4

On a Windows 7 system, the search provider has been hijacked, and keeps prompting us to change it when Internet Explorer 9 starts up. It brings up the Manage Add ons dialogue, and we can click on any of the providers, but clicking Set as Default does nothing. We can delete anything other than the one that is ironically named nothing, and it even does it if I launch Internet Properties without IE9 starting. I then tried to Reset all the settings, but it did not change anything.

Where in the registry or on the filesystem does Windows store this data so I can manually remove the entries?

Canadian Luke
  • 24,640

2 Answers2

10

For user-specific search providers, edit this registry key:

HKCU\Software\Microsoft\Internet Explorer\SearchScopes

For system-wide search providers, edit this registry key:

HKLM\Software\Microsoft\Internet Explorer\SearchScopes
Synetech
  • 69,547
Phillip R.
  • 2,101
  • 1
  • 16
  • 12
2

HijackThis will detect unauthorized modifications to IE’s search engines (via each of several different methods) and let you revert them easily.

Further, if you know you have malware, run a scan with some malware scanners, including specifically Spybot which can find numerous problems and “innoculate/immunize” IE at both the user and system levels.

Synetech
  • 69,547