Do you know what Search.ph-cmf.com is?
Search.ph-cmf.com is a questionable application that targets your browser or to be more precise, particular browser’s settings, such as default search engine, start page, or new tab page. The application may alter these settings to introduce you the search engine. Probably, the software’s creators are hoping you will use it to surf the Internet and so they might have a chance to generate advertising revenue per clicks. Apparently, the threat could show you advertisements from its third-party associates, and despite their possibly harmless appearance, the ads could come from malicious web pages. Thus, probably the safest solution would be to eliminate the browser hijacker and to make this task easier, our researchers prepared a removal guide that is available below the article.
The search engine was tested in our internal lab by our specialists, and during this process, they indicated that the application is rather identical to other browser hijackers we have already tested before, for example, Search.tr-cmf.com, Search.ma-cmf.com, Search.we-cmf.com, and many others. What they have in common is not only their working manner or appearance but also the same distribution channels. Search.ph-cmf.com could hijack the browser during another program’s installation process if users do not deselect it on the setup wizard.
In other words, the hijacker’s developers might be distributing it with bundled software installers. Such configuration files could be shared through questionable file-sharing web pages. We always advise our readers to look for more trustworthy sources if they want to stay away from unreliable programs, although it might be quite difficult. In some cases, you cannot trust the application even if it comes from a site that looks official. Therefore, it is more important to check the software publishers because if they are reputable, their programs should be safe to use too. Additionally, we would advise using reliable antimalware software, since it can warn you about possible threats.
Search.ph-cmf.com screenshot
Scroll down for full removal instructions
Search.ph-cmf.com should be compatible with Google Chrome, Mozilla Firefox, and Internet Explorer. It might hijack these browsers by modifying particular data. For example, if the user has Google Chrome as his default browser, the application could change data in files named as Preferences, Secure Preferences, and Web Data. These files can be found in the %LocalAppData%\Google\Chrome\User Data\Default directory, and they are responsible for such browser preferences as your start page, search engine, new tab page, and so on. As you realize, after it settles on the system, your browser might start loading Search.ph-cmf.com instead of your previous homepage, new tab page, and so on.
The reason we are against the applications usage is because it might display additional content in the search results. This content should belong to the software’s third party associates and so it could redirect you to unfamiliar web pages. Sadly, some of these sites could promote similar threats (e.g. potentially unwanted programs, adware, etc.) or in some cases even malware (e.g. Trojans, viruses, and so on.). Users who would not like to encounter such content accidentally, should simply eliminate the application and choose a more reliable alternative.
In order to get rid of the browser hijacker manually you would have to fix or delete particular files belonging to the affected browser. Since this task might be too complicated for some of you, we would advise you to have a look at the instructions first and only then decide how to deal with Search.ph-cmf.com. Fortunately, there is another way to erase the application, and you can do it automatically with a legitimate antimalware tool. As soon as the software is installed, open it and set it to scan the system. Then click the removal button, and the antimalware tool should delete all detected threats at once.
Remove Search.ph-cmf.com
Internet Explorer
- Press Windows Key+R, then type Regedit in the provided bow and click OK.
- Use the Windows Registry to locate this specific path: HKCU\Software\Microsoft\Internet Explorer\Main
- Search for a Value Name that is called Start Page and right-click it.
- Select Modify, replace current Value Data (http://Search.ph-cmf.com), and click OK.
- Navigate to this directory: HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
- Find the given Value Names: FaviconURL, FaviconURLFallback, TopResultURL, URL.
- Right-click each of these value names separately and select Modify.
- Instead of http://Search.ph-cmf.com/favicon.ico or http://Search.ph-cmf.com insert a web page you prefer and click OK.
Mozilla Firefox
- Open the Explorer and navigate to: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\{Unique Mozilla User ID}
- Find a file called Prefs.js and launch it with Notepad.
- Locate and delete this line: user_pref(“browser.startup.homepage”, “http://Search.ph-cmf.com”) or replace the link within with a web page you prefer.
- Press Ctrl+S and close the file.
Google Chrome
- Access the Explorer (Windows Key+E) and search for the following path: C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default
- Locate and remove these specific files: Preferences, Secure Preferences, and Web Data.
In non-techie terms:
If you want to have a search engine you could trust and use without a fear it might bring you trouble, Search.ph-cmf.com is not the tool you are looking for. The application uses a modified Yahoo search engine, so it could show you suspicious third-party ads and such content might be harmful. For instance, the ads may lead to web pages distributing malicious programs or other browser hijackers. Thus, we believe you should not take any chances with the hijacker and get rid of it either with the instructions placed above or with a trustworthy antimalware tool.