Stylish Profile and Search13 Removal

This post was written by admin on November 10, 2009
Posted Under: Browser Hijack, Facebook, Stylish Profile, search13

Many Facebook users have compromised their PC security by downloading a plug-in from Stylish Profile to ‘bring life to your Facebook’ only to find that their browser has been hijacked and redirects to search13.net

Update December 2009: Download a-squared antimalware free - Run a full scan on all drives and move all detected items to the quarantine.

Antivirus and antimalware programs do NOT remove this as it is a browser hijacker. After trying several methods of removal, I finally found one that worked.

If you are infected with this hijacker click here to download HijackThis and then close ALL open browsers.

Open your Control Panel and open Add/Remove programs, locate and uninstall Stylish Profile then close the open windows, if you have Revo Uninstaller it will be much easier.

Double click the HijackThis Installer and click Install. The program interface will then open, click on ‘Do a system scan only’.

Follow the instructions with EXTREME CAUTION and only tick the boxes as mentioned. There are 12 items to be removed -- 8 relate to search13.net and 4 relate to Stylish Profile.

The boxes to tick are as follows: Updated -- Not all may be present

R1 -- HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://search13.net/search.php?clid=486&q=%s

R1 -- HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://search13.net/

R1 -- HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://search13.net/

R1 -- HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://search13.net/

R1 -- HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://search13.net/

R0 -- HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://search13.net/

R1 -- HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://search13.net/

R1 -- HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://search13.net/

O2 -- BHO: Update it -- {751BE56D-A6B1-4901-91BA-D62033450B13} -- C:Program FilesStylish ProfileupdaterWin32.dll

O2 -- BHO: tom for ie -- {8AA217B9-D729-4ee0-AED7-E93D695E94A2} -- C:Program FilesStylish Profiletom4ie.dll

O9 -- Extra button: StylishProfile -- {14CD42DD-ABCD-3586-DCAB-40E3693E3737} -- C:Program FilesStylish Profilect.htm (file missing)

O9 -- Extra ‘Tools’ menuitem: StylishProfile -- {14CD42DD-ABCD-3586-DCAB-40E3693E3737} -- C:Program FilesStylish Profilect.htm (file missing)

Once ticked click ‘Fix checked’ and then exit the program.

Open your browser. I have used Firefox and Internet Explorer as they are the most commonly used browsers. Starting with Firefox, go to Tools > Options, under the Main tab enter your preferred homepage then click OK. If you get a message informing you that your homepage is being changed ensure that you tick ‘Allow’

Homepage Guard - click Allow

Then click to ‘Manage Search Engines’ and click on ‘Web Search’ to highlight it and click ‘Remove’ then click OK. Return to ‘Tools’ and click on ‘Add-ons’, scroll through the list and uninstall Express Tab, FBFan, Homepage Guard and Stylish Profile. Restart Firefox. Note that ‘Homepage Guard’ is not always present.

In Internet Explorer click on Tools & Internet Options and change the homepage to your preferred homepage. Click OK then go to ‘Tools’ and click on ‘manage Add-ons’. Any that relate to search13, Stylish Profile or TODO simply click on each one and disable them, although HijackThis should have removed the entries.

Click on ‘Manage Search Providers’ and if ‘Search’ is listed click on it to highlight it and then click ‘Remove’. Exit the window back to your browser and close all open browsers.

Open ‘My Computer > C: > Program Files and delete the Stylish Profile folder. Run CCleaner to clear all temp files and then clean the registry, I use Auslogics Free Registry Cleaner, works well.

Finally, delete the installer for Stylish Profile and if you so wish you can uninstall HijackThis. That’s it, crap removed!

If your homepage is still being redirected to search13 or other strange search engines, open your browser, open a new tab and type “about:config” -- without the quotes -- into the address bar. There will be a warning, click on ‘I’ll be careful, I promise’ and at the top of the window where it says ‘Filter:’ type “keyword.url” -- without quotes -- right click on the results and select Reset.

Make use of free tools such as the Web of Trust add-on which will alert users to bad sites and WinPatrol which will allow users to stop these changes being made or to undo the changes.

Click here for Virus Total analysis

Download links -- all are free:
HijackThis
CCleaner
Auslogics Registry Cleaner
Web of Trust addon
WinPatrol 2010
Revo Uninstaller