Yaahoo (not Yahoo) keeps on installing itself

[FrankSMS]

Running Win7 (updated). In the latest Firefox Options, Search, One-Click Search Engines I noticed something odd. Some search engine called Yaahoo, not Yahoo, is there just under DuckDuckGo which I use all the time. I did a file search on the whole computer for Yaahoo but there's nothing. I can delete it but it reappears as soon as I close and open Firefox again. It hijacks my searches sometimes in very strange ways. I've scanned my system using Clamwin, CCleaner, Malwarebytes, Spybot, Windows Defender and SuperAntiSpyware. Nothing. Often with Firefox it uses a lot of resources but usually I'm on huge websites like CNN or Facebook so there's no way it could be some sort of mining hack. But the way my temperatures and CPU use ramps up it sure looks like that. There's nothing else connecting to the internet often, not even email. Just one browser. Its really mysterious. It seems to only happen with Firefox. The only other browser I use is Chrome (Iron) which doesn't seem to be affected but I'll watch its resource use carefully in the future.

Any suggestions? Meanwhile I'll delete it upon opening Firefox. That should help. I'll check it periodically to see if it reappears without restarting but so far that doesn't seem to have occurred.

[85rx-7se]

Try Firefox with add ons disabled. If it goes away, some add on is likely at fault. Also remove Duck Duck and see if the problem is there. A lot of program installers, hide extra items in them that must be deselected when doing the install or you get all sorts of junk. Also delete all your Temporary files ... You may also try a new Firefox Profile -- if it is fine there, then your old profile is messed up. You can also search in the registry for any keys with the name "Yaahoo" and delete them. I could not find anything about this search engine when I tried on Google about it.

[dickvl]

You can also check for unusual files in the Firefox Firefox program folder.

You should only find channel-prefs.js in the "defaults\pref" location.
Any file found here apart from channel-prefs.js is suspicious.
You can check the content of the file in a text editor (use open with and do not double-click the file).
C:\Program Files\Mozilla Firefox\defaults\pref\

[FrankSMS]

> You can also check for unusual files in the Firefox program folder.

There are so many files in there I wouldn't know what is out of place. Is there a way of copying just the name of all the files in this folder? I've never known how to do that with more than one file. It would be rather useful in a situation like this. Other than a screen shot of course which isn't searchable I would think as its an image.

> You should only find channel-prefs.js in the "defaults\pref" location.

Yes just that file there.

So I tried disabling all my my Add-Ons and Yaahoo didn't materialize like before. Then I added then back and it still hasn't reappeared. Go figure.

[johnkirby]

Well, moz2u, I have no idea why you disabled all all your Add-Ons and then added them back to find Yaahoo had stopped appearing. But I gave it a go and ...it did the same for me!! Yaahoo has stopped annoying the hell out of me and vanished. So thank you for sharing that. I would never have thought of trying that.

[FrankSMS]

My purpose was to first determine if one of them was the problem then add them one by one. But I got lazy and just added them all back. I checked for a day and all was well. I just checked now after a few days and low and behold Yaahoo is back in all its infernal glory under One-Click Search Engines.
The Add-Ons I'm using are:

Adblock Plus
Adblocker Ultimate (not sure if its redundant using both of these)
EPUB Reader (which doesn't work for me - just get a black screen after the front cover)
Youtube Downloader mp3

Are you using any of these?

I'll play with these and update the news.
I just realized that a very clever tactic for a virus design is to not reappear right away so it gives the user a false sense of confidence. Shows that we must check a while after removal to check for its return. Nothing more dangerous than a false sense of confidence. As someone wise once said....Don't assume!

[Peja Stija]

Have installed some shady software lately ? Try to run a few apps at a time before relaunching the browser and perhaps you'll find out which app might sneakily be adding it to your FF.

[FrankSMS]

I guess we usually suspect an Add-On but you're right, it could be something else. I guess all we can do is keeping googling for Yaahoo (filtering out Yahoo) and see who else has noticed this. Its probably new so that's why its not posted yet.

[TheVisitor]

I guess we usually suspect an Add-On but you're right, it could be something else. I guess all we can do is keeping googling for Yaahoo (filtering out Yahoo) and see who else has noticed this. Its probably new so that's why its not posted yet.

The only thing I could find along those lines is that Yaahoo is possibly a rebrand of 'Mysearch' which is known malware. Do you have anything in add/remove programs related to 'Mysearch' ?

[FrankSMS]

Nope. As an aside, its important to note that some programs don't end up in Add/Remove Programs for some reason. So I checked Program Files but didn't see anything. I'll keep an eye out though. I did a file search of all drives and mysearch isn't there. I wonder if it could have another name though.