Instashare has got me!

[TheJDawg]

It's in both Google and IE. Don't think I have Firefox that I know of.

I used a program Revo Uninstaller to remove Insta Share (which may have exacerbated the problem) and normal windows uninstaller wouldn't work.

[ken545]

• Open Internet Explorer
• Click on Tools up on the top right
• Click on Manage Add Ons from the dropdown list
• In this window you can manage the Internet Explorer add-ons
• Click on Search Providers
• Click on the option Toolbars and Extensions on left side of the window.
• Then click on the malicious items te remove Instashare
• Make Google you default
• Close IE and then open it again and see if Instashare is gone

If this dont work then lets set IE back to default

• Open IE
• Go to Tools> Internet Options > Advanced Tab
• Reset Internet Explorer Setting
• Reset
• This will take a few seconds
• Close IE and then reopen it and see if it helped

• Open Chrome
• Click the Chrome menu on the browser toolbar.
• Click on Settings
• Then Manage Search Engines
• Highlite Instashare and select Delete

• Click the Chrome menu on the browser toolbar.
• Click on Settings
• Open a specific page or set of pages.
• Set Pages
• Remove Instashare if present
• You can copy and paste the url from a page you like or if you have that page open select use current
• OK your way out and close chome.
• Reopen Chrome and make sure your start page is the one you want

• Click the Chrome menu on the browser toolbar.
• Select Settings.
• Scroll down to Show advanced settings...
• Locate the Privacy Section, select Content Settings
• In the pop up window scoll to Plug-Ins, select Disable individual plug-ins...
• Locate the following plug-ins and set them to Disable:Instashare
• Exit Chrome settings menu.

• Open Chrome
• Click the Chrome menu on the browser toolbar.
• Click on History
• Click on Clear Browsing History
• Check
  1. Browsing History
  2. Cookies and Site Plug Ins
  3. Cached Images and Files
• Then ok your way out and close Chrome

If no luck then lets set Chome back to factory defaults

• Click the Chrome menu on the browser toolbar.
• Select Settings.
• Scroll down to Show advanced settings...
• Down on the bottom you will see an option for RESET BROWSER SETTINGS
• Click on it and it will set Chome back to defaults

[TheJDawg]

Unfortunately non of that worked. Didn't find Insta Share in any of the areas specified either.

[ken545]

Open up FRST and paste this into the search box

Insta Share

Then click on Search Files

Post the log please

[TheJDawg]

Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by Jonesboy at 2014-09-17 11:12:24
Running from C:\Users\Jonesboy\Desktop
Boot Mode: Normal

================== Search Files: "Insta Share" =============

====== End Of Search ======

[TheJDawg]

An auto Malwarbytes Log after an auto scan. Still infected though.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 17/09/2014
Scan Time: 11:51:00 AM
Logfile: Malwarbytes 17092014.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.09.16.09
Rootkit Database: v2014.09.15.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Jonesboy

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 360307
Time Elapsed: 10 min, 17 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 1
PUP.Optional.WebSteroids.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}, , [9ebb618dc1bae6502113523957abf709],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 2
PUP.Optional.Superfish.A, C:\Users\Jonesboy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, , [9ebb65893f3cdf57d89bee2e6f9443bd],
PUP.Optional.Superfish.A, C:\Users\Jonesboy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, , [88d121cda0db66d0274c74a8d033b947],

Physical Sectors: 0
(No malicious items detected)


(end)

[ken545]

Lets try this

Download Avast-browser-cleanup to your desktop

• There is nothing to install, just right click on it and Run As Adminstrator
• When its finished scanning it will list Browser Add ONs
• If if finds Insta Share or any other bogus toolbars
• Just high light them and select REMOVE
• Close out the program
• Reboot your system and test your browsers

[TheJDawg]

Nope. Didn't find INsta share or anything.

[ken545]

This is what I think, Instashare is gone, you might just be seeing leftover pages

When you open IE, besides your homepage do other pages load ?

Open IE and go to tools > internet options and on the general tab make sure just your homepage is listed, anything else you can just remove

[TheJDawg]

There were no other homepages listed.
No other pages load initially but I use Google.com as the homepage.
If I go to say a newspaper page then a new tab will pop up asking me to take part in a survey.
Google Chrome seems more infected than IE as it has ads all through the web page.
But both get the extra tab popping up asking me to undertake a survey.