dec 2022 09:44:14 GMT]]>@surge7861 Okay. It's probably best to start fresh with a new profile then instead of trying to fix your profile.

]]>https://forums.opera.com/post/296991https://forums.opera.com/post/296991Sat, 24 Dec 2022 09:44:14 GMT<![CDATA[Reply to Cant remove Private Searches hijacker extension on Fri, 23 Dec 2022 17:27:50 GMT]]>im get this same virus yesterday, in my task manager i hav
Antimalware Service Executable
Application Frame Host
calculator(2) (but in portugese)
COM Surrogate
COM Surrogate
crashpar_handler
crashpar_handler
Device Association Framework ...
hpwuSchd Application (32bits)
User OOBE Broker
Usermode Font Driver Host
Video Application (2)

if some one knows if one of these its weird or somethhing tell me plz

]]>https://forums.opera.com/post/296948https://forums.opera.com/post/296948Fri, 23 Dec 2022 17:27:50 GMT<![CDATA[Reply to Cant remove Private Searches hijacker extension on Fri, 23 Dec 2022 17:11:00 GMT]]>As for the exe in the file I have the opera.exe and 2 orthers
launcher.exe.1671441701.old
launcher.exe.1671666764.old
So I dont think any of them are the issue

]]>https://forums.opera.com/post/296932https://forums.opera.com/post/296932Fri, 23 Dec 2022 17:11:00 GMT<![CDATA[Reply to Cant remove Private Searches hijacker extension on Fri, 23 Dec 2022 17:01:51 GMT]]>I did forget to mention i did create a dummy profile on the pc yesterday and tested opera gx on a fresh install there and it didn't show up so i believe it's tied to just my profile and only opera as ive tested other browsers on my profile too.

]]>https://forums.opera.com/post/296931https://forums.opera.com/post/296931Fri, 23 Dec 2022 17:01:51 GMT<![CDATA[Reply to Cant remove Private Searches hijacker extension on Fri, 23 Dec 2022 15:44:48 GMT]]>Do you see any weird exe files at the root of "C:\Users\yourusername\AppData"?

If you rename your profile folder, does the extension show up and keep coming back in the new profile too? (You can delete the new profile folder and rename your old one back when you're done testing if you want.)

]]>https://forums.opera.com/post/296929https://forums.opera.com/post/296929Fri, 23 Dec 2022 15:44:48 GMT<![CDATA[Reply to Cant remove Private Searches hijacker extension on Fri, 23 Dec 2022 15:42:20 GMT]]>@surge7861 said in Cant remove Private Searches hijacker extension:

but there is like 10 opera gx ones that show up im not sure if that is notmal

Yes. That's normal.

]]>https://forums.opera.com/post/296928https://forums.opera.com/post/296928Fri, 23 Dec 2022 15:42:20 GMT<![CDATA[Reply to Cant remove Private Searches hijacker extension on Fri, 23 Dec 2022 13:48:47 GMT]]>Thanks for the reply I'll try to answer all your questions below..

Nothing seems to show up under task manager but there is like 10 opera gx ones that show up im not sure if that is notmal as I havent checked before.

I checked each folder for the manifest.json stuff, there were 5 folders 4 of them were opera and one was for honey (I installed that myself so I could see extensions up the top) doesnt seem to be in there.

The command in target is: "C:\Users*****\AppData\Local\Programs\Opera GX\launcher.exe"
I just covered up personal details with an asterisks

As for the link I followed what I could but im not seeing anything suspicious in task manager to work off of it sadly..

If there is anything else you want me to look up and post I'll do what I can, cheers.

]]>https://forums.opera.com/post/296921https://forums.opera.com/post/296921Fri, 23 Dec 2022 13:48:47 GMT<![CDATA[Reply to Cant remove Private Searches hijacker extension on Fri, 23 Dec 2022 10:58:31 GMT]]>Also see https://virusresearch.org/remove-private-search-protection-com-hijacker/#uninstall_Private.search-protection.com_1.

]]>https://forums.opera.com/post/296914https://forums.opera.com/post/296914Fri, 23 Dec 2022 10:58:31 GMT<![CDATA[Reply to Cant remove Private Searches hijacker extension on Fri, 23 Dec 2022 10:46:16 GMT]]>Do you have a privatesearches process showing on the processes tab in the Windows Task Manager? If so, you can right-click the process and choose "open file location" to find out where it's at.

Also, goto the URL opera://about, take note of the "profile" path. Then, in Windows Explorer (file explorer) (with file extensions on hidden items turned on under "View -> show"), browser to the "Extensions" folder in the profile folder. There you will see extensions sorted by ID folder. In each folder, open up manifest.json in Notepad and see if you can find the ID for the fake Google docs malware extension.

If you can find the ID, that will help as you can open regedit and search the Windows registry for that ID to locate some of the entries for it. For example, the ID might be in a Chrome polices key to tell Chrome to automatically install the extension if it's not installed. That shouldn't affect Opera though as it doesn't support policies, but that should help you get rid of it for Chrome and track down the location of the malware perhaps.

Also, right-click your Opera shortcut, goto "properties" and switch to the "shortcuts" tab. For a pinned Opera taskbar icon, right-click it and then right-click "Opera Browser" and goto properties to get to the shortcut tab. What's the command shown in the target field?

]]>https://forums.opera.com/post/296913https://forums.opera.com/post/296913Fri, 23 Dec 2022 10:46:16 GMT