Can't get rid of Vosteran!

[Gemma]

Hi,

I have recently had to install a new hard drive after my computer took a fall and I've been reinstalling all the software and drivers needed. I noticed two days ago that when I open Google Chrome, a second tab appears with "Vosteran Search". After googling I realised this is Malware. I have tried using Malwarebytes Pro, Bitdefender, Adwcleaner, JT, uninstalled from programs and removed the extension in Google Chrome but I still can't get rid of it!!!

 

Please help! 

 

Logs attached. Too long to post in message apparently...

 

Thanks, Gemma

 

 

 

FRST.txt

Addition.txt

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Next,

 

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

 

 

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

 

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

 

 

In most cases, a restart will be required.

 

 

Wait for the prompt to restart the computer to appear, then click on Yes.

 

 

Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

 

Next,

 

Scan with ZOEK

 

Please download ZOEK by Smeenk from here: http://hijackthis.nl/smeenk/ and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

 

• 
  

Right-click on icon and select Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.
In the main box please paste in the following script:

 

services_list;standardsearch;autoclean;emptyclsid;emptyfolderscheck;deleteiedefaults;firefoxlook;chromelook;FFdefaults;CHRdefaults;

 

 

• 
  

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

 

Please include its content in your next reply. Don't forget to re-enable security software!

 

Post those two logs, let me know if the issue with Chrome is gone when Zoek has completed....

 

Thank you,

 

Kevin...

[Gemma]

Hi Kevin,

 

Apparently the post is too long with both logs so I will try (again) to post them, separately this time...

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 28/11/2014
Scan Time: 5:50:58 PM
Logfile: Mbam.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.28.03
Rootkit Database: v2014.11.22.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: UNICORN

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 308596
Time Elapsed: 9 min, 11 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

[Gemma]

I am having so much trouble trying to upload these posts.

I keep getting a message that says "Your post was too long. Please go back and shorten it a little".

 

So I have attached the Zoek log. I hope this is ok.

 

And yes Vosteran Search is still opening in the second tab in Google Chrome

 

Cheers,

Gemma

 

 

 

 

zoek-results.txt

[kevinf80]

Thanks for the logs, continue please:

 

Go to the following link: https://support.google.com/chrome/answer/3296214?hl=en reset browser settings specific to Chrome.

 

Go to the following link: https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb Install Adblock plus, specific to Chrome.

 

Go to the following link: https://chrome.google.com/webstore/detail/flashblock/gofhjkjmkpinhpoiabjplobcaignabnl?hl=en Install FlashBlock specific to Chrome.

 

Go to the following link: https://support.google.com/chrome/answer/95314?hl=en Set your startup and home pages specific to Chrome.

 

Go to the following link: https://support.google.com/chrome/answer/95426?hl=en Set your deault search engine specific to Chrome.

 

Finally,

 

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

 

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Quick Scan

Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

 

1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

 

notepad c:\windows\debug\mrt.log

 

Post the log from MRST, also let me know if issue is cleared for Chrome....

 

Kevin...

[Gemma]

Hi Kevin,

 

While following your instruction links, I found Vosteran listed as a search engine in Google Chrome so I deleted it.

Below is the log and I no longer have Vosteran opening every time I open Chrome

 

Thanks for your help, it's greatly appreciated!

 

Gemma

 

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.18, November 2014 (build 5.18.10802.0)
Started On Fri Nov 28 22:07:25 2014

Engine: 1.1.11104.0
Signatures: 1.187.1116.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Fri Nov 28 22:18:29 2014

Return code: 0 (0x0)

[kevinf80]

Excellent, good to hear you`ve removed that nuisance. Run the following to clear up:

 

Download "Delfix by Xplode" and save it to your desktop.

 

Or use the following if first link is down:

 

"Delfix link mirror"

 

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

 

Make Sure the following items are checked:

 

• 
  

    Activate UAC
    Remove disinfection tools
     Create registry backup
    Purge System Restore
    Reset system settings

 

Now click on "Run" and wait patiently until the tool has completed.

 

The tool will create a log when it has completed. We don't need you to post this.

 

Part of the routine will be to create a registry back up with ERUNT,  the back up will be created here:

 

C:\Windows\ERUNT

 

When all is known to be well with your system you can delete that back up folder if you consider it as not needed...

 

Any remnant files/logs from tools we have used can be deleted…

 

Next,

 

Read the following link to fully understand PC security and best practices, you may find it useful....

 

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

 

Let me know if we are ok to close out...

 

Thank you,

 

Kevin..

[Gemma]

Hi Kevin,

 

Yes, my computer is running fine now so you can close out. Thank you very much for your assistance.   

 

And thank you for the link re PC security and best practices. I will take the advice.

 

 

Cheers,

Gemma

[kevinf80]

Hello Gemma,

 

Thanks for the update, good to hear all is well. It was a pleasure to work with you...

 

Take care and surf safe,

 

Kevin...

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!