Jump to content

Need help removing searchnet.blinkxcore.com


Recommended Posts

  • Replies 59
  • Created
  • Last Reply

Top Posters In This Topic

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll be working with you.
 
     
    
Before we start please read and note the following:

  • Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
  • Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
  • Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
  • Do not paste the logs in your posts, attachments make my work easier. There is a Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
  • Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
  • Note that we may live in totally different time zones, what may cause some delays between answers.
  • Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

:excl: I can't foresee everything, so if anything unexpected happens, please stop and inform me!
:excl: There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  warning.gif Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 
 
 

51a612a8b27e2-Zoek.png Scan with ZOEK
 
Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on 51a612a8b27e2-Zoek.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:
    createsrpoint;autoclean;chrdefaults;ffdefaults;emptyalltemp;ipconfig /flushdns;b
  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)
  • Post its content into your next reply.
Link to post
Share on other sites

Thank you!  Here is the zoek results:

 

Zoek.exe v5.0.0.0 Updated 14-September-2014
Tool run by Sally on Fri 09/19/2014 at 13:13:13.82.
Microsoft Windows 7 Home Premium  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Sally\Desktop\zoek.exe [scan all users] [script inserted] 
 
==== System Restore Info ======================
 
9/19/2014 1:13:47 PM Zoek.exe System Restore Point Created Succesfully.
 
==== Deleting CLSID Registry Keys ======================
 
 
==== Deleting CLSID Registry Values ======================
 
 
==== Deleting Services ======================
 
 
==== FireFox Fix ======================
 
Deleted from C:\Users\Sally\AppData\Roaming\Mozilla\Firefox\Profiles\7gxs4fdd.default\prefs.js:
 
Added to C:\Users\Sally\AppData\Roaming\Mozilla\Firefox\Profiles\7gxs4fdd.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);
 
Deleted from C:\Users\Sally\AppData\Roaming\Thunderbird\Profiles\er2x5i2n.default\prefs.js:
 
Added to C:\Users\Sally\AppData\Roaming\Thunderbird\Profiles\er2x5i2n.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);
 
==== Batch Command(s) Run By Tool======================
 
 
==== Deleting Files \ Folders ======================
 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons deleted
C:\Users\Sally\Downloads\CouponPrinter(1).exe deleted
C:\Users\Sally\Downloads\CouponPrinter.exe deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
"C:\PROGRA~2\Coupons\CouponPrinterService.exe" deleted
"C:\PROGRA~2\Coupons\CouponPrinterService.exe" deleted
"C:\PROGRA~2\The Weather Channel\Desktop Weather\Microsoft.Threading.Tasks.dll" deleted
"C:\PROGRA~2\The Weather Channel\Desktop Weather\System.Threading.Tasks.dll" deleted
"C:\PROGRA~2\The Weather Channel\Desktop Weather\TWC.Win7.exe" deleted
"C:\PROGRA~2\The Weather Channel\Desktop Weather\TWC.Win7.Models.dll" deleted
"C:\PROGRA~2\The Weather Channel\Desktop Weather\TWC.Win7.Services.dll" deleted
"C:\PROGRA~2\The Weather Channel\Desktop Weather\TWC.Win7.UI.dll" deleted
"C:\PROGRA~2\The Weather Channel\Desktop Weather\Themes\Weather\PartlyCloudyNight.jpg" not deleted
"C:\PROGRA~2\Coupons" not deleted
"C:\PROGRA~2\Coupons" not deleted
"C:\PROGRA~2\The Weather Channel" not deleted
"C:\PROGRA~2\The Weather Channel\Desktop Weather" not deleted
"C:\PROGRA~2\The Weather Channel\Desktop Weather\Themes" not deleted
"C:\PROGRA~2\The Weather Channel\Desktop Weather\Themes\Weather" not deleted
 
==== Firefox Extensions ======================
 
AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
==== Firefox Plugins ======================
 
Profilepath: C:\Users\Sally\AppData\Roaming\Mozilla\Firefox\Profiles\7gxs4fdd.default
DFC9460CC37E5C414DC4680B10C19E7A - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll - Shockwave Flash
 
 
==== Chromium Look ======================
 
Google Voice Search Hotword (Beta) - Sally\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn
Cute Kitten 2 - Sally\AppData\Local\Google\Chrome\User Data\Default\Extensions\knhilgggnegappnkfbeaeeiioopeamlc
 
==== Set IE to Default ======================
 
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU
 
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
 
==== All HKCU SearchScopes ======================
 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google  Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
 
==== Reset Google Chrome ======================
 
C:\Users\Sally\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Sally\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
 
==== Empty IE Cache ======================
 
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Sally\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0JT73K will be deleted at reboot
C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5H2YLZHI will be deleted at reboot
C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D8BC3WO will be deleted at reboot
C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EFEVZVEO will be deleted at reboot
C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PX949SK7 will be deleted at reboot
C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WPF56B6.tmp will be deleted at reboot
 
==== Empty FireFox Cache ======================
 
No FireFox Cache found
 
==== Empty Chrome Cache ======================
 
C:\Users\Sally\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
 
==== Empty All Flash Cache ======================
 
Flash Cache is not empty, a reboot is needed
 
==== Empty All Java Cache ======================
 
Java Cache cleared successfully
 
==== C:\zoek_backup content ======================
 
C:\zoek_backup (files=45 folders=11 8491198 bytes)
 
==== Empty Temp Folders ======================
 
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Sally\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot
 
==== After Reboot ======================
 
==== Empty Temp Folders ======================
 
C:\Windows\Temp successfully emptied
C:\Users\Sally\AppData\Local\Temp successfully emptied
 
==== Empty Recycle Bin ======================
 
C:\$RECYCLE.BIN successfully emptied
 
==== Deleting Files / Folders ======================
 
"C:\PROGRA~2\The Weather Channel\Desktop Weather\Themes\Weather\PartlyCloudyNight.jpg"  not found
"C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WPF56B6.tmp" not found
"C:\PROGRA~2\Coupons"  not found
"C:\PROGRA~2\Coupons"  not found
"C:\PROGRA~2\The Weather Channel"  not found
"C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0JT73K" not found
"C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5H2YLZHI" not found
"C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9D8BC3WO" not found
"C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EFEVZVEO" not found
"C:\Users\Sally\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PX949SK7" not found
"C:\Users\Sally\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\KDW8JU4T\cdn.140fire.com"  not found
 
==== EOF on Fri 09/19/2014 at 13:31:16.43 ======================
Link to post
Share on other sites

Glad I could help. We will delete all used tools and I'll give you some tips to harden your security and learn how to protect yourself :)
 
 

Recommended reading:

 
 
icon_exclaim.gifMUST READ - security tips:

icon_exclaim.gifMUST READ - general maintenance:

The Importance of Software Updating:

 

 
In order to stay protected it is very important that you regularly update all of your software. Cybercriminals depend on the apathy of users around software updates to keep their malicious endeavor running.
 
Operating systems, such as Windows, and applications, such as Adobe Reader or JAVA, are used by tens of millions of computers and devices around the world, making them a huge target for cybercriminals. Downloading updates and installing them can sometimes be tedious, but the advantages you get from the updates are certainly worth it.

Recommended additional software:

 
 
icon_arrow.gifTFC - to clean unneeded temporary files.
icon_arrow.gifMalwarebytes' Anti-Malware - to scan your system from time to time in search for malware.
icon_arrow.gifMalwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.
icon_arrow.gifMcShield - to prevent infections spread by removable media.
icon_arrow.gifCryptoPrevent - to secure yourself from very severe CryptoLocker infection.
icon_arrow.gifUnchecky - to prevent from installing additional foistware, implemented in legitimate installations.
icon_arrow.gifFiheHippo.com Update Checker - to keep your programs up-to-date.
icon_arrow.gifAdblock - to surf the web without annoying ads! 
 
 

Post-cleanup procedures:

 

 
Download DelFix by Xplode and save it to your desktop.

  • Run the tool by right click on the 51a5ce45263de-delfix.png icon and Run as administrator option.
  • Make sure that these ones are checked:
    • Remove disinfection tools
    • Purge system restore
    • Reset system settings
  • Push Run.
  • The program will run for a few seconds and display a notepad report. You do not need to attach it.

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning. 
 
 
 


My help is free for everybody.

If you're happy with the help provided and/or wish to buy me a beer for the assistance you received, then you can consider a donation: xbtn_donate_SM.gif.pagespeed.ic.MMi5tqVp

Thank you!

 
 
Stay safe,
TwinHeadedEagle   :)

Link to post
Share on other sites

Please follow this article to reset your Google Chrome. Do not sign in after reset.

 

https://support.google.com/chrome_webstore/answer/1053348?hl=en

 

Tell me do you still have the issue after this?

 

Ok, you said not to sign in after reset...   I followed the instructions and when I clicked to reset, it didn't log me out of Chrome, so I logged myself out, and relaunched it.   So far so good...I've been browsing internet for about 10 minutes and no signs of searchnet.....    I haven't logged back in..  

Link to post
Share on other sites

Ok, you said not to sign in after reset...   I followed the instructions and when I clicked to reset, it didn't log me out of Chrome, so I logged myself out, and relaunched it.   So far so good...I've been browsing internet for about 10 minutes and no signs of searchnet.....    I haven't logged back in..  

spoke too soon....Malwarebytes just said it blocked searchnet again

Link to post
Share on other sites

Something strange is going on:
 
 
TDSSKiller_Kaspersky.png Scan with TDSSKiller
 
Please download TDSSKiller by Kaspersky and save it to your desktop.

  • Right-click on TDSSKiller_Kaspersky.png
  • icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.
  • Your machine may appear very slow and unusable after that - it's normal.
  • TDSSKiller will run automaticaly. Click on Change parameters and click OK.
  • Click the Start Scan button and wait patiently.
  • If anything will be found follow this guidelines:A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post.
    • If a suspicious object is detected, the default action will be Skip, click on Continue.
    • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
      Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
      If Cure is not available, please choose Skip instead.
    • Do not choose Delete unless instructed!

51a5bf3d99e8a-ComboFixlogo16.png Scan with ComboFix
 
This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!

 
Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on 51a5bf3d99e8a-ComboFixlogo16.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Accept the disclaimer and agree if prompted to install Recovery Console.
  • Do not take any actions while ComboFix goes through your System - it may cause it to stall!
  • This scan may take some time!
  • When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).
  • Include that log in your next reply.
    icon_idea.gif If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
    icon_idea.gif If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.
     
     
     
     

    Please download Farbar Recovery Scan Tool and save it to your desktop.
     
    Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
    Only one of them will run on your system, that will be the right version.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Link to post
Share on other sites

 

Something strange is going on:

 

 

TDSSKiller_Kaspersky.png Scan with TDSSKiller

 

Please download TDSSKiller by Kaspersky and save it to your desktop.

  • Right-click on TDSSKiller_Kaspersky.png
  • icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.
  • Your machine may appear very slow and unusable after that - it's normal.
  • TDSSKiller will run automaticaly. Click on Change parameters and click OK.
  • Click the Start Scan button and wait patiently.
  • If anything will be found follow this guidelines:A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post.
    • If a suspicious object is detected, the default action will be Skip, click on Continue.
    • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.

      Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.

      If Cure is not available, please choose Skip instead.

    • Do not choose Delete unless instructed!

51a5bf3d99e8a-ComboFixlogo16.png Scan with ComboFix

 

This is a very powerful tool that should be used only if advised by Malware Analyst.

Do not run ComboFix on your own!

 

Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on 51a5bf3d99e8a-ComboFixlogo16.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Accept the disclaimer and agree if prompted to install Recovery Console.
  • Do not take any actions while ComboFix goes through your System - it may cause it to stall!
  • This scan may take some time!
  • When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).
  • Include that log in your next reply.

    icon_idea.gif If you'll encounter any issues with internet connection after running ComboFix, please visit this link.

    icon_idea.gif If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

     

     

     

     

    Please download Farbar Recovery Scan Tool and save it to your desktop.

     

    Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.

    Only one of them will run on your system, that will be the right version.

    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

 

Ok Kaspersky ran and found no threats, and I tried to upload the log three times and it wont upload... (see screenshot) .  The other logs should all be here.  Let me know what else to do...

Addition.txt

FRST.txt

ComboFix.txt

post-173636-0-18370100-1411167407_thumb.

Link to post
Share on other sites

I am pretty sure your router is compromised. You will have to restore it to factory settings and then to reconfigure it, if it is needed.

Can I do this remotely? and then input the same wifi access password or will all that need to be changed?     I'm asking this because if I can do it without having to explain it all to my my landlord it will save a lot of headaches.   

Link to post
Share on other sites

Can I do this remotely? and then input the same wifi access password or will all that need to be changed?     I'm asking this because if I can do it without having to explain it all to my my landlord it will save a lot of headaches.   

or should i just have her call Comcast and let them do it, because she's totally clueless when it comes to any of this "stuff".

Link to post
Share on other sites

As far as I am concerned, do it whatever you like or can :)

I don't want to get in the router and find out I can't do what's needed....  Will I need to rename network connection and change the wifi password?   I don't know what this searchnet does to a router.... so I guess  my best option is to let the Landlord handle it with Comcast.....  if I can get a hold of her.

 

i'll write back as soon as I can get something done.  Thank you

Link to post
Share on other sites

You just need to reset it to factory settings. It is very simple and can be done within a minute. You can set the password again.

So I can get in there and do it without her even knowing I was in?   Are there any settings in there that I can change to prevent this from happening again?   I'm gonna wait till she's not home.... she's home... I don't want it going down while she's there...  I rather not have to try to explain this all to her because she wouldn't have a clue, and she can be very un-trusting.... which is why I hesitate doing it myself.  I'll know by tomorrow whats what.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.