Jump to content

esurf.biz has hijacked IE, Firefox and Opera


dmax77

Recommended Posts

Internet Explorer, Firefox and Opera browsers all open with homepage esurf.biz for the last 2 days.

 

Attempts to detect and clean with Malwarebytes, SuperAntiSpyware,Spyhunter and Eset Anti-virus have failed

 

Hope someone can help me. :)

 

Thanks

 

dmax

Link to post
Share on other sites

Hello and welcome,

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Next,

 

Please open Malwarebytes Anti-Malware.

  • On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
  • Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
  • Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • With some infections, you may or may not see this message box.

            'Could not load DDA driver'
  • Click 'Yes' to this message, to allow the driver to load after a restart.
  • Allow the computer to restart. Continue with the rest of these instructions.
  • When the scan is complete, click Apply Actions.
  • Wait for the prompt to restart the computer to appear, then click on Yes.
  • After the restart once you are back at your desktop, open MBAM once more.



To get the log from Malwarebytes do the following:

  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click Export > From export you have three options:

      Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
      Text file (*.txt)        - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
      XML file (*.xml)      - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
  • Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…


 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.

  • Double click on Adwcleaner.exe to run the tool.
  • Click on the Scan in the Actions box
  • Please wait fot the scan to finish..
  • When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
  • Click on the Cleaning box.
  • Next click OK on the "Closing Programs" pop up box.
  • Click OK on the Information box & again OK to allow the necessary reboot
  • After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...

 
Next,
 
thisisujrt.gif Please download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts. (re-enable when done)
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.


 

Next,

 

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
    (Windows 8 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.


 

Let me see those logs, also give an update on any remaining issues or concerns...

 

Thank you,

 

Kevin....

Link to post
Share on other sites

Hello Kevin

 

Thanks very much for your time and help.

 

I have run all the scans you listed in that order and logs were created, which I will post and attach last.

 

After the scans it appears Firefox Browser is now free of any signs of hijacking.

 

However Internet Explorer and Opera 32 Browsers still are affected with the start/homepage being set to esurf.biz

 

Now the logs:

 

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 27/10/2015
Scan Time: 5:05 AM
Logfile:
Administrator: Yes

Version: 2.1.8.1057
Malware Database: v2015.10.26.05
Rootkit Database: v2015.10.23.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: David

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 332734
Time Elapsed: 4 min, 55 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

 

 

# AdwCleaner v5.015 - Logfile created 27/10/2015 at 06:09:01
# Updated 26/10/2015 by Xplode
# Database : 2015-10-26.2 [server]
# Operating system : Windows 7 Professional Service Pack 1 (x64)
# Username : David - HOME-PC
# Running from : C:\Users\David\Desktop\adwcleaner_5.015.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C8].txt - [652 bytes] ##########

 

 

Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Windows 7 Professional x64
Ran by David on Tue 27/10/2015 at 12:03:36.38
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 27/10/2015 at 12:05:09.99
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Addition.txt

FRST.txt

Link to post
Share on other sites

Continue as follows please:

 

Download and unzip DNSJumper to your Desktop, the tool is portable no installation necessary.

DNSJumper instructions available here: http://www.sordum.org/7952/dns-jumper-v2-0/

Tool can be downloaded here: http://www.sordum.org/downloads/?dns-jumper

 

  • Right click on Dnsjumper.exe and select "Run as Administrator" to start the tool.
  • From the lefthand pane select "Flush DNS"
  • From the main interface select the dropdown under "Choose a DNS Server"
  • From the list select either "Google Public DNS" or "Open DNS"
  • From the lefthand pane select "Apply DNS"

When done re-boot your system....

 

Next,

 

51a612a8b27e2-Zoek.pngScan with ZOEK

Please download ZOEK by Smeenk from here: http://hijackthis.nl/smeenk/ and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on 51a612a8b27e2-Zoek.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:



services_list;standardsearch;autoclean;emptyclsid;emptyfolderscheck;deleteiedefaults;firefoxlook;chromelook;FFdefaults;CHRdefaults;Operalook;Operadefaults;


  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)



Please include its content in your next reply. Don't forget to re-enable security software!

 

Let me see those logs, also if any remaining issues or concerns...

 

Thank you,

 

Kevin
 

Link to post
Share on other sites

Uninstall Opera with GeekUninstaller, instructions follow

 

Download GeekUninstaller from here: http://www.geekuninstaller.com/download (Choose free version) Save Geek.zip to your Desktop. (Visit the Home page at that link for necessary information)

Extract Geek Uninstaller and save to your Desktop. There is no need to install, the executable is portable and can also be run from a USB if required.

Run the tool, the main GUI will populate with installed programs list,

Left click on Opera to highlight that entry.

Select Action from the Menu bar, then Uninstall from there follow the prompts.

If Uninstall fails open the "Action" menu one more time and use "Force Removal" option

 

Next,

 

Go here: http://windows.microsoft.com/en-gb/internet-explorer/reset-ie-settings#ie=ie-11  follow the instructions and reset IE 11

 

Next,

 

Re-install Opera if you use it from here: http://www.opera.com/

 

Any change with browser issues?

 

Thanks,

 

Kevin..

Link to post
Share on other sites

Hello Kevin

 

I have uninstalled Opera with GeekUninstaller and re-installed.

 

Opera now appears to be free of the hijacker.

 

I have reset Internet Explorer as per the instructions on the linked page and re-booted.

 

Internet Explorer however is still infected, showing esurf.biz as homepage and opening tabs to ad and survey sites.

 

Thanks for all your help so far.

 

David

Link to post
Share on other sites

Thanks for the update David, continue as follows:

 

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the two logs....
 

Next,

 

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

  • Quit all running programs.
  • For Windows XP, double-click to start.
  • For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
  • Read and accept the EULA (End User Licene Agreement)
  • Click Scan to scan the system.
  • When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open.
  • Close the program > Don't Fix anything!



Let me see those logs....

 

Thank you,

 

Kevin...
 

Link to post
Share on other sites

Thanks for those logs. Yninstall the following via GeekUninstaller:

 

Internet Download Manager

SpyHunter 4

 

Re-boot when complete.

 

Next,

 

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Post that log, also let me know if any remaining issues or concerns...

 

Thank you,

 

Kevin...
 

 

Fixlist.txt

Link to post
Share on other sites

Hello Kevin

 

I have uninstalled both Spy Hunter and Internet Download Manager using GeekUninstaller.

 

I downloaded the fixlist text and run FRST. I have attached the resulting log.

 

Internet Explorer still has its Homepage set esurf.biz.

 

Thank you for your continued help.

 

David

 

 

 

Fixlog.txt

Link to post
Share on other sites

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the two logs....
 

Next,

 

Select Windows key and R key together, Type or copy/paste the following into the "Run" box, iexplore -extoff tap enter...

 

internet explorer will open with all extensions disabled, does the issue remain?

 

Post FRST logs, also let me know the result of internet explorerbwith extensions off..

 

Thank you,

 

Kevin.

Link to post
Share on other sites

Thanks for the logs, update... Do not see anything wrong with those logs.....

 

Open Internet Explorer, select Tools (looks like a cog wheel) select "Manage Add-ons"

 

In the new window select "Search Providers" the default maybe set as esurf.biz if so select the normal one maybe Bing etc. Change that to default.

 

Single left click once on esurf.biz, select remove...

 

Reboot your system, open IE, any improvement?

Link to post
Share on other sites

Hello Kevin

 

esurf.biz did not show up in any of the Add-on settings.

 

Even in Internet Options Microsoft is shown as the Homepage and Bing as the default  Search Engine.

 

Even trying to change these makes no difference, esurf.biz always loads as the Homepage and then ope ns tabs to surveys/Ads.

 

As mentioned in my previous post when extensions disabled it did not show up.

 

I have attached a jpeg image of the esurf.biz Homepage taken with Print Screen.

 

Thank you.

 

David

post-194517-0-08905200-1446059169_thumb.

Link to post
Share on other sites

This proving hard to catch, run the following and post the produced log..

 

Please download SystemLook from the following link below and save it to your Desktop. Use the correct version 32bit or 64bit.

http://jpshortstuff.247fixes.com/SystemLook_x64.exe     <<-   64 bit….

http://images.malwareremoval.com/jpshortstuff/SystemLook.exe   <<-  32 bit

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :filefindesurf.biz*esurf.*:regfindesurf.bizesurf.**esurf*
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.


Note: The log can also be found on your Desktop entitled SystemLook.txt

 

Cheers,

 

Kevin..
 

Link to post
Share on other sites

....Ok run the following once again, note i`ve also asked for the "Shortcut.txt" to be added..

 

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" Also checkmark Shortcut.txt and Addition.txt under Optional scan Select scan, when done post the two logs....
 

Kevin...

Link to post
Share on other sites

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.
 

Post the new log, also check if the issue is now gone...

Fixlist.txt

Link to post
Share on other sites

Thanks for the log and update, good to see the nuisance is gone. Run the following to clean up:

 

Download "Delfix by Xplode" and save it to your desktop.

Or use the following if first link is down:

"Delfix link mirror"

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:



  •    
  • Remove disinfection tools
       
  • Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created.
       
  • Reset system settings



Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Any remnant files/logs from tools we have used can be deleted…
 

Next,

 

Read the following links to fully understand PC Security and Best Practices, you may find them useful....

Answers to Common Security Questions and best Practices

Do I need a Registry Cleaner?

Take care and surf safe

Kevin...  busy.gif
 

Link to post
Share on other sites

  • Root Admin

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.