Safesearch infection

[ken545]

• Click the Chrome menu
  
  on the browser toolbar.
• Select Settings.
• Scroll down to Show advanced settings...
• Down on the bottom you will see an option for RESET BROWSER SETTINGS
• Click on it and it will set Chome back to defaults

 

[Et Cetera]

Okay, that seemed to do it. I restarted the computer and checked again, and Safesearch does not appear in either initial startup or New Tab. You've been a great help by the way. So the question now is do I avoid IE because Safesearch is still its startup page? Because we already restored IE's default settings as we just did to Chrome but Safesearch is still there.

 

[ken545]

Open IE and go to Tools > Internet Options and there you can change your homepage, you can type in a url like msn.com for instance or if your browser is open to a page you want to use just click on Use Current

 

[Et Cetera]

Same thing as before, Safesearch persists.

Here's what I just did: I opened IE to Internet Options > General > Tabs > When a tab is opened, open: > Your first home page (which is Bing)

So to recap:

Chrome seems totally fine.
IE initially opens with Safesearch. New Tab opens Bing, the homepage I manually set it to.

 

[ken545]

Lets clear all your history, this will remove cookies also so be sure to write down log on info for any sites you use that you need a user name and password because removing cookies will delete that info but when you log back in a new cookie will be set and thats fine, the reason for this is that you may still have some bad cookies from Safesearch

• Open Chrome
• Click the Chrome menu
  
  on the browser toolbar.
• Click on History
• Click on Clear Browsing History
• Check
  1. Browsing History
  2. Cookies and Site Plug Ins
  3. Cached Images and Files
• Then ok your way out and close Chrome

• Open Internet Explorer
• Go to Tools > Internet Options
• Browsing History
• Delete Temp Files / History / Cookies / Saved Passwords / Web Form Information
• Delete
• Close out Internet Explorer

 

[Et Cetera]

It had no effect, it's still in the condition described in my previous post.

 

[ken545]

Please download aswMBR to your desktop.

• Double click the aswMBR icon to run it.
• Click the Scan button to start scan.
• If you are asked to update the Avast Virus database please allow it to do so.
• When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

I just want to see the report....Please Do Not Fix Anything




=============================================




Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• when the window opens, click on Change Parameters
• under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
• click OK
• Press Start Scan
  • As we are only looking for a log of what is on the machine right now > choose to skip whatever is found
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)
    

 

[ken545]

Running those tools cant hurt, just making sure there is nothing else present

• Open Internet Explorer
• Go to Tools > Internet Options > Tabs
• When a new tab is open ...on the drop down list select a blank page
• OK your way out and close IE

 

[Et Cetera]

Ran aswMBR, file below.

Ran TDSSkiller, no threats found and it generated no log file.

aswMBR version 1.0.1.2041 Copyright(c) 2014 AVAST Software
Run date: 2014-09-11 11:19:41
-----------------------------
11:19:41.378 OS Version: Windows x64 6.2.9200
11:19:41.378 Number of processors: 8 586 0x3C03
11:19:41.378 ComputerName: ALLENTRANSIER UserName: Allen
11:19:42.174 Initialize success
11:19:42.174 VM: initialized successfully
11:19:42.189 VM: Intel CPU supported
11:19:47.098 VM: disk I/O iaStorA.sys
11:49:26.898 AVAST engine defs: 14091000
11:53:25.538 The log file has been saved successfully to "C:\Users\Allen\Desktop\aswMBR report.txt"

 

[ken545]

Good, follow the instructions to change your new tab to open to a blank page

 

[Et Cetera]

Okay, did it. New Tab in IE gives about:blank

 

[ken545]

Great, keep in mind that you're free of this infection and what you were seeing where just some websites you went in via Safesearch, looks like your good to go

Double click on AdwCleaner.exe to run the tool again.

• Click on the Uninstall button.
• Click Yes when asked are you sure you want to uninstall.
• Both AdwCleaner.exe, its folder and all logs will be removed.

==========================================================


Please download DelFix and save the file to your Desktop.

• Double-click DelFix.exe to run the program.
• Place a checkmark next to the following items:

*Activate UAC
*Remove disinfection tools
*Create registry backup
*Reset System Settings


Click the Run button

This will remove the specialised tools we used to clean your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually



==========================================================

• 
  How did I get infected in the first place ?
  Read these links and find out how to prevent getting infected again.
• Tutorial for System Restore <-- Do this first to prevent yourself from being reinfected.
• WhattheTech
• Grinler BleepingComputer
• GeeksTo Go
• Dslreports

Safe Surfn
Ken

 

[Et Cetera]

Thanks, Ken. I appreciate it.

 

[ken545]

Your very welcome

Ken