Cant remove Private Searches hijacker extension

[burnout426]

burnout426 Volunteer last edited by

Also see https://virusresearch.org/remove-private-search-protection-com-hijacker/#uninstall_Private.search-protection.com_1.

[Surge7861]

Surge7861 last edited by

Thanks for the reply I'll try to answer all your questions below..

Nothing seems to show up under task manager but there is like 10 opera gx ones that show up im not sure if that is notmal as I havent checked before.

I checked each folder for the manifest.json stuff, there were 5 folders 4 of them were opera and one was for honey (I installed that myself so I could see extensions up the top) doesnt seem to be in there.

The command in target is: "C:\Users*****\AppData\Local\Programs\Opera GX\launcher.exe"
I just covered up personal details with an asterisks

As for the link I followed what I could but im not seeing anything suspicious in task manager to work off of it sadly..

If there is anything else you want me to look up and post I'll do what I can, cheers.

[burnout426]

burnout426 Volunteer @Surge7861 last edited by

@surge7861 said in Cant remove Private Searches hijacker extension:

but there is like 10 opera gx ones that show up im not sure if that is notmal

Yes. That's normal.

[burnout426]

burnout426 Volunteer last edited by

Do you see any weird exe files at the root of "C:\Users\yourusername\AppData"?

If you rename your profile folder, does the extension show up and keep coming back in the new profile too? (You can delete the new profile folder and rename your old one back when you're done testing if you want.)

[Surge7861]

Surge7861 last edited by

I did forget to mention i did create a dummy profile on the pc yesterday and tested opera gx on a fresh install there and it didn't show up so i believe it's tied to just my profile and only opera as ive tested other browsers on my profile too.

[Surge7861]

Surge7861 last edited by

As for the exe in the file I have the opera.exe and 2 orthers
launcher.exe.1671441701.old
launcher.exe.1671666764.old
So I dont think any of them are the issue

[hvvvpl]

hvvvpl last edited by

im get this same virus yesterday, in my task manager i hav
Antimalware Service Executable
Application Frame Host
calculator(2) (but in portugese)
COM Surrogate
COM Surrogate
crashpar_handler
crashpar_handler
Device Association Framework ...
hpwuSchd Application (32bits)
User OOBE Broker
Usermode Font Driver Host
Video Application (2)

if some one knows if one of these its weird or somethhing tell me plz

[burnout426]

burnout426 Volunteer @Surge7861 last edited by

@surge7861 Okay. It's probably best to start fresh with a new profile then instead of trying to fix your profile.

[Lettuce-x]

Lettuce-x last edited by

I don't have any idea why the browser looks like this when I search for anything, can I get some help please?

[leocg]

leocg Moderator Volunteer @Lettuce-x last edited by

@lettuce-x Read the topic above.

[Anawilliam]

Anawilliam Banned @burnout426 last edited by

@burnout426 Thank you for you explanation! I will use this