0

I had a major problem trying to get smartsputnik.ru from being my default browser. I'm pretty sure that it came from some weird Japanese game my neighbor's kid downloaded recklessly from some site.

I tried removing it from Google Chrome through the settings but I can't remove it. This is what Chrome tells me:

This setting is enforced by your administrator.

I haven't seen that before, nor did I know that was even possible. I checked the only other browser on my PC, IE. And smartsputnik was there as well. Also I went to regedit and looked for the "smartsputnik" keyword using 'Find'. All I saw was one value and I deleted it. I ended process trees of those that I haven't seen before. But I saw some of them coming back.

I've reset Chrome settings afterwards but the problem persists.

I don't want to mess anything else since I'm more of the game developer type.

I also tried SystemLook program from what I've read in the internet. But that was for another malware. I didn't understand the logs I got and don't want to mess with it as well.

I'm all out of options here.

I need to remove this search engine and anything related to it. It's in Russian language so I don't need it even more.

random
  • 14,638
  • 9
  • 54
  • 58
Gian Carlo Manuel
  • 3
  • 1
  • 1
  • 3

3 Answers3

0

Try checking Chrome's shortcuts. If you see that the executable path has been modified, remove all the shortcuts. Afterwards run all your spy- and malware checks again, before you recreate the shortcuts.

Praetore
  • 31
  • 3
0

Have you already tried right-clicking the chrome shortcut, going into properties and looking if something is added to the path like "....chrome.exe http://somesite.com"?

Also look if there's something in the program files folder.

Try reinstalling chrome or running it as administrator.

You could also use CCleaner to remove add ons and plug ins which you can download on Piriforms website

Update

I found something interesting on this page. It might help you.

xdevs23
  • 185
  • 7
  • Sorry. I'm having trouble as to what path it is. Did you mean where is the program it is leading to? If that's the case, the target file is this: > "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --profile-directory=Default --app-id=mgndgikekgjfcpckkfioiadnlibdjbkf I think it is the last part. Do you agree? Also, the program files there had two suspicious folders * 45.0.2454.99 * 45.0.2454.93 Which I think is just the version files – Gian Carlo Manuel Sep 25 '15 at 13:47
  • Remove everything after "...chrome.exe". Then click OK and check if it works now. Also check if there are any malicious extensions installed. Chrome Menu -> Settings and on the left hand side click on " Extensions" – xdevs23 Sep 25 '15 at 13:50
  • Good news: No suspicious extensions. Bad news: Deleting that part of the address didn't solved it. Whenever I try to search through the address bar in Chrome, _smartsputnik_ suddenly appears but then gets replaced almost immediately by _http://go.mail.ru/_ My hunch is that whatever program is causing it it is inside my computer locally. Just a hunch tho. – Gian Carlo Manuel Sep 25 '15 at 14:04
  • Maybe try killing suspicious background processes and clear your history. Did you check if there's something related to this site in your AppData? – xdevs23 Sep 25 '15 at 14:15
  • While waiting for replies, I did look around with with Hidden files set to ON. But I didn't looked at AppData/ so I went there and went to /Local/Google and found a folder called 'Software Removal Tool' but I don't think this is what causes the problem since it was there for a long time. I already run McAfee (Which is legit McAfee) and run the clean and currently running Full Scan. Still the problem persists. But could a file named 'lockfile' be suspicious? It's under AppData/Local/Google/Chrome/UserData. – Gian Carlo Manuel Sep 25 '15 at 14:30
  • I just reinstalled Chrome. Nothing happened as well. – Gian Carlo Manuel Sep 25 '15 at 15:29
  • Please look in C:\Program Files\ and C:\Program Files (x86)\ and C:\ProgramData\ for folders which are related to smartsputnik – xdevs23 Sep 25 '15 at 15:52
  • Please look at the updated post. – xdevs23 Sep 25 '15 at 15:57
  • Thank you so much for your help. My eyes are dropping and I just want to sleep. I scanned with SpyHunter4 and it took hours. I just finished. Knowing that it's 3am and I needed to pay for it to get it to fix the problem. Also, I discovery that it found even more malicious software than I thought it would. It's very useful. Then again, I'm still in college. Got no money for it. – Gian Carlo Manuel Sep 25 '15 at 19:04
  • The best is to search on google for specific solutions. It is very hard to uninstall these types of adware. Best is to look for suspicious files, search the whole registry and also clean temporary directories and reinstall infected applications. You may need to refresh your windows installation by upgrading it using the same version as installed. – xdevs23 Sep 25 '15 at 19:10
  • Thank you for the help and I found the solution. I'm posting my answer. Thanks, mate. :) – Gian Carlo Manuel Sep 26 '15 at 09:56
  • Of course :D liked to help you – xdevs23 Sep 26 '15 at 10:10
0

I've found the ANSWER!!

The thing is, fixing the problem itself is pretty simple. It only involves setting Google as the default search engine and deleting ">" which is the name of the search engine itself and leading to smartsputnik. But, like I said, I couldn't because a message "This setting is enforced by your administrator"

That is what I had to fix!

All I had to do was go to regedit to remove the key for smartsputnik.ru and navigate to:

HKEY_LOCAL_MACHINE/SOFTWARE/Policies/Google/GroupPolicies

and then I deleted it. I also went to it's folder and deleted it.

When I reset Chrome settings again, I got to change my default search engine and VOILA~~! Problem solved. :)

Thank you for the help~!

Gian Carlo Manuel
  • 3
  • 1
  • 1
  • 3
  • A warning for anyone reading this answer: that will fix the obvious problem of the default search engine setting, but it is likely that other malware has also been installed. – Andrew Morton Oct 03 '15 at 17:45