PUP.Optional.MySearchDial.A still showing ?!

[larryme]

Hi, I am wondering if you guys can help me.  I recently purchased a Malwarebytes Pro and I love the product; however, I can not remove 

"PUP.Optional.MySearchDial.A"

I tried using adwcleaner and JRT tools but to no avail.  What do I need to do?  Malwarebytes keeps detecting it in IE and I try to quarantine or remove it using Malwarebytes but nothing works.

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• 
  

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

Kevin...

[larryme]

Addition.txtFRST.txt  Here are the files you requested.

[larryme]

Here is the output from Malwarebytes.

Text.txt

[kevinf80]

Make sure to run from account with Administrator status...

 

Next,

 

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Next,

 

Open Malwarebytes 2.0, run a Threat Scan

 

 

•  

   

• On the Dashboard, click the 'Update Now >>' link

   

   

• After the update completes, click the 'Scan Now >>' button.

   

   

• Or, on the Dashboard, click the Scan Now >> button.

   

   

• If an update is available, click the Update Now button.

   

   

• A Threat Scan will begin.

   

   

• When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

   

   

• In most cases, a restart will be required.

   

   

• Wait for the prompt to restart the computer to appear, then click on Yes.

   

   

 

 

Post log:

 

 

•  

   

• After the restart once you are back at your desktop, open MBAM once more.

   

   

• Click on the History tab > Application Logs.

   

   

• Double click on the scan log which shows the Date and time of the scan just performed.

   

   

• Click 'Copy to Clipboard'

   

   

• Paste the contents of the clipboard into your reply.

   

   

 

 

Let me see those logs in next reply...

 

Kevin

fixlist.txt

[larryme]

I can not "copy to clipboard" the Malwarebytes scan log but I attached the fixlog from FRST.

Fixlog.txt

[larryme]

Here is the clipboard results...I have to copy it to clipboard before the reboot because you can not (or I do not know how to ) access from the history tab.

clip.txt

[kevinf80]

I need to see the log from after the reboot to make sure found entry is removed...

 

• 
  

open MBAM once more.
Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click 'Export'.
Click 'Text file (*.txt)'
In the Save File dialog box which appears, click on Desktop.
In the File name: box type a name for your scan log.
A message box named 'File Saved' should appear stating "Your file has been successfully exported".
Click Ok
Attach that saved log to your next reply.

[larryme]

Here is the text file you requested.

Malwarebytes_log.txt

[kevinf80]

Again is the option to delete on reboot, do you do that to allow MB to remove the item?

 

Next,

 

Download Zoek.zip from here http://www.hijackthis.nl/smeenk/220813/zoek.zip and save the zip file to your Desktop.

Double click zip file and extract to your  Desktop:

 

 

 

 

you will now have 3 versions of the tool on the Desktop:

 

 

 

Before running Zoek make sure all Browsers are closed and Security is turned OFF. Check at the following link: http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/

 

Double click on each in turn until one version of Zoek will run (accept UAC) The following window will open:

 

 

 

 

Copy and paste the following script from the code box and paste into the field.

 

 

standardsearch;autoruns;autoclean;FFdefaults;CHRdefaults;emptyalltemp;installedprogs;

 

 

Select the "Run Script" tab. The following window will open:

 

 

 

 

 

 

Please be patient and do not use the PC when the scan is in progress.

 

When complete you maybe asked to re-boot your PC, if so please do

 

 

Post the produced log in your next reply…..

[larryme]

I completed the instructions above. I had an error message pop up while I ran the Zoek files.  The Zoek.exe was the last file to be executed. All Antivirus and AntiMalware were off.

 

The error message "An error has occured in the script on this page" line 68 - url c;\user..\local\temp\zoekrun.hta

zoek-results.log

[kevinf80]

Please download SystemLook from the following link below and save it to your Desktop. Use the correct version 32bit or 64bit.

 

http://jpshortstuff.247fixes.com/SystemLook_x64.exe      <<-   64 bit….

 

http://images.malwareremoval.com/jpshortstuff/SystemLook.exe  <<-  32 bit

 

• 
  

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
 

:regfindMysearchdial*Mysearchdial*

 
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

 

Let me see that log...

 

Download Security Check by screen317 from either of the following:

http://screen317.spywareinfoforum.org/SecurityCheck.exe or http://screen317.changelog.fr/SecurityCheck.exe

Save it to your Desktop. (If your security alerts either accept the alert, or turn the security off while Secuirity Check runs)

Double click SecurityCheck.exe (Vista or Windows 7/8 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

If Security Check will not run or you get an alert saying it is not supported, Re-boot your PC then try again...

 

Let me see that log...

 

Post both logs to your next reply,

 

Kevin

[larryme]

Here are the files you requested.  I am not sure why but when I save the SecurityCheck checkup.txt it does not show up in the folder.  I guess I need to adjust the Windows hidden files settings but let me know if there is something else I needed to do.  I basically cut and paste the results into a new file.

checkup3.txt

SystemLook.txt

[kevinf80]

Download OTM from either of the following links and save to your Desktop: (If your security alerts to OTM, either accept the alert or turn off security to allow OTM to run)

http://oldtimer.geekstogo.com/OTM.exe.
http://www.itxassociates.com/OT-Tools/OTM.com
http://www.itxassociates.com/OT-Tools/OTM.exe  

Double click OTM.exe to start the tool. Vista or Windows 7 users accepy UAC alert. Be aware all processes will be stopped during run, also Desktop will disappear, this will be put back on completion.... If your security alerts to OTM either, accept the alert or turn off security until OTM completes...

• Copy the text from the code box belowbelow to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy). Ensure to start with and include the colon before Reg :Reg
  
  

  :Reg[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0E337C23-C5A5-4F08-8C3D-FFF27AB815AE}][-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MySearchDial]:Filesipconfig /flushdns /cC:\Program Files (x86)\Mysearchdial:Commands[EmptyTemp]

• Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
• Click the red button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM
  

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

If the machine reboots, the Results log can be found here:

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss is the date of the tool run.

 

Post that log, also let me know if there are any remaining issues or concerns....

 

Kevin

[larryme]

Looks like Anti-Malware is still detecting it!  Here is the log from the last program. The program did reboot when it was running to remove files.

07102014_195107.log

[kevinf80]

run another threat scan with Malwarebytes, post the log. If "MysearchDial" shows in the log do the following...

 

Select > start > into the search box type regedit tap "enter" or select ok...

 

Regedit will open, navigate by expanding the following:

 

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy

 

Do not expand ElevationPolicy right click on that folder and select "Export" Save that file to your Desktop or Similar. Close out Regedit.

 

Go to the saved file, right click on the file, select > send to > compressed (zipped) folder. The zipped folder will save.

 

Attach the zip folder to next reply...

 

Kevin

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!