Removing delta-homes from windows 8

Question

This is the second time I've the delta homes search engine installed in my windows 8 computer without my permission, although I've set the privacy that programs don't get installed automatically! Anyway, I'm trying to remove this and despite the following steps: can't and the delta homes search page opens up each time I click on chrome and firefox.

1) I went to the settings, and removed delta homes from there. Managed search engines, set the pages so that chrome opens only. Nothing worked.

2) I checked for installed programs from the control panel so that I could remove it, no result!

3) I tried to search my computer's files, apps etc by 'delta', couldn't find it.

Last time when it happened, I uninstalled mozilla and reinstalled it, and so did for chrome, and it worked. But this time I tried the same with mozilla, it's not working. I restarted my computer, no change!

Please help!!

Solution 1

delta homes search page opens up each time I click on chrome and firefox.

First scan your PC with something like CureIt or Kaspersky Virus Removal Tool. To be sure run them both sequentially.

Then, get rid of the homepages:

1. Right-click your Firefox (Internet Explorer, Chrome, etc) shortcut and in the Target field remove delta-homes URL after the path to firefox.exe (iexplore.exe, chrome.exe, etc). Example:

   • Before: "C:\Program Files\Mozilla\Firefox\firefox.exe" http://delta-homes...
   • After: "C:\Program Files\Mozilla\Firefox\firefox.exe"

2. Open Regedit, and do a search for delta-home. There would be several types of registry entries containing this string.

   • For the keys like HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL remove key value, i.e. make it empty.

   • For the keys like HKEY_CLASSES_ROOT\Applications\iexplore.exe\shell\open\command that contain values similar to this:

     "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://delta-homes...

     replace http://delta-homes... with %1

     WARNINIG: If you're not comfortable with editing registry, ask for someone's help, because using Registry Editor incorrectly can cause serious problems.

3. Check your browsers for any extensions and search engine providers that shouldn't be there. Delete everything that doesn't look familiar to you, you can always reinstall them later. In fact, delta-homes site has removal instructions:

   • Firefox Homepage and default search

     1. Open Firefox.
     2. Click "Open Menu" on the right-top and click “Options” open “Options” panel.
     3. Click “General” tab.
     4. Delete delta-homes homepage link and set a new homepage link. Or click "Restore to Default".
     5. Click "OK".
     6. Choose “Manage Search Engines” in the search list.
     7. Choose "delta-homes" and click "Remove",then click “OK”.
     8. Restart Firefox explore.

   • IE Homepage and default search

     1. Open IE.
     2. Click “Tools->Internet Options”,Open “Internet Options” panel.
     3. Click “General” tab.
     4. Delete delta-homes homepage link and set a new homepage link,or click "Use blank".
     5. Click “Settings” button in the “Search” area,open “Manage Add-ons” panel.
     6. Choose delta-homes and click "Remove",then close “Manage Add-ons” panel.
     7. Click “Apply” or “OK” on “Internet Opens” panel to save the changes.

   • Chrome Homepage and default search

     1. Open Chrome.
     2. Click “Customize and control Google Chrome” in the right-top of the page and click "Setting".
     3. Click “Set pages” link of "On startup" ->delete delta-homes homepage link ->click “OK”.
     4. Click "Change" link of "Apperance" ->delete delta-homes homepage link ->click "OK".
     5. Click “Manage search engines”->delete delta-homes,then click “OK”.
     6. Restart Chrome explore.

Solution 2

There is a standard fix for this in Information Security, which we ghoulishly call "nuke it from orbit".

The process is:

• [Optional] Take a forensic image of the machine
• Wipe the machine
• Rebuild the OS from known good media
• [If possible] Close the hole the malware got in from
• Restore the data from a known good backup.
• [If required] Very carefully recover any data that is in your last known bad backup but not your last known good backup.

Now, of course, to most regular users this seems like a massive overreaction, but it really is the only way to be sure. You don't know what else got in the same way that the malware did, and in these days of modular kit malware you don't know what else the malware has done; it may have installed other malware or opened other ways in.