europa Posted October 28, 2014 ID:897954 Share Posted October 28, 2014 Hi.I'd be very grateful for some help in removing safefinder malware. Please note: i have already followed some of the tips from here: https://forums.malwarebytes.org/index.php?/topic/157591-pc-is-acting-up-and-i-cant-get-rid-of-safefinder-as-new-tab-on-chrome/?hl=%2Bsafefinder#entry884399 (as this appears to be the same issue). However, i am not confident 'fixing' anything at this point...especially as this is a friend's pc. Therefore, it'd be great if someone could point me in the right direction. Addition.txtDelFix.txtFRST.txtmalwarebytes.txtRKreport_SCN_10282014_204521.log Link to post Share on other sites More sharing options...
europa Posted October 30, 2014 Author ID:899138 Share Posted October 30, 2014 Anyone available to help, please? Link to post Share on other sites More sharing options...
kevinf80 Posted October 30, 2014 ID:899152 Share Posted October 30, 2014 Hello and P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Next, Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... linkWhen the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware. Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected. In most cases, a restart will be required. Wait for the prompt to restart the computer to appear, then click on Yes. Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply. Next, Run a scan with FRST one more time, only one log will be produced (FRST.txt) Post both logs in your next reply... Link to post Share on other sites More sharing options...
europa Posted October 30, 2014 Author ID:899175 Share Posted October 30, 2014 Logs attached. Many thanks! FRST.txtmalwarebytes.txt Link to post Share on other sites More sharing options...
kevinf80 Posted October 30, 2014 ID:899245 Share Posted October 30, 2014 Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Run FRST and press the Fix button just once and wait.The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Download AdwCleaner by Xplode onto your Desktop. Double click on Adwcleaner.exe to run the tool. Click on Scan Once the scan is done, click on the Clean button. You will get a prompt asking to close all programs. Click OK. Click OK again to reboot your computer. A text file will open after the restart. Please post the content of that logfile in your reply. You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number Next, Please download Junkware Removal Tool to your desktop.Shut down your protection software now to avoid potential conflicts. (re-enable when done)Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".The tool will open and start scanning your system.Please be patient as this can take a while to complete depending on your system's specifications.On completion, a log (JRT.txt) is saved to your desktop and will automatically open.Post the contents of JRT.txt into your next message. Next, We still need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete: Run Eset Online Scanner **Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin. (To run ESET Online Scanner in a browser other than Internet Explorer, you'll need to download ESET SMART Installer during the process) Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET. Turn off the real time scanner of any existing antivirus program while performing the online scan click on the Run ESET Online Scanner button Tick the box next to YES, I accept the Terms of Use.Click Start When asked, allow the add/on to be installedClick Start Make sure that the option "Remove found threats" is UNticked Click on Advanced Settings, ensure the following options are checked: Scan for potentially unsafe applicationsEnable Anti-Stealth Technology Click Scan wait for the virus definitions to be downloaded Wait for the scan to finish When the scan is complete If no threats were found put a checkmark in "Uninstall application on close" close program report to me that nothing was found If threats were found click on "list of threats found" click on "export to text file" and save it as ESET SCAN and save to the desktop Click on back put a checkmark in "Uninstall application on close" click on finish close program Copy and paste the report in next reply. Let me see those logs in your next reply, also give an update on any remaining issues or concerns... Thanks, Kevin Fixlist.txt Link to post Share on other sites More sharing options...
europa Posted October 30, 2014 Author ID:899389 Share Posted October 30, 2014 Fixlog.txt Link to post Share on other sites More sharing options...
europa Posted October 30, 2014 Author ID:899417 Share Posted October 30, 2014 AdwCleanerS0.txtJRT.txt Link to post Share on other sites More sharing options...
europa Posted October 30, 2014 Author ID:899500 Share Posted October 30, 2014 All done! Let me know if i need to do anything else.ESET.txt Link to post Share on other sites More sharing options...
kevinf80 Posted October 30, 2014 ID:899640 Share Posted October 30, 2014 Open Notepad, select "Format" from the menu bar, make sure "Word Wrap" is not checked. Copy the text from the code box below to Notepad.@echo offdel /f /s /q "C:\Users\rafal\AppData\Roaming\RHEng\B4D4358D08394F8D93BCF1D1A9B88D5C\Installer.exe"del /f /s /q "C:\Users\rafal\Downloads\Advanced_Uninstaller11.exe"del %0Save the Notepad file on your desktop...as delfile.bat... save type as "All Files"It should look like this: <--XP <--vista or windows 7/8Double click on delfile.bat to execute it.A black CMD window will flash, then disappear...this is normal.The files and folders, if found...will have been deleted and the "delfile.bat" file will also be deleted. Next, If no remaining issues or concerns run the following to clean up: Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Activate UAC Remove disinfection tools Create registry backup Purge System Restore Reset system settings Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Part of the routine will be to create a registry back up with ERUNT, the back up will be created here: C:\Windows\ERUNT When all is known to be well with your system you can delete that back up folder if you consider it as not needed... Any remnant files/logs from tools we have used can be deleted… Next, Read the following link to fully understand PC security and best practices, you may find it useful.... http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629 Let me know if we are ok to close out.... Kevin... Link to post Share on other sites More sharing options...
europa Posted November 1, 2014 Author ID:900601 Share Posted November 1, 2014 Many thanks, Kevin. All looks good; my friend will be pleased! Thanks also for the link - i'll install the necessary antivirus software before giving him his pc back! All the best! Link to post Share on other sites More sharing options...
kevinf80 Posted November 1, 2014 ID:900653 Share Posted November 1, 2014 Thanks for the update, good to hear all is well again.... Take care and surf safe, Kevin Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 4, 2014 Root Admin ID:902299 Share Posted November 4, 2014 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts