Http://search.yahoo.com/?type=714647&fr=spigot-yhp-ch

[Geo791]

Hello...PLEASE HELP!

I have been working to remedy this issue of Yahoo hijackng the homepage and the search engine on this laptop for hours with no resolve. I am retired, and working on computers is my hobby. I help several friends with their computer problems. I have exhausted every attemp at fixing this and it just keeps coming back. This nasty thing has infected my friends laptop, as well as his desktop. This will be a learning experience for me and I will gladly compensate whomever chooses to accept the challenge of helping me rid these systems of this malware.

 

dds.txt

 

attach.txt

[MrCharlie]

Welcome to the forum.

Please run a Quick Scan with Malwarebytes like this and post the log:

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

---------------------

Then........

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

General Forum P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running, please create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

[Geo791]

Hello MrCharlie, thanks for helping me resolve this. It is really bugging my that I am not able to rid this.

I just ran Malwarebytes yesterday and it found 21 PUPs and removed them. That is why it did not find

any today.

 

mbam-log-2014-02-28 (18-56-57).txt

 

RKreport0_S_02282014_193017.txt

 

[MrCharlie]

Please start with this:

Lets clean out any adware/spyware now: (this will require a reboot so save all your work)

Please download AdwCleaner from HERE or HERE to your desktop.

• Double click on AdwCleaner.exe to run the tool.

  Vista/Windows 7/8 users right-click and select Run As Administrator

• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• When it's done you'll see: Pending: Please uncheck elements you don't want removed.
• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• Look over the log especially under Files/Folders for any program you want to save.
• If there's a program you may want to save, just uncheck it from AdwCleaner.
• If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
• If you're ready to clean it all up.....click the Clean button.
• After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.
• Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
• To restore an item that has been deleted:
• Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

Last.......

Please download Farbar Recovery Scan Tool (FRST) and save it to a folder.

(use correct version for your system.....Which system am I using?)

FRST <----for 32 bit systems

FRST64 <----for 64 bit systems

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

New window that comes up.

MrC

[Geo791]

The quest goes on...

 

AdwCleanerS3.txt

 

JRT.txt

 

FRST.txt

 

Addition.txt

[MrCharlie]

You most likely got this infection from this program:
(IObit) C:\Program Files\IObit\Advanced SystemCare 7

-------------------

Download the attached fixlist.txt to the same folder as FRST.
Run FRST.exe and click Fix only once and wait
The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

Then......reboot and let me know how it is, MrC

[Geo791]

Well...sorry to say, but that nasty hikacker is still hijacking both IE8 and FF

I did run the "fixlist.txt" and it completed okay.

 

Fixlog.txt

 

[MrCharlie]

The link below explains how to rest your browsers, reset IE and FF:

http://www.howtogeek.com/171924/how-to-reset-your-web-browser-to-its-default-settings/

Let me know.....MrC

[Geo791]

Sorry MrCharlie...no cigar. This thing just won't go away. Both IE8 and FF are being hijacted. I reset both FF and IE8 but when I reopened them...there it was again :'(

[MrCharlie]

OK, this happened after you installed....
C:\Program Files\IObit\Advanced SystemCare 7

correct??

--------------------------

Please run another scan with FRST and make sure the addition box is checked.

MrC

[Geo791]

Good afternoon MrC. Thank you for your continued support. I do appreciate your time and effort.

 

To reiterate, this is a close friend's laptop which I maintain for him as well as his desktop.

Actually, this hijacker did not began with the install of IObit ASC. I have used ASC to tune up

the computers I have worked on for over a year. This laptop has had it installed and been in use

for probably close to a year also. I use ASC on my own machines too. I am beginning to think maybe

ASC is not the utillity I shoud be using for this purpose. I did some research and found too that using

any of the registry cleaners, which would include ASC', is not a good thing to be doing....ouch.

 

This laptop, and also his desktop, became infected with this hijacker about 1-2 weeks ago. I did not

realize he actually had malware doing this. I thought that he was just able to set his homepage

correctly in IE and FF. I went to his house this week to do some tuning for him and that's when I

discovered that they both were infected.

 

Because IObit shovels freeware to it's customers, I think the infection may have come from an

install of IObit Malware Fighter, or Driver Booster, both of which were on his computers. I did not

install them so I am assuming he must have clicked on a button he should not have, and here

we are....

 

I ran the FRST.exe program again. Here are the log files:

 

FRST.txt

 

Addition.txt

[MrCharlie]

When you install ASC you get a bunch of other crap installed weather you want it or not and also it hijacks with spigot.
It's not a recommended program to have on the system, I would never ask you to install anything from IObit.

ASC has a Browser Protection feature under Tools somewhere that prevents you from changing any search or home pages.
If we don't disable that you won't be able to reset them.

So try to find and disable that or completely uninstall IObit and all the crap it comes with:
 

Advanced SystemCare 7 (HKLM\...\Advanced SystemCare 7_is1) (Version: 7.1.0 - IObit)
Driver Booster (HKLM\...\Driver Booster_is1) (Version: 1.2 - IObit)
IObit Uninstaller (HKLM\...\IObitUninstall) (Version: 3.1.7.2405 - IObit)
Smart Defrag 3 (HKLM\...\Smart Defrag 3_is1) (Version: 3.0 - IObit)

 

Let me know what you would like to do, MrC

[Geo791]

Okay MrC. I have uninstalled ALL of the IObit software completely.

Where do we go from here?

[Geo791]

BTW... nice family. Looks like a yellow laby and golden.

 

Here are some new FRST files following the IObit software uninstall.

 

FRST.txt

 

Addition.txt

[MrCharlie]

I think I got it all in the attached fixlist.txt, I notice this VIPRE Search Guard Toolbar, please disable it so it doesn't interfere with the fix:

 

Toolbar: HKLM - VIPRE Search Guard Toolbar - {A924C17A-5E94-4E02-BED5-49720BA6F7FA} - C:\Program Files\VIPRE\VSGN.dll ()
Toolbar: HKCU - VIPRE Search Guard Toolbar - {A924C17A-5E94-4E02-BED5-49720BA6F7FA} - C:\Program Files\VIPRE\VSGN.dll ()

 

Download the attached fixlist.txt to the same folder as FRST.
Run FRST.exe and click Fix only once and wait
The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

Then......reboot if necessary and you should be able to set home and search pages now.
You can also just reset the browsers as before.

Let me know.....MrC

[Geo791]

Hurray!!! MrC yor ARE the man! FF and IE8 are both working perfectly now.

 

Because I am very much interested in how this was accomplished, I would like to know how you use the log files from these programs to create the "fixlist.txt" file used to remedy the problem. Remember, I work on these beasts too? I still have the desktop with the very same hijacking issue to repair yet. Could I possibly repair the desktop myself, or would I need to get back to you for help doing it?

 

I have no clue how much time was involved for you to help me solve this problem on the laptop. I definately want to make a donation to you

 

I know there will be some cleanup left to do on this so I will await your reply.

[Geo791]

Oops...forgot to post the fixlog.txt file for you.

 

Fixlog.txt

 

 

[MrCharlie]

Good......

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• If you get Unsupported operating system. Aborting now, just reboot and try again.
• A Notepad document should open automatically called checkup.txt.
• Please Post the contents of that document.
• Do Not Attach It!!!

MrC

[Geo791]

The securiy program ran but an error appeared so I tired to reboot and run it a second time...same little error box came up

but then the program continued. Here is the text file:

 

 Results of screen317's Security Check version 0.99.79 
 Windows XP Service Pack 3 x86  
 Internet Explorer 8 
``````````````Antivirus/Firewall Check:``````````````
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware version 1.75.0.1300 
 CCleaner    
 Java 6 Update 45 
 Java 7 Update 51 
 Java 6 Update 2 
 Java 6 Update 7 
 Adobe Flash Player  12.0.0.70 
 Adobe Reader XI 
 Mozilla Firefox (27.0.1)
````````Process Check: objlist.exe by Laurent```````` 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:: 3%
````````````````````End of Log``````````````````````
 

[MrCharlie]

Out dated programs on the system are vulnerable to malware.
Please update or uninstall them:

--------------------------------------

Java 7 Update 51 <---this is OK

Uninstall all of these from your add/remove programs:
Java™ 6 Update 2
Java™ 6 Update 7
Java™ 6 Update 45

-----------------------------------

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /



Then hit enter. (it may look like CF is re-installing but it's not)
This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Please download OTC to your desktop. (This will clean up most of the tools and logs)
http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")
Click on the CleanUp! button and follow the prompts.
(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)
You will be asked to reboot the machine to finish the Cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:
If you used FRST and can't delete the quarantine folder:
Download the fixlist.txt to the same folder as FRST.exe.
Run FRST.exe and click Fix only once and wait
That will delete the quarantine folder created by FRST.
The rest you can manually delete.

-------------------------------

Any questions...please post back.
If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again. (PM also found HERE)

Good Luck and Thanks for using the forum, MrC

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!