Removing Babylon Toolbar

[Spartex]

Hello All,

Since a short time I'm dealing with a very annoying type of spyware/malware called Babylon.

After trying to delete in manually with the configuration windows of software and deleting it from the browers options itself - it's still there.

Altho I'm not having to many problems with it (At least it seems), I still don't trust the toolbar and starting page fully.

Including with this post is the ComboFix Log I did in the first place - with the directions that was given in a previous post on this forum with a member that was infected with babylon.

I hope somebody can see into this problem, Thanks in Advance.

Mike

Log.txt

[Spartex]

Seems I forgot the DDS logs to - so second post with the proper DDS logs included.

DDS.txt

Attach.txt

[MrCharlie]

Welcome to the forum.

Please download AdwCleaner from here and save it on your Desktop.

1. Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
   
2. Now click on the Search tab.
   
3. Please post the contents of the log-file created in your next post.
   

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

MrC

[Spartex]

The Logs of AdwCleaner are attached - Is it right a window pops that says nothing has been deleted yet?

And thanks for looking into my problem and welcoming me on the forum MrC.

Mike

AdwCleanerR1.txt

[MrCharlie]

1. Please re-run AdwCleaner
   
2. Click on Delete button.
   
3. Confirm each time with OK.
   
4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
   

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

MrC

[Spartex]

I did a re-run of AdwCleaner and tried to delete the infected files with the Delete button.

However there is an error occuring, didn't get any log files cause of it and computer didn't get rebooted. See print screen attachment to see what error I'm speaking of.

Mike

[MrCharlie]

Try it in safe mode, MrC

[Spartex]

Just booted in safe mode, tried to run it with the same error occuring and still no log results.

When I booted Firefox it said something about that it wasn't my default brower and if I wanted to set it as default brower again. (Normally doesn't give this message when booting Firefox)

[MrCharlie]

Run AdwCleaner again and hit the uninstall button.

Download a fresh copy and run it:

Please download AdwCleaner from here and save it on your Desktop.

1. Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
   
2. Now click on the Search tab.
   
3. Please post the contents of the log-file created in your next post.
   

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

You don't have to the log just continue and click the "Delete" button.

Let me know, MrC

[Spartex]

In first instance it didn't work and I got the same error again, In second instance it did.

Here are the logs that appeared on my Desktop,

Mike

AdwCleanerS2.txt

[MrCharlie]

I can't read that, can I assume that all were deleted? MrC

[Spartex]

It seems like it's gone now from my browser

Are you enable to open the file?

In case it doens't open I'll post in this post.

Hope it's gone and i'm clear again

Thanks in Advance!

---------------------------------------------------------------------------------------

# AdwCleaner v2.002 - Verslag gemaakt op 09/19/2012 om 17:52:42

# Geactualiseerd op 16/09/2012 door Xplode

# Besturingssysteem : Windows 7 Ultimate Service Pack 1 (64 bits)

# Gebruiker : Mike - PC-MIKE

# Opstarten Modus : Normale modus

# Gelanceerd vanaf : C:\Users\Mike\Desktop\adwcleaner.exe

# Optie [Verwijderen]

***** [Diensten] *****

***** [Files / Mappen] *****

***** [Register] *****

***** [browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Vervangen : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=HP_ss&mntrId=9653f2390000000000008c89a57e160a --> hxxp://www.google.com

Vervangen : [HKCU\Software\Microsoft\Internet Explorer\Main - BrowserMngr Start Page] = hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=HP_ss&mntrId=9653f2390000000000008c89a57e160a --> hxxp://www.google.com

Vervangen : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=NT_ss&mntrId=9653f2390000000000008c89a57e160a --> hxxp://www.google.com

-\\ Mozilla Firefox v15.0.1 (nl)

Profielnaam : default

File : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\ksh7ya9l.default\prefs.js

C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\ksh7ya9l.default\user.js ... Verwijdert !

Verwijdert : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=NT_ss&mntr[...]

Verwijdert : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");

Verwijdert : user_pref("browser.search.order.1", "Search the web (Babylon)");

Verwijdert : user_pref("browser.search.selectedEngine", "Search the web (Babylon)");

Verwijdert : user_pref("browser.startup.homepage", "hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=HP_s[...]

Verwijdert : user_pref("extensions.BabylonToolbar.admin", false);

Verwijdert : user_pref("extensions.BabylonToolbar.aflt", "babsst");

Verwijdert : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");

Verwijdert : user_pref("extensions.BabylonToolbar.autoRvrt", "false");

Verwijdert : user_pref("extensions.BabylonToolbar.babExt", "");

Verwijdert : user_pref("extensions.BabylonToolbar.babTrack", "affID=110823&tt=3612_6");

Verwijdert : user_pref("extensions.BabylonToolbar.babext", "babExt");

Verwijdert : user_pref("extensions.BabylonToolbar.babtrack", "babTrack");

Verwijdert : user_pref("extensions.BabylonToolbar.bbDpng", "19");

Verwijdert : user_pref("extensions.BabylonToolbar.bbdpng", 6);

Verwijdert : user_pref("extensions.BabylonToolbar.cntry", "NL");

Verwijdert : user_pref("extensions.BabylonToolbar.dfltLng", "en");

Verwijdert : user_pref("extensions.BabylonToolbar.dfltlng", "en");

Verwijdert : user_pref("extensions.BabylonToolbar.dfltsrch", "false");

Verwijdert : user_pref("extensions.BabylonToolbar.dp_alert", "0");

Verwijdert : user_pref("extensions.BabylonToolbar.dpk", "a239ee63432785bc9c5f6d9c56596c52");

Verwijdert : user_pref("extensions.BabylonToolbar.envrmnt", "production");

Verwijdert : user_pref("extensions.BabylonToolbar.excTlbr", false);

Verwijdert : user_pref("extensions.BabylonToolbar.firstrun", false);

Verwijdert : user_pref("extensions.BabylonToolbar.hdrMd5", "6E8EB69C1C5DDD93FA8DFE259713D2F4");

Verwijdert : user_pref("extensions.BabylonToolbar.hmpg", false);

Verwijdert : user_pref("extensions.BabylonToolbar.hrdid", "9653f2390000000000008c89a57e160a");

Verwijdert : user_pref("extensions.BabylonToolbar.id", "9653f2390000000000008c89a57e160a");

Verwijdert : user_pref("extensions.BabylonToolbar.instlDay", "15588");

Verwijdert : user_pref("extensions.BabylonToolbar.instlRef", "sst");

Verwijdert : user_pref("extensions.BabylonToolbar.instlday", "15588");

Verwijdert : user_pref("extensions.BabylonToolbar.instlref", "sst");

Verwijdert : user_pref("extensions.BabylonToolbar.isdcmntcmplt", "false");

Verwijdert : user_pref("extensions.BabylonToolbar.keywordurl", "");

Verwijdert : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.6.9.1218:30:26");

Verwijdert : user_pref("extensions.BabylonToolbar.lastdp", 6);

Verwijdert : user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.1");

Verwijdert : user_pref("extensions.BabylonToolbar.newTab", false);

Verwijdert : user_pref("extensions.BabylonToolbar.newtab", "false");

Verwijdert : user_pref("extensions.BabylonToolbar.newtaburl", "");

Verwijdert : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");

Verwijdert : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");

Verwijdert : user_pref("extensions.BabylonToolbar.prtnrid", "babylon");

Verwijdert : user_pref("extensions.BabylonToolbar.savedVrsnTs", "1");

Verwijdert : user_pref("extensions.BabylonToolbar.sg", "tzb");

Verwijdert : user_pref("extensions.BabylonToolbar.smplGrp", "tzb");

Verwijdert : user_pref("extensions.BabylonToolbar.smplgrp", "none");

Verwijdert : user_pref("extensions.BabylonToolbar.srcExt", "ss");

Verwijdert : user_pref("extensions.BabylonToolbar.srcext", "ss");

Verwijdert : user_pref("extensions.BabylonToolbar.srch", "");

Verwijdert : user_pref("extensions.BabylonToolbar.srchprvdr", "");

Verwijdert : user_pref("extensions.BabylonToolbar.tlbrId", "tb9");

Verwijdert : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[...]

Verwijdert : user_pref("extensions.BabylonToolbar.tlbrid", "tb9");

Verwijdert : user_pref("extensions.BabylonToolbar.tlbrsrchurl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[...]

Verwijdert : user_pref("extensions.BabylonToolbar.vrsn", "1.6.9.12");

Verwijdert : user_pref("extensions.BabylonToolbar.vrsnTs", "1.6.9.1218:30:26");

Verwijdert : user_pref("extensions.BabylonToolbar.vrsni", "1.6.9.12");

Verwijdert : user_pref("extensions.BabylonToolbar.vrsnts", "1.6.9.1218:30:26");

Verwijdert : user_pref("extensions.BabylonToolbar_i.babExt", "");

Verwijdert : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=110823&tt=3612_6");

Verwijdert : user_pref("extensions.BabylonToolbar_i.newTab", false);

Verwijdert : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

Verwijdert : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

Verwijdert : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.6.9.1218:30:26");

-\\ Google Chrome v21.0.1180.89

File : C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Preferences

Verwijdert [l.580] : homepage = "hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=HP_ss&mntrId=9653f2390000000000008c89a57e160a",

Verwijdert [l.739] : urls_to_restore_on_startup ="session": {"restore_on_startup": 4, [ "hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=HP_ss&mntrId=9653f2390000000000008c89a57e160a" ]},

*************************

AdwCleaner[s1].txt - [484 octets] - [19/09/2012 17:52:27]

AdwCleaner[s2].txt - [6903 octets] - [19/09/2012 17:52:42]

########## EOF - C:\AdwCleaner[s2].txt - [6963 octets] ##########

[MrCharlie]

Looks Good.

So it's OK now?? MrC

[Spartex]

Ah now I see, it's a different language from english.

Basicly there are 2 words that are different.

Vervangen = Replace

Verwijdert = Removed

I think the rest should be the same as it should be in English.

Mike

[MrCharlie]

OK >>>>> so everything is OK now.....right?? MrC

[Spartex]

Yes it seems like it's fully gone - the starting pages as well as the toolbar & Search Function!

Hope it stays this way.

Thanks a lot MrC!

[MrCharlie]

Great

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassoci...T-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[Spartex]

Done the clean up steps,

Thanks for everything!

Profile Feedback on the way & Marked the webpage as favorite in case problems may pop up in the future (which I don't hope on).

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!