Malware: how to remove annoying extra argument when Firefox & Chrome processes start

I am in the midst of a malware cleanup, as a result of making the rookie mistake of trying out an .exe file from an unreliable source. Anyway, the malware seemingly tued out to be some sort of adware, the kind that embeds annoying ads in the pages while you are browsing. Right now I'm taking care of that (I least I hope so, since I've been making intensive use of ProcessExplorer, Autoruns, Malwarebytes Anti-Malware and Spy Hunter 4 for the last hours). However, there still remains a tricky modification performed by the malware that I still don't know how to fix. Whenever I run Chrome or Firefox, those processes are executed with an additional argument that points to an annoying russian website, like so:

firefox.exe "http://typhirosapile.ru"
chrome.exe "http://typhirosapile.ru"

(I know this because that's how the processes are getting called according to the "command line" column in the Task Manager, Windows 7)

My educated guess is that there must be some kind of file or registry that tells Windows how to execute Firefox / Chrome processes by default, and somehow the malware modified those files by adding the annoying russian website as an extra argument.

Is my guess correct? And how can I fix this?

Thanks in advance.

- - , .
.

Recent Questions...