# how to remove yoog search engine?



## bursuc17

i think this might be some kind of worm or something since i didn't install it. i use firefox and opera web browsers latest versions,and this yoog search engine replaced the google search engine in both browsers or any other search engine i assing as default.in firefox it creates/edits files USER.js and PREFS.js and Yoog Search.xml and in opera it edits the search.ini file.i deleted the files i uninstalled the browsers and installed againthe damn thing stays there no matter what i do.spyware doctor says everything is ok.don't know what else to do.So if any of you can help me with this i would really appreciate.

user.js : user_pref("browser.search.selectedEngine", "Yoog Search");
user_pref("keyword.URL", "http://www10.yoog.com/search.php?q=");
user_pref("keyword.enabled", true);


prefs.js : # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the application is running,
* the changes will be overwritten when the application exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1228584837);
user_pref("app.update.lastUpdateTime.background-update-timer", 1228584836);
user_pref("app.update.lastUpdateTime.blocklist-background-update-timer", 1228584837);
user_pref("app.update.lastUpdateTime.search-engine-update-timer", 1228584837);
user_pref("browser.search.selectedEngine", "Yoog Search");
user_pref("browser.startup.homepage_override.mstone", "rv:1.8.1.18");
user_pref("extensions.lastAppVersion", "2.0.0.18");
user_pref("intl.charsetmenu.browser.cache", "UTF-8");
user_pref("keyword.URL", "http://www10.yoog.com/search.php?q=");
user_pref("network.cookie.prefsMigrated", true);
user_pref("urlclassifier.tableversion.goog-black-enchash", "1.65485");
user_pref("urlclassifier.tableversion.goog-black-url", "1.25401");
user_pref("urlclassifier.tableversion.goog-white-domain", "1.484");
user_pref("urlclassifier.tableversion.goog-white-url", "1.371");


Yoog Search.xml :
- <SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/">
<ShortName>Yoog Search</ShortName> 
<InputEncoding>UTF-8</InputEncoding> 
<Url type="text/html" template="http://www10.yoog.com/search.php?q={searchTerms}" /> 
</SearchPlugin>


----------



## Hemiod

user.js : user_pref("browser.search.selectedEngine", "Google");
user_pref("keyword.URL", "http://www.google.co.uk/search?hl=en&q=");
user_pref("keyword.enabled", true);

That will restore the search url back to Google.

I have same problem but i cannot find the yoog's DLL or XML that overwrite the Mozilla user preferences i need your to find it

http://www.360n.com/remove_yoog.htm << For IE not Firefox


----------



## bursuc17

it's in the application data folder ,by default it's invisible and it's in Cocuments and settings\yourpc\.Look in the mozilla folder,you will find all those files in there,but editing them as you said won't do it i already tryed that when i left the first post in here, you edit the files and the next time you restart the browser it all the same again , it must be some DLL or other file in the system folder that overwrites the files to the yoog settings again.excuse my english


----------



## bursuc17

IE doesn't do it for me , i don't use it and i had it disabled the first thing after reinstalling xp


----------



## Hemiod

yeah, I think we need to find the file call Globaladsolution for firefox


----------



## johnwill

Uninstall Firefox totally, and remove the Mozilla folder from *Program Files* and also under your profile.

Install Firefox again.


----------



## bursuc17

ok ,now i think i got it.took me a while but my browsers are "clean" now.you were right about the globaladsolution file.you must locate and delete a file named : cont_globaladsolution-remove.exe from your system32 folder and then remove nsglobadlsolution.dll from Progfiles\mozilla\components folder. uninstall mozilla delete mozilla folder from C:\progfiles and from c:\documents and settings\yourpc\app data\ . and last but i'm not sure it has anithing to do with this yoog search engine,delete any kavo0.dll tavo0.dll KAVO0.DLL TAVO0.DLL,i found them in my system32 folder and if you find them too then it definetly has something to do with the yoog search


----------



## Hemiod

Hmmm i cannot finds these files :S


----------



## twlvvman

bursuc17 You are the King. I followed you directions. The file on my computer was cont_adsoftinc_remove.exe and the dll was nsadsoftinc.dll. Removing these files and removing the references to yoog from the registry fixed the problem. I did not need to reinstall firefox. 

Thanks for the help

Twlvvman


----------



## Mr.Steve

Hi,

I have this Yoog Malware also and I have tried everything to get rid of it, including the above advice which did not work. I do suspect however it might be because the strings are different on my machine and although I tried to compensate for the difference it did not work.

I am also having two other problems that might be related to this Yoog search malware that attaches itself to Firefox. 

1: I cannot see the admin/Application Data folder on my hard drive (or as it happens the Local Folder) even after I click folder options/ show hidden folders (as well as doing this via windows explorer). 

2: When I do change my folder options to view hidden files it just resets itself immediately on opening a folder no matter what I do - It just will not store the saved view options.

I am also constantly getting some search engine page (no name) on any error 404 pages I get, which will not let me use the back button to escape them. The only way to return to where I was is by going back to the beginning and starting over; which is a nightmare if I am logged into a website I’m working on and hit a broken link triggering this error 404 message and no way back.

Please help guys, I have been searching and trying different remedies for nearly a day. I have managed to delete this yoog file several times but it just keeps coming back.

Thanks - Steve


Im running windows XP with SP2 via bootcamp on my Imac machine. I recently did an upgrade to winXPSP3 (in october) and it totally screwed my antivirus system (Zone Alarm) - it would not let me surf with maximum protection and kept cutting my internet connection off. So I decided to reinstall and since turned automatic updates off.


----------



## twlvvman

Steve, I can't help much with the imac. I suspect that is part of the problem with viewing the files or I have seen other malware that will prevent you from viewing the admin areas. I know you don't want to hear it, but a clean install may be your best answer. 

One other thing I found on getting rid of the yoog. It wasn't showing up in my search engine list, but was still defaulting to it on a url line search. I had to remove the user.js file from C:\Documents and Settings\currentuser\Application Data\Mozilla\Firefox\Profiles\2mqbo42t.default to finish cleaning up the problem.

Twlvvman


----------



## GILiad

Thanks bursuc17 & twlvvman. In my case it was cont-adsite-remove.exe, adsite.exe & nscC.dll


----------



## Mr.Steve

Hi Everyone,

First, I want to point out that not a single method currently posted online that I am aware of works when trying to remove Yoog Search Malware. I tried every single one (which takes a lot of time) and they all failed, so this tells me either experts are not taking this serious or they are presently unable to select a generic system for its removal that works.

I am happy to say that I did finally remove Yoog Search Malware from my system and although it seems a long winded way, when compared to the time used in trying alternative ways it proves to be one of the more efficient ways in the long run. It also finds many Malware programs that my current security software missed and therefore was well worth it. 

*Step 1* - Open Firefox and click Bookmarks/Organise Bookmarks. 

*Step 2* - Click Import and Backup and select ‘Backup’. Choose the destination for saving this file and click ‘Save’.

_Only Do Steps 1 and 2 if you want to save all your current ‘Bookmarks’ and ‘Bookmark Folders’ otherwise you can skip this part._

*Step 3* - Uninstall Mozilla Firefox - Control Panel/Add Remove Programs/Mozilla/Uninstall.

*Step 4* – Now remove all traces of Mozilla Firefox from your system - My Computer/C:/Documents and Settings/Admin *or whatever your System Username is*/Application Data *(if this is hidden click folder options and tick the box that says show hidden folders*/Mozilla/Delete this folder if it is still there.

*Step 5* - Remove any other Mozilla Files - Click Start (bottom left corner) and click 'Search'/click 'Search All Files and Folders'/Type in 'Mozilla' in the section that says 'all or part of the file name'/then click 'More Advanced Options' and tick both 'Search System Folders' and 'Search Hidden Files and Folders'/*Click Search and Wait*

*Step 6* - Once the Search has finished, locate the Mozilla files listed and delete them from your system, this includes any Mozilla Files that may be in a different programs such as a Photo Editor.

*Step 7* - When all traces of Mozilla have been deleted from your PC (be sure to empty your ‘Recycle Bin’) then restart your system.

*Step 8* - Download the following programs from these locations if you do not already have them, install them one by one and ensure you update them online. Do not run them yet; just ensure they are up to date. 
•	AdAware
•	SuperAntispyware
•	Spybot Search & Destroy 
•	Malwarebytes' Anti-Malware

*Step 9* – Temporarily turn off your internet connection and disable your current Anti Virus/Spyware programs so they do not interfere with the new programs we will run. 

*Step 10* – Run the programs in the order above, ensuring that you follow each step carefully including any back up requests and re-boots. *I only used the first three to clean my system*

*Step 11* – After rebooting your system, you can uninstall these programs if you wish.

*Step 12* – Turn on your Anti Virus/Spyware programs and reconnect to the Internet. Re-install Mozilla.

*Step 13* – Once Mozilla Firefox is on check to ensure the Yoog Malware has gone and then import your ‘Saved Bookmarks’ by following Steps 1 and 2 but this time choosing ‘Import’ instead of ‘Backup’. 

Your System should now be clean from the Yoog Malware as well as any other Malware your current security software may have missed. I hope this helped. 

One more thing - I do not know if this is relevant but I have ‘Corel’ Paint Shop Pro on my system which I updated recently. There was a Mozilla file embedded in this software (which I removed when purging my system of everything Mozilla) and I wondered if this was a possible hiding place for Yoog? There was no logical reason why this software program used for basic photo editing should contain a file related to a browser, none that I can see anyway.

I hope this helped – Steve


----------



## bursuc17

i'm not a specialist in pc's or something like that but my guess is that we'll be hearing from Mr.Steve becouse i think that importing your old bookmarks was a good idea.Anyway i got the yoog search engine back in my browsers again now,don't have a clue how and that is what pisses me off that.On the whole web you won't find a single line of text that tells you how you get infected with this.


----------



## bursuc17

here ,i hope this will help ,put this in a text named foldersettings file save it rename the extension from .txt to .reg open it and you will be able to use the SHOW HIDDEN FILES AND FOLDERS again.


Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]
"Text"="@shell32.dll,-30499"
"Type"="group"
"Bitmap"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,\
48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,34,00,00,\
00
"HelpID"="shell.hlp#51131"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30501"
"Type"="radio"
"CheckedValue"=dword:00000002
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51104"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30500"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51105"


----------



## GILiad

Hi All,

I observe that this Yoog search engine came up after the auto update of Mozilla. So I suggest that we set the update to ask first before update.


----------



## johnwill

I've updated FF for every update, and I've never seen this thing appear. I really doubt that has anything to do with it.


----------



## bursuc17

i don't think the updates had somethink to do with this search engine either.i updated every time there was a new ipdate avaible,and a update is supposed to increase security in the browser not to inject worms viruses etc.for firefox there is an addon that you could use to prevent the future apparition of this search engine again,you need to set it right becouse it will block any scripts from every web page you visit and that it's not always good.

https://addons.mozilla.org/en-US/firefox/search?q=noscript&cat=all


----------



## Mr.Steve

Hi Guys,

I can confirm that since I carried out the procedure as described in my earlier post, the 'Yoog Search' has not re-appeared. As a bonus my machine is working faster and I still have the software I downloaded to carry out regular in depth scans.

So, it does work. 

I do not think it came from a Mozilla update. My suspects are either 'Real Player' (install and/or update) or a 'Corel Paintshop Pro (X)' update, which I carried out and incidentally found a file related to Mozilla inside the 'Corel' folder. 

Hope I have helped someone else and I am pleased to be rid of it.

Steve


----------



## peterjohnsia

tnx bursuc17... your idea helps me alot... i did what you said.. delete some file in system32.. uninstall mozilla, delete the mozilla's remaining file in progfile and reinstall mozilla again.. after the reinstallation the yoog search engine is gone..... im trying to fix my Ie7 both.. my ie7 and mozilla has same prob.with yoog..


----------



## bursuc17

glad i could help with mozilla but i can't help you with ie7,as far as i'm concerned ie7(6,5,4etc)does not exist,making mozilla your default browser would be a smart thing to do ,and if you want something more like IE try google chrome, i tried it but i¡m gonna stick to mozilla and opera for now.


----------



## yophilly528

None of the previous solutions worked for me. But while digging around in: 

My Computer/C:/Documents and Settings/*admin*/Application Data /Mozilla/Firefox/Profiles/********.default (made of random letters)

I found this folder: searchplugins. Inside was a Yoog.xml file. I deleted the folder and restarted firefox. No more yoog. Ty that.


----------



## bursuc17

if youtake a good look at the first posts you'll see that we also found that folder/file and removed it but with no results,so'i'm guessing that you'll have the yoog search engine back again after you reboot the pc or update the browser,i hope i'm wrong.


----------



## yophilly528

No its gone, but i did delete some stuff in previous posts, maybe a combination did it.


----------



## jagp007

Here's an option that worked for me. I don’t have for complicated solutions. 
First download the Google toolbar for Firefox & install it (if you don’t already have it).
http://www.google.com/tools/firefox...n-ha-na-us-bk-test&utm_medium=ha&tbbrand=GZAZ 
Once installed, Open your Firefox browser and on the toolbar.
“Click on tools.” Then “Click on options.”
In the Main tab look for Add-ons and “Click on Manage add-ons"
Look for the “Extensions” tab and scroll to the “Google toolbar for Firefox” and “Click on options”
“On the choose a toolbar layout” check the “Replace Firefox search box”
Kiss Yoog search goodbye!!!!


----------



## bursuc17

yes but the ideea is to remove it from your system not to hide it.


----------



## ColoS

I found a way to stop Yoog from reappearing after being removed from the search engine list. Go to Control Panel/Folder Options/View scroll down the list until you see "Use simple file sharing" and disable it, hit Apply and Ok.Then go to X:\Documents and Settings\XXXXXX\Application Data\Mozilla\Firefox\Profiles\xxxxx.default to the mentioned in the other posts searchplugins folder and delete yoog.hml file. Go back and right click the searchplugins folder, select Sharing and Security. Select the Security tab and on the bottom of the box named Permissions for Administrators check the deny box in front of "Write" , repeat the same for all Groups or user names after selecting them in the top box, apply the settings and hit ok. When you start Firefox Yoog search is gone  The bad side of this is that if you want to get a new search engine you'll have to uncheck the deny on "Write" because with it on nobody on the computer can create new files in the searchplugins folder and then enable it again to stop Yoog from appearing (because actually the files that create Yoog.hml are still there, but with this option on they don't have access to create it in this folder). I'm using Windows Xp SP3 so this process will probably be different in Vista and other operating systems, but I think that the principle is the same.


----------



## jem83

Mr Steve-
I am NOT particularly tech savvy and some of the approaches in this thread for getting rid of the damn Yoog were totally over my head... also the files they were telling me look for were nowhere to be found. I had another problem, too, which was a whole lot of "sponsored ads" appearing on search engines, like google and wikipedia, and taking up way more of the page than they are supposed to. I thought maybe those things and Yoog were related but wasn't sure. In any case I followed your very straightforward directions from start to finish (opting not to keep my old bookmarks, however) and Yoog is gone, as are all those super annoying ads. So all of the spyware purging really did the trick. I registered on this forum purely to say thanks a million from a lay person for your tech support...


----------



## bursuc17

i'm amazed of how many persons have this yoog search engine problem and still there is no oficial removal solution to it , i mean from like norton or some big antiviris company or something like it.thanks to all the guys that posted here and made it easier for others to remove that search engine.


----------



## kemei

yoog is very hard to remove but there is a method if followed properly will remove it. i had it and got it out. recently from www.gadgetech-info.blogspot.com


----------



## bursuc17

i had opera infected with yoog contrary to what www.gadgetech-info.blogspot.com says.


----------



## Tasch

Thank you so much Steve! it worked I'm happy to say that your way (13 steps) helped me to remove Yoog Malware from my system! ray:


----------



## pcpeart

@Mr Steve
Thanks this worked. I tried a lot of other things and nothing got rid of it before. Interestingly enough I also had corel installed on my pc and during the search there were about 6 files with mozilla in the name that were found I deleted them along with the other mozilla files.
Thanks a milli


----------



## dbeharry

Mr. Steve's approach did it for me as well. I'm not sure that you need to run all of the spyware/malware programs, but it is key to remove anything connected with Mozilla. Especially liked the reminder to backup the bookmarks. 

I agree that it is odd that none of the major software companies has provided a solution to this. Perhaps that is because it doesn't seem at all malicious, yet. 

Thank you.


----------



## darrio84

Go into your start menu and click "search" and type in "Yoog". (Make sure its an advanced search in all files and folders, including hidden and system folders, this option should be under the text window) Delete any files that are found after the search and empty the recycle bin.

Yoog should be gone when you open firefox.


----------



## 2xg

Thanks for the feedback, however this is an Ancient Thread therefore it's time to Close.


----------

