I know that I have "getsearchredirect" but I can't get rid of it. I think it's a Bing + Edge thing.

Status
Not open for further replies.

H2OGuy

New Member
Thread author
Aug 24, 2022
13
Hello,

I am using Edge on a Windows 10 computer using the Bing search engine. I am fairly certain that I am infected with "getsearchredirect" because I can watch it in my search bar (address bar) go to the getsearchredirect.com page. Two things. First of all, it doesn't redirect me to another page in the end. I go exactly where I want to go. It just eats up time going to the redirect page before sending me where I want to go, and I'd rather not have a redirect malware. Second, nothing that I do can seem to get rid of it. I've gone to the specific MalwareTips page, and none of it works. I don't have any obvious installed programs to remove, or any apparent browser items to remove. This started at least a month ago, probably more, and I did nothing about it because it wasn't actually taking me anywhere that I don't want to go. However, I recently realized that it could be not just eating up browser time with the redirect, but could be capturing user-specific information as well.

Malwarebytes just detects some false positives. ADW detects nothing, and I haven't tried Hitman because I don't want to get involved with Sophos, I've had a very bad experience with them in the past.

I did try SpyBot, and it detected some "ZippyShare" items that I don't recognize, but couldn't remove them without paying.

It appears to be an Edge + Bing specific item, as I can use other native search engines and other browsers (Firefox) without any interruption. I'm using ZoneAlarm firewall (free version) and BitDefender antivirus (free version).

I'd hate to know that it's anything tucked into Windows somewhere that's messing with my normal files as well. So if there's something on my computer that publishes the malware... I'd like to know.

Many thanks for your assistance. This is the first time that I've opened up a new post on MalwareTips.
 

Attachments

  • Addition.txt
    27.8 KB · Views: 22
  • FRST.txt
    60.8 KB · Views: 29
Last edited:
  • Like
Reactions: Jack and BryanB

nasdaq

Moderator
Verified
Staff member
Nov 5, 2019
913
Hello, Welcome to MalwareTips.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===


Please execute Malwarebytes one more time and delete all the items that will reported.

Restart the computer normally after the removal.

If the problem persists run the Farbar Program and post fresh logs for my review.
Include a fresh Malwarebytes logs also.
 

H2OGuy

New Member
Thread author
Aug 24, 2022
13
Hello, thank you for assisting me!

I did what you asked, with the one additional detail of first uninstalling the program that was generating all of the false positives.

I then ran MalwareBytes, which showed a clean system. Then I rebooted and ran MalwareBytes again, and it showed a clean system.

I checked in with Edge/Bing and discovered that "getsearchredirect" is still active, unfortunately.

I then ran MalwareBytes a third time in order to generate a log.

Then I ran Farbar RST again, so I could post the log for you. I hope it helps!

Edit: The system is not allowing me to post a FRST log. It uploads but does not display the FRST as being posted. Any help?
 

Attachments

  • MWB Log.txt
    1.2 KB · Views: 21

nasdaq

Moderator
Verified
Staff member
Nov 5, 2019
913
Hi,

Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===


No malware was found in your logs.
This fix is just some maintenance.


Please post the Fixlog.txt and let me know what problem persists.
 

Attachments

  • Fixlist.txt
    1.1 KB · Views: 18

H2OGuy

New Member
Thread author
Aug 24, 2022
13
Hello! Thank you again.

I just ran the FRST and it said that it fixed everything (if you read my earlier version of this post, I was stupid because I had the Fix file in the wrong folder).

Where do I go now?

Thank you!
 

Attachments

  • Fixlog.txt
    4.7 KB · Views: 15
Last edited:

H2OGuy

New Member
Thread author
Aug 24, 2022
13
I just went to use my browser, and it is still using getsearchredirect.

The connection is worse than ever. When I do a search now, it tries to connect to ".trovi.com".

If I do a search on my Bing homepage, getsearchredirect takes over and shows me a bunch of results using Google (supposedly).

I don't know if this is helpful or not, but I used SpyHunter (free) and it discovered getsearchredirect at:

c:\users\%me%\appdata\local\microsoft\edge\user data\default\preferences :: Sorry
 
Last edited by a moderator:

nasdaq

Moderator
Verified
Staff member
Nov 5, 2019
913
Hi,

Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

After the restart Clear browsing data stored on your device

Restart Edge.

If the problem persist continue with the link above and Clear browsing data stored in the cloud (if you’ve turned on sync or personalization)



Please post the Fixlog.txt and let me know what problem persists.
 

Attachments

  • Fixlist.txt
    692 bytes · Views: 17

H2OGuy

New Member
Thread author
Aug 24, 2022
13
Hello.

Unfortunately, I'm still getting redirected through getsearchredirect into what is supposedly a Google search (that has next to nothing to do with my Bing search).

I had a Windows Update take place, do I need to make a new FRST Log for you? I don't know how FRST works, obviously.
 

Attachments

  • Fixlog.txt
    2.3 KB · Views: 17

H2OGuy

New Member
Thread author
Aug 24, 2022
13
Unfortunately I'm still getting getsearchredirect when I use Bing on Edge. It doesn't affect anything else. I'm having trouble attaching the Fix log to this post.

I don't know if this is important or not, but I have had some system and software changes since I ran the first FRST that is being used. Do you want me to run another one with the updated information?
 

nasdaq

Moderator
Verified
Staff member
Nov 5, 2019
913
Hi,

Please run a scan with the Farbar program and post fresh logs for my review.
If you have difficulties in attaching the logs copy and paste them in our next reply.
 

H2OGuy

New Member
Thread author
Aug 24, 2022
13
Hello again, thank you for putting up with me, I really do appreciate all of the time and effort that you're showing me.

Here are the two new FRST logs.
 

Attachments

  • Addition.txt
    31.7 KB · Views: 17
  • FRST.txt
    60.8 KB · Views: 17

nasdaq

Moderator
Verified
Staff member
Nov 5, 2019
913
Hi,

Nothing suspicious was found in your logs.

I found this link Remove Getsearchredirecting.com Redirect (Removal Guide)


Some of the suggested tool have been used. No arm in going to the process again.
Try the other suggestions.

===

You may also have a problem with the Windows Updates.


Open the Addition.txt logs and look in the = Restore Points = section.

This error may be the cause or these multiple tries.

Under Application errors:
Description: Faulting application name: Explorer.EXE, version: 10.0.19041.1889, time stamp: 0xd1439b88

I suggest your download and run the troubleshooter

Windows Update Troubleshooter

Please keep ke posted of any development.
 

H2OGuy

New Member
Thread author
Aug 24, 2022
13
Hello.

Well, thanks for reading the logs. Before I go, would it make any difference if Edge was open or closed during the Farbar scan?

I tried that link, but it didn't find any malware to remove. My Bing searches just keep getting redirected.

If this is a browser Edge/Bing issue, would resetting my whole computer get rid of it, or would it just hang around in memory or my personal filles? I don't know if Edge gets a clean start when Windows does.
 
Last edited:

nasdaq

Moderator
Verified
Staff member
Nov 5, 2019
913
Hi

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.

Code:
start

Comment: For your security a new restore point will be created.
CreateRestorePoint:
Comment: We need to close all processes to complete the fix.
CloseProcesses:

FilesInDirectory: c:\users\%me%\appdata\local\microsoft\edge\user data\default\preferences\*.*


Comment: The system will restart.
Reboot:

End

Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===


Please post the Fixlog.txt and let me know what problem persists.
 

H2OGuy

New Member
Thread author
Aug 24, 2022
13
Thank you again. Here is the log; now it is all of the search engines in Edge.

One thing that might need to be taken into account... when I originally posted the file path, I used "%me%" just to represent my name. It should actually be "mdv88" So,

c:\users\mdv88\appdata\local\microsoft\edge\user data\default\preferences\*.*

for instance. I hope that this hasn't been messing up all of your searches. I apologize for that. Maybe it will help?
 

Attachments

  • Fixlog.txt
    1.1 KB · Views: 16

nasdaq

Moderator
Verified
Staff member
Nov 5, 2019
913
Hi,

Can you open the folder in bold and see if there is such a folder or filles in it?

It may be hidden so make sure you can see all the files.
 

H2OGuy

New Member
Thread author
Aug 24, 2022
13
I'm sorry, I don't see a link in bold, but this is the only one that I can see, so:

c:\users\mdv88\appdata\local\microsoft\edge\user data\default\preferences\*.*

I can't get into any "preferences" fold (there isn't any). Yes, I can see hidden files and folders. ScreenGrab.pngSorry if I'm missing the bold link...
 

nasdaq

Moderator
Verified
Staff member
Nov 5, 2019
913
Hi,

You did good.

Let see if by chance the bad folder was created as a super hidden file.

refer to this link.

If check uncheck this button.

Click the “View” tab. Uncheck the “Hide protected operating system files (Recommended)” box.
 

H2OGuy

New Member
Thread author
Aug 24, 2022
13
As much as I wish that I had found an answer, I'm not sure that I did. Here's a screen capture of what I did and what I found:
ScreenGrab (2).png
 

nasdaq

Moderator
Verified
Staff member
Nov 5, 2019
913
Hi,


There someting in Windows 10 that eludes me.

Please start a topic in this Forum.

Windows 10 operating system.

An expert with that system may be able to help you find the files in the preferences folder.

When found you should delete them possibly in Safe Mode.

Keep me posted..
 
Status
Not open for further replies.
Top