Tech: Wisesearch Malware?

Subject: Tech: Wisesearch Malware?
From: wilbyhillbilly
Date: 13 Jan 14 - 10:04 AM

This thing is driving me nuts! I have been trying to get rid of it for over a week now and am at the end of my tether, hence this plea.

I am running WinXP and chrome browser.

Can someone please tell me how to remove it. I've tried all the "googled" methods. Deleted it from Settings/cookies/search engines/ I even went to regedit and found something there that I got rid of. but it's still there every morning when I log on, so I go through the whole procedure again, EVERY TIME!

Most of the google results give free downloads guaranteeing to get rid but I am pretty sure that was how I picked it up in the first place, by trying one of these solutions to get rid of something else, so I am now a bit wary of any "free" downloads.

Any help would be greatly appreciated.

John

Subject: RE: Tech: Wisesearch Malware?
From: Stilly River Sage
Date: 13 Jan 14 - 11:00 AM

Don't try any of those advertised "free" downloads unless you want a worse problem

There are good free software solutions out there, but they don't advertise like the one's you're seeing.

I have a routine I go through if I encounter what seems to be malware.

I keep an up-to-date free version of Malwarebytes in my computer. Search and see if it finds and isolates the problem. If you don't have it already or are unable to download updates, it is suggested that you start the computer in safe mode with networking and download it but when you save it change the file name to get past malware that blocks it.

System Restore is your friend - if you go back to a date well before the appearance of the bug, and if your restore points have been left alone.

A regular go-to place that I consult for this kind of thing is BleepingComputer.com, though I don't find mention of this malware there. They usually post step by step methods for removing problems and I've learned a lot from this place. I think they're the ones who recommended several of the background programs I regularly run.

Don't let it happen again. Run a program like WinPatrol (this links to the download page). It runs in the background, you can use the free version very happily (just click through the registration screen and you'll default to the free version - the whole thing downloads and you choose which to use.) WinPatrol watches the registry and doesn't let anything change it without popping up a box to ask if you wanted to do that. If it pops up when you're working on installing a new program, no problem, but if it seems random then chances are something is in the background trying to sneak into your computer.

You can go search a site like Symantec's Security Response page to see if your bug is making its presence known to the security vendors.

Finally, be careful with any "promiscuous browsing" and be wary of those tempting photos of voluptuous babes (with links embedded) that lead to salacious stories about "she did it at school!" types of stories. They're bound to be trouble for the computer.

Good luck in removing it.

SRS

Subject: RE: Tech: Wisesearch Malware?
From: Jack Campin
Date: 13 Jan 14 - 11:18 AM

This looks on the level:

http://malwaretips.com/blogs/websearch-wisesearch-info-removal/

As usual, the simplest and most effective fix is to remove Windows from your computer. No other OS is vulnerable to it.

Subject: RE: Tech: Wisesearch Malware?
From: Stilly River Sage
Date: 13 Jan 14 - 11:38 AM

That't a lot of steps, but it is an answer. I'd try System Restore first, it's faster.

SRS

Subject: RE: Tech: Wisesearch Malware?
From: JohnInKansas
Date: 13 Jan 14 - 12:20 PM

System restore sometimes works, but sometimes is the cause of "recurring infection." Many kinds of malware insert a line in the registry to reinstall themselves every time you reboot, if the malware itself has been removed. If you've rebooted a half dozen times, ALL restore points may be thus infected.

The ONLY solution where this happens is to turn off "Restore," which deletes all records of past system configurations, remove the malware, and turn "Restore" back on only after the malware has been successfully removed.

Once the system is "clean," and System Restore is turned back on, a new restore point will be created and stored the next time you reboot.

IFF this is necessary, the instructions for removal of the particular infection you have, from any of the reputable AV makers, should tell you do do it.

Nearly all major AV makers have "remote scan" utilties you can use (no charge) to determine whether an infection is present. You might have to "purchase" one of their advanced products to have them remove it, but they will tell you what's there, and generally will direct you to "manual removal methods" that you can use without buying anything.

Most AV makers recommend a scan using their remote scan utility before installing/reinstalling their AV software so you don't have to own their stuff or have it on your computer to get their free scans.

Any of the popup "free removers" is as likely to be a source of new malware as to be a help.

Go ONLY to known reputable AV makers for advice, print their instructions if necessary, and follow them carefully.

John

Subject: RE: Tech: Wisesearch Malware?
From: JohnInKansas
Date: 13 Jan 14 - 02:07 PM

A quick look finds descriptions of websearch.wisesearch as a group of (at least) three separate but similar programs pretending to be "search engines." A problem with them is that they may redirect you to a new homepage and may prevent using any other search tools, and the "results" they produce are almost exclusively from "paid advertisers," many of whom are likely to be malware/adware distributors.

Some AV programs may see the "search engines" as legitimate programs, and hence will not attempt to remove them. Any AV program that also looks for "adware" most likely will at least give a warning, but different AV makers have different definitions of what's acceptable.

My Google search produced lots of hits, but on the first page of "results" my Norton flagged about a third of the "hits" as "UNSAFE SITES."

Instructions from apparently reliable sites indicate that you should be able to remove the Wisesearch using tools in the affected browser, primarily by disabling "add-ons" you allow the browser to use, but since even brief use of the wisesearch program may have taken you to other malware a complete cleanup may involve finding lots of other "stuff." Some of the resulting invasive things may actually be malware, but more likely most will just be invasive adware and/or site redirectors to take you to more of the same unwanted "adware," some of which may have installed more malicious things.

Based on the sparse verifiable information I found, it is unlikely that some "free AV" programs will even detect (or remove) this crud, due to it's appearance as "just another search engine," unless they also include "adware blocking" and "malicious cookie detection" in fairly sophisticated form. Manual removal of all the "add-ons" it might use, in your browser, would be about the only approach likely to work, if that's your situation.

If you don't have an AV program that you trust, you might want to try the free Norton program. It does indicate "malicious cookie" detection, and might find/remove adware like your main problem. Although I haven't tried it out, it should install easily and be easily removable if it doesn't help.

If you don't want to try that, or something similar from another AV maker, or if it doesn't work, I would suggest going directly to your browser's site and "search on site" for assistance since most of the advice I found that "looks safe" indicates that appropriate changes to browser settings (esp. add-ons) should at least disable this infection.

John

Subject: RE: Tech: Wisesearch Malware?
From: wilbyhillbilly
Date: 14 Jan 14 - 03:55 AM

Thanks all for the input, there's a couple of things there that I haven't tried yet. But it is proving a real pain to get rid of. I tried blocking it in google chrome and also deleting it from extensions etc, but every time I delete it from "manage search engines" it's back again the next time I boot and again keeps showing 4 cookies even though I delete them every time.

I did try one program called Spyhunter and it did find it but then wanted a lot of dollars to wipe it and I wasn't sure whether after buying it that it would actually work. Has anyone used this because if it really works then it might be worthwhile investing in it.