My Lucky 123 “Virus” Removal (June 2019 Update)

My Lucky 123 “Virus” Removal (June 2019 Update)My Lucky 123 “Virus” Removal (June 2019 Update)My Lucky 123 “Virus” Removal (June 2019 Update)

This page aims to help you remove “My Lucky 123”. These “My Lucky 123” removal instructions work for Chrome, Firefox and Internet Explorer, as well as every version of Windows.

There are some specific programs known as Browser hijackers that, once inside a PC, usually mess with the user’s browsers in a very intrusive way. For example, they may impose some undesired changes to your Firefox or Chrome browser, replace your homepage with an unknown one, insert a search engine that may redirect your searches to pages with aggressive ads, pop-ups, and banners and constantly interrupt your normal browsing with unnecessary messages. You are probably on this page because you are facing a disturbance of this type, caused by a program called “My Lucky 123”. The chance is that you are heavily irritated by this browser hijacker and you are looking for ways to remove it. Fortunately, we have an effective solution for you that will help you manually uninstall “My Lucky 123” from your PC and bring your browser back to normal. Below you will find a removal guide with all the instructions you may need to successfully get rid of this program and all of its traces. We have given you also a useful description of this software and the way it operates. Knowing more about it will surely help you remove the unwanted program effectively and prevent close interactions with this type of programs in the future.

My Lucky 123 “Virus” Removal (June 2019 Update)

My Lucky 123 in Chrome

What is My Lucky 123 “Virus”?

First of all let’s clear that confusion up. “My Lucky 123” is not an actual virus. According to security experts, “My Lucky 123” is a potentially unwanted program (PUP) from the category of browser hijackers. When in your system, this software usually takes over your default browser, imposes its changes to your homepage and search engine and installs some plug-ins and add-ons deep inside your system. This is usually done in order to ensure that you are exposed to as many advertisements as possible and most of your searches get redirected to various promotional web pages. The reason for this rather aggressive invasion is that this program is involved in a remuneration model known as Pay-Per-Click. Every time you click on the websites, ads, pop-ups and banners this browser hijacker displays on your screen, its owners earn revenue from your clicks. This is a marketing strategy that helps many online vendors display their ads directly on the user’s monitor and enables other businesses to profit from the paid ads. However, despite there being nothing wrong with this strategy, some users may suffer from a heavy browsing-related disturbance caused by the browser hijacker’s intrusiveness. This is the main reason why they often seek ways to remove it from their computers and bring their browser settings back to normal.

“My Lucky 123” – what to do?

Many people, who are facing “My Lucky 123” and all its obtrusive popping windows, may think that there is something wrong with their PC. The excessive amount of advertisements and the constant page redirects may not only cause interruption to their browsing but it may even cause their computer to operate in a sluggish manner. Moreover, their attempts to restore their old settings are usually in vain because bringing the browser settings back is not possible unless they fully uninstall “My Lucky 123” from their computers. This is something very upsetting and some inexperienced users may consider the browser hijacker to be an alarming threat or a virus.

The good thing is that these programs are not as malicious as a Trojan horse infection or Ransomware. In fact, they are pretty harmless and do not contain scripts that can corrupt your system. Real malware from the rank of Ransomware will cause serious damage to your data and blackmail you, while the worst a program like “My Lucky 123” could do is redirect you to different web pages and nagging ads. However, even if there is no direct risk that browser hijackers could expose you to, for your own safety we would advise you to avoid interacting with the randomly generated messages that pop up out of nowhere. You never know when you may come across suspicious commercial websites infected with viruses and various harmful threats.

How to prevent browser hijackers from getting inside your system?

We always advise our users to pay attention when interacting with online content and especially when downloading and installing software on their machines. Potentially unwanted programs like “My Lucky 123” are usually distributed through software bundles. That’s why it is really important to always check the installation packages of the programs you are about to install for such added software. The quickest way to do this is through the advanced/custom option in the setup, where you can manually deselect them. It is a good idea to avoid the standard installation option and always opt for more detailed settings because this gives you more control over the programs you will install on your computer and will help you keep it bloatware free.


Name “My Lucky 123”
Type  Browser Hijacker
Danger Level Medium (nowhere near threats like Ransomware, but still a security risk)
Symptoms Your homepage is replaced, your search engine redirects you to different pages and your screen is injected with ads and pop-ups.
Distribution Method Usually bundled inside software installers, but could be found also in spam emails, direct downloads, freeware platforms, torrent platforms.
Detection Tool

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you’ll need to purchase the full version.
More information about SpyHunter and steps to uninstall.


My Lucky 123 “Virus” Removal (Chrome/Firefox)

My Lucky 123 “Virus” Removal (June 2019 Update)

Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).

My Lucky 123 “Virus” Removal (June 2019 Update)


Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab (the “Details” Tab on Win 8 and 10). Try to determine which processes are dangerous. 

My Lucky 123 “Virus” Removal (June 2019 Update)

Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

My Lucky 123 “Virus” Removal (June 2019 Update)
Drag and Drop Files Here to Scan
Maximum file size: 128MB.

This scanner is free and will always remain free for our website's users. You can find its full-page version at:

Scan Results

Virus Scanner Result
My Lucky 123 “Virus” Removal (June 2019 Update)ClamAV
My Lucky 123 “Virus” Removal (June 2019 Update)AVG AV
My Lucky 123 “Virus” Removal (June 2019 Update)Maldet

After you open their folder, end the processes that are infected, then delete their folders. 

Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections. 

My Lucky 123 “Virus” Removal (June 2019 Update)

Hold together the Start Key and R. Type appwiz.cpl –> OK.

My Lucky 123 “Virus” Removal (June 2019 Update)

You are now in the Control Panel. Look for suspicious entries. Uninstall it/them.

Type msconfig in the search field and hit enter. A window will pop-up:

My Lucky 123 “Virus” Removal (June 2019 Update)

Startup —> Uncheck entries that have “Unknown” as Manufacturer or otherwise look suspicious.

My Lucky 123 “Virus” Removal (June 2019 Update)

Hold the Start Key and R –  copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

My Lucky 123 “Virus” Removal (June 2019 Update)

If there are suspicious IPs below “Localhost” – write to us in the comments.

Open the start menu and search for Network Connections (On Windows 10 you just write it after clicking the Windows button), press enter.

  1. Right-click on the Network Adapter you are using —> Properties —> Internet Protocol Version 4 (ICP/IP), click  Properties.
  2. The DNS line should be set to Obtain DNS server automatically. If it is not, set it yourself.
  3. Click on Advanced —> the DNS tab. Remove everything here (if there is something) —> OK.

My Lucky 123 “Virus” Removal (June 2019 Update)

My Lucky 123 “Virus” Removal (June 2019 Update)

  • After you complete this step, the threat will be gone from your browsers. Finish the next step as well or it may reappear on a system reboot.

Right click on the browser’s shortcut —> Properties.

NOTE: We are showing Google Chrome, but you can do this for Firefox and IE (or Edge).

My Lucky 123 “Virus” Removal (June 2019 Update)

Properties —–> Shortcut. In Target, remove everything after .exe.

My Lucky 123 “Virus” Removal (June 2019 Update)

My Lucky 123 “Virus” Removal (June 2019 Update)  Remove My Lucky 123 from Internet Explorer:

Open IE, click  My Lucky 123 “Virus” Removal (June 2019 Update) —–> Manage Add-ons.

My Lucky 123 “Virus” Removal (June 2019 Update)

Find the threat —> Disable. Go to My Lucky 123 “Virus” Removal (June 2019 Update) —–> Internet Options —> change the URL to whatever you use (if hijacked) —> Apply.

My Lucky 123 “Virus” Removal (June 2019 Update) Remove My Lucky 123 from Firefox:

Open Firefoxclick  My Lucky 123 “Virus” Removal (June 2019 Update)  ——-> Add-ons —-> Extensions.

My Lucky 123 “Virus” Removal (June 2019 Update)

Find the adware/malware —> Remove.
My Lucky 123 “Virus” Removal (June 2019 Update)Remove My Lucky 123 from Chrome:

Close Chrome. Navigate to:

 C:/Users/!!!!USER NAME!!!!/AppData/Local/Google/Chrome/User Data. There is a Folder called “Default” inside:

My Lucky 123 “Virus” Removal (June 2019 Update)

Rename it to Backup Default. Restart Chrome.

My Lucky 123 “Virus” Removal (June 2019 Update)

Type Regedit in the windows search field and press Enter.

Inside, press CTRL and F together and type the threat’s Name. Right click and delete any entries you find with a similar name. If they don’t show up this way, go manually to these directories and delete/uninstall them:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

If the guide didn’t help you, download the anti-virus program we recommended or ask us in the comments for guidance!


About the author


Lidia Howler

Lidia is a web content creator with years of experience in the cyber-security sector. She helps readers with articles on malware removal and online security. Her strive for simplicity and well-researched information provides users with easy-to-follow It-related tips and step-by-step tutorials.


  • I’ve tried doing everything, but the mylucky123 page still loads up everytime I open one of the browsers installed on my computer.

  • # uncheckit_begin
    # These rules were added by the Uncheckitprogram in order to block advertising software modules # fix for traceroute and netstat display anomaly
    After local host the following are there,
    # uncheckit_end

    • Hi Ashwin, you have Uncheckit installed, which is blocking these domains from displaying adverts on your PC. That is a good thing.

  • # unchecky_begin
    # These rules were added by the Unchecky program in order to block advertising software modules # fix for traceroute and netstat display anomaly
    # unchecky_end

    • Hi there, you have unchecky installed, which blocks these sites from showing ads on your PC. That is a good thing. Are those all the entries in the hosts file?

  • Hi Dimas, try Searching for notepad first. Type notepad in the search bar, right click on it and select Run as Admin. Now open Notepad, click on File-> Open and manually navigate to the file. It’s in C://Windows/System32/drivers/etc/

  • Hi, when I try the “notepad%windir%/system32/Drivers/etc/hosts”, i get this underneath local hosts… is that ok?

    • Hello Raikuro, means you PC won’t be able to access the mcafee update site. This means that either a malware has blocked the program from updating or you are using a pirated copy of the program. Either way i recommend you delete the line.

  • Hi Jaap van den Berg,
    the IPs you are looking for are in the hosts.txt file. There you can easily remove these entries.

    • I have removed them from the file but the system does not allow me to save the file and overwrite it even though I am logged in as admin…
      Never mind. I changed the access permissions for this file and now it has been overwritten 🙂

  • i cant delete the ips because i dont have permission even though i am admin and have enabled permissions under security thislineskipsanyemptylines
    ok i sorted it out thanks

    • Hello, Brandon! Make sure to delete those IP’s because they are certainly coming from the unwanted program. Once you remove them, save the changes to the Hosts file. Note that you will need to have opened the file with Administrator priveleges.

  • I have Lucky 123 in my computer and yesterday a voice started speaking to me saying that I had to ring a number and that they would help me remove the virus. I switched the computer off.

    • You have done the right thing. Do not call that number since it is almost certainly a scam used to extract money from you. Try using our guide from down below and see if it helps you to manually deal with the virus and if you run into difficulty with any of the steps, be sure to contact us in the comments.

  • i deleted everything step by step and i hope that this time it wont reappear! by the way i had the virus called Lucky Starting which appeared in Google Chrome… i deleted everything but it reappeared.. maybe now it wont.. and everytime it reappeared there were 3 folders that were new in my C:/Program Files (x86)/… called amulesw WinSnare and i forgot the name of the 3…

Leave a Comment