smartsputnik.ru became my default search engine, replacing Google search

Question

I had a major problem trying to get smartsputnik.ru from being my default browser. I'm pretty sure that it came from some weird Japanese game my neighbor's kid downloaded recklessly from some site.

I tried removing it from Google Chrome through the settings but I can't remove it. This is what Chrome tells me:

This setting is enforced by your administrator.

I haven't seen that before, nor did I know that was even possible. I checked the only other browser on my PC, IE. And smartsputnik was there as well. Also I went to regedit and looked for the "smartsputnik" keyword using 'Find'. All I saw was one value and I deleted it. I ended process trees of those that I haven't seen before. But I saw some of them coming back.

I've reset Chrome settings afterwards but the problem persists.

I don't want to mess anything else since I'm more of the game developer type.

I also tried SystemLook program from what I've read in the internet. But that was for another malware. I didn't understand the logs I got and don't want to mess with it as well.

I'm all out of options here.

I need to remove this search engine and anything related to it. It's in Russian language so I don't need it even more.

Solution

Have you already tried right-clicking the chrome shortcut, going into properties and looking if something is added to the path like "....chrome.exe http://somesite.com"?

Also look if there's something in the program files folder.

Try reinstalling chrome or running it as administrator.

You could also use CCleaner to remove add ons and plug ins which you can download on Piriforms website

---

Update

I found something interesting on this page. It might help you.

Comments

[Gian Carlo Manuel]

Sorry. I'm having trouble as to what path it is. Did you mean where is the program it is leading to? If that's the case, the target file is this: > "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --profile-directory=Default --app-id=mgndgikekgjfcpckkfioiadnlibdjbkf I think it is the last part. Do you agree? Also, the program files there had two suspicious folders * 45.0.2454.99 * 45.0.2454.93 Which I think is just the version files

[xdevs23]

Remove everything after "...chrome.exe". Then click OK and check if it works now. Also check if there are any malicious extensions installed. Chrome Menu -> Settings and on the left hand side click on " Extensions"

[Gian Carlo Manuel]

Good news: No suspicious extensions. Bad news: Deleting that part of the address didn't solved it. Whenever I try to search through the address bar in Chrome, smartsputnik suddenly appears but then gets replaced almost immediately by go.mail.ru My hunch is that whatever program is causing it it is inside my computer locally. Just a hunch tho.

[xdevs23]

Maybe try killing suspicious background processes and clear your history. Did you check if there's something related to this site in your AppData?

[Gian Carlo Manuel]

While waiting for replies, I did look around with with Hidden files set to ON. But I didn't looked at AppData/ so I went there and went to /Local/Google and found a folder called 'Software Removal Tool' but I don't think this is what causes the problem since it was there for a long time. I already run McAfee (Which is legit McAfee) and run the clean and currently running Full Scan. Still the problem persists. But could a file named 'lockfile' be suspicious? It's under AppData/Local/Google/Chrome/UserData.

[Gian Carlo Manuel]

I just reinstalled Chrome. Nothing happened as well.

[xdevs23]

Please look in C:\Program Files\ and C:\Program Files (x86)\ and C:\ProgramData\ for folders which are related to smartsputnik

[xdevs23]

Please look at the updated post.

[Gian Carlo Manuel]

Thank you so much for your help. My eyes are dropping and I just want to sleep. I scanned with SpyHunter4 and it took hours. I just finished. Knowing that it's 3am and I needed to pay for it to get it to fix the problem. Also, I discovery that it found even more malicious software than I thought it would. It's very useful. Then again, I'm still in college. Got no money for it.

[xdevs23]

The best is to search on google for specific solutions. It is very hard to uninstall these types of adware. Best is to look for suspicious files, search the whole registry and also clean temporary directories and reinstall infected applications. You may need to refresh your windows installation by upgrading it using the same version as installed.

[Gian Carlo Manuel]

Thank you for the help and I found the solution. I'm posting my answer. Thanks, mate. :)

[xdevs23]

Of course :D liked to help you

[Andrew Morton]

A warning for anyone reading this answer: that will fix the obvious problem of the default search engine setting, but it is likely that other malware has also been installed.