Search.ph-cmf.com Removal Guide

It becomes somewhat of a routine to inform you about browser hijackers like Search.ph-cmf.com. There have been several other programs from the same group and these “search engines” even look identical to each other. This also means that we can use the same methods to remove all these applications. So to get rid of Search.ph-cmf.com, simply scroll down to the bottom of the description where you will find the manual removal instructions. Also, you should consider getting a computer security application that would warn you about similar threats floating around. After all, cyber infections do not come alone, so it is always a good idea to have a professional tool that would help you deal with it.

As mentioned, the browser hijacker comes from a long line of similar intruders, for example, Search.yourmapscenter.com, Search.youremailnow.com, or Search.yourclassifiedscenter.com, to name just a few. All these programs are distributed in the same manner. Our researchers say that they probably spread via third-party installers. Users encounter such installers when they download freeware applications from third-party sites. Although such sites are not inherently malicious, they could be easily used as a platform for promotion and distribution by malware developers. So if you want to avoid the likes of Search.ph-cmf.com, you should refrain from downloading apps from unfamiliar sites. If you must have some program, be sure to get it at its official website.

So let us say you already have Search.ph-cmf.com on your computer, what’s next? Luckily, you will notice immediately that the browser hijacker has perched on your browser because it does not try to hide it. It changes the homepage on Internet Explorer, Chrome, and Firefox, and then it redirects all of your web search queries through its server. It might look that this “search provider” gives you reliable search results, but take a closer look: it is simply using the custom version of Yahoo! Search. Of course, Yahoo! Search is not related in any way to this intruder, and the search engine is simply exploited by the hijacker to deliver and display customized search results.

Sometimes it will look like the search results are more related to what you like than they should be. You are not seeing things. Search.ph-cmf.com collects information about your likes and preferences as it tracks your online activities. Then it can generate custom content in the search results and even the commercial advertisements it accommodates. Custom content increases the possibility of your clicking these links and ads, and this is exactly what the hijacker needs. Your clicks help it make money via the pay-per-click system.

The problem here is that Search.ph-cmf.com does not look further your click. It does not review the content it promotes, and so anyone could make use of the program to promote their links. And if the links happen to be corrupted or leading to a malware-related website, you could get infected with a severe security threat.

Do not allow this to happen. Remove Search.ph-cmf.com right now and then scan your PC with the SpyHunter free scanner. You cannot forget other unfamiliar programs that might have entered the system with the hijacker. So terminate them all and then proceed with caution whenever you go online because you can never know when you encounter similar threats again.

How to Remove Search.ph-cmf.com

Internet Explorer

1. Press Win+R and type regedit. Click OK.
2. Go to HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main.
3. Right-click the Start Page value on the right.
4. Select Modify and change your homepage address. Click OK.
5. Go to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.
6. On the right pane, modify the following values:
   FaviconURL
   FaviconURLFallback
   TopResultURL
   URL
7. Save changes and exit Registry Editor.

Firefox

1. Press Win+R and the Run prompt will open.
2. Type %AppData% into the Open box and click OK.
3. Go to Mozilla\Firefox\Profiles\[Unique user ID].
4. Find the prefs.js file and open it.
5. Delete this string: user_pref("browser.startup.homepage", "http://Search.ph-cmf.com");
6. Save changes and exit the file.

Chrome

1. Press Win+R and type %LocalAppData%. Press Enter.
2. Navigate to Google\Chrome\User Data\Default.
3. Delete these files: Preferences, Secure Preferences, and Web Data.