Jump to content

µTorrent Infected My Machine With "Spigot", "SearchSettings" & Yahoo Search


Recommended Posts

Dear Malwarebytes Community~

 

First, thanks so much for reading this post. I appreciate everyone here, and all the voluntary time that each and every one of you contribute to this forum.

 

I've ran into some issues with my browsers (Chrome 32.0.1700.76 m, IE 11, Firefox 26.0, Opera 12.16) on my Windows 8.1 Machine; they continuously are being redirected to "http://search.yahoo.com/?type=599486&fr=spigot-yhp-ch" upon start-up. As you can see, there is some information even within the URL that indicates who the culprit is (Spigot). That being said, I've done some research and concluded that in fact, this software is installed as bloatware through the newer version of µTorrent (uTorrent). I'm not sure it BitTorrent has the bloatware or not but both are owned by the same parent company, so I'm assuming that BitTorrent does also.

 

There is another Topic that covered this topic already located here: https://forums.malwarebytes.org/index.php?showtopic=131286. I was unable to amend any comments to the bottom, so I created this new topic instead. I followed all the suggestions in the other Topic and I've attached my log files from the suggested software scans using:

  • RogueKiller 64
  • AdwCleaner
  • Junkware Removal Tool

Would someone be willing to take a look at the attached files and point me in the right direction for removal of this annoying software? Thanks so much in advance everyone.

 

Warmly,

Zacchaeus

 

 

 

RKreport0_S_01232014_081003.txt

JRT.txt

AdwCleanerR0.txt

Link to post
Share on other sites

Welcome to the forum, we need to see the logs from FRST also:

Please download Farbar Recovery Scan Tool and save it to a folder. (use correct version for your system.....Which system am I using?)

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

bleep-crop.jpg

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

reply1.jpg

New window that comes up.

replyer1.jpg

MrC

Link to post
Share on other sites

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

 

[RUN][sUSP PATH] HKCU\[...]\Run : Pokki (C:\WINDOWS\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform [-][7][x]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-3897320492-4017189252-1221310888-1001\[...]\Run : Pokki (C:\WINDOWS\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform [-][7][x]) -> FOUND

[RUN][sUSP PATH] HKCU\[...]\RunOnce : Application Restart #2 (C:\Users\Zacchaeus\AppData\Local\Pokki\Engine\pokki.exe --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side-phishing-detection --enable-file-cookies --disable-sync --disable-breakpad --disable-bundled-ppapi-flash --disable-sync-tabs --disable-speech-input --disable-custom-jumplist --process-per-tab --debug-devtools-frontend="C:\Users\Zacchaeus\AppData\Local\Pokki\Engine\inspector" --no-first-run --lang=en-US --disable-component-update --disable-prompt-on-repost --no-startup-window --disable-translate --disable-logging --disable-desktop-notifications --disable-gpu-process-prelaunch --flag-switches-begin --flag-switches-end --restore-last-session [7][-]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-3897320492-4017189252-1221310888-1001\[...]\RunOnce : Application Restart #2 (C:\Users\Zacchaeus\AppData\Local\Pokki\Engine\pokki.exe --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side-phishing-detection --enable-file-cookies --disable-sync --disable-breakpad --disable-bundled-ppapi-flash --disable-sync-tabs --disable-speech-input --disable-custom-jumplist --process-per-tab --debug-devtools-frontend="C:\Users\Zacchaeus\AppData\Local\Pokki\Engine\inspector" --no-first-run --lang=en-US --disable-component-update --disable-prompt-on-repost --no-startup-window --disable-translate --disable-logging --disable-desktop-notifications --disable-gpu-process-prelaunch --flag-switches-begin --flag-switches-end --restore-last-session [7][-]) -> FOUND

Now click Delete on the right hand column under Options

-------------

Next:

Download the attached fixlist.txt to the same folder as FRST.

Run FRST.exe and click Fix only once and wait

The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

Last......

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a FULL Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

Link to post
Share on other sites

Dear @MrCharlie~

 

Thank you so much for helping out. I've attached both reports; the fixlog.txt and the Malwarebytes log file as well. Everything looks good on my PC now. Thank you again, so very much. I do have a couple of additional questions if you don't mind.

  • Did you see anything on my other log files that looked that I was hacked, spied upon, etc.?
  • Why did you have me uninstall (essentially) Pokki? Pokki is a great menu alternative especially for Windows 8 and 8.1. I would like to know your thoughts on that if you don't mind.

Looking forward to wrapping this up.

 

Warmly,

Zacchaeus

mbam-log-2014-01-23 (13-50-53).txt

Fixlog.txt

Link to post
Share on other sites

It's considered a PUP:

http://searchsecurity.techtarget.com/definition/PUP

You can re-install it.

----------------------------------

If there's no other problems.........

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • If you get Unsupported operating system. Aborting now, just reboot and try again.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!
MrC
Link to post
Share on other sites

Dear @MrCharlie~

 

Thanks so much. Below is my log file:

 

 Results of screen317's Security Check version 0.99.79  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Firewall Enabled!  
Kaspersky PURE 3.0   
Windows Defender     
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 SEO SpyGlass    
 Malwarebytes Anti-Malware version 1.75.0.1300  
 Java 7 Update 51  
 Adobe Flash Player 12.0.0.43  
 Adobe Reader XI  
 Mozilla Firefox (26.0) 
 Google Chrome 32.0.1700.72  
 Google Chrome 32.0.1700.76  
````````Process Check: objlist.exe by Laurent````````  
 Kaspersky Lab Kaspersky PURE 3.0 avp.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log`````````````````````` 
Link to post
Share on other sites

That looks good.

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Please download OTC to your desktop. (This will clean up most of the tools and logs)

http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")

Click on the CleanUp! button and follow the prompts.

(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)

You will be asked to reboot the machine to finish the Cleanup process, choose Yes.

After the reboot all the tools we used should be gone.

Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete. (right click.....Delete)

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:

If you used FRST and can't delete the quarantine folder:

Download the fixlist.txt to the same folder as FRST.exe.

Run FRST.exe and click Fix only once and wait

That will delete the quarantine folder created by FRST.

The rest you can manually delete.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.