Jump to content

CenturyLink.net – Hijack - Browsers

ed48

By ed48
in Resolved Malware Removal Logs

 Share

Recommended Posts

ed48

ed48

Posted
Posted

I recently installed a “Windows 10 Compatibility Pack” after receiving an email from CenturyLink recommending it before I upgrade to Windows 10.  Since installing it, Chrome, Firefox, and IE all open up to the following link, http://centurylink.net/?cid=wcp_desktop.   My home page for each is actually set as https://www.google.com/ .  I uninstalled the compatibility pack, I ran Malwarebytes Anti-Malware, and I ran Microsoft Security Essentials full scan option, and the centurylink site still opens when I open a browser.  I called CenturyLink and they couldn’t or wouldn’t help me.  I saw that a similar problem was discussed by dbreeze at the following link in December 2015, for a computer running Windows  OS 8.1, https://forums.malwarebytes.org/topic/176689-centurylinknet-hijack-ie-firefox/   I am still running Windows 7 on my computer, and have not upgraded to Windows 10.

 

Should I follow the same steps outlined in the link above to remove the centurylink.net?  I noticed the following was stated by dbreeze in the link above:  NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system.  I would greatly appreciate your advice and guidance.  (This is my first post to this site, so I am unsure if I have done this correctly.) 

Thank you,

Ed48

Link to post
Share on other sites
  • Staff
gringo_pr

gringo_pr

Posted
  • Staff
Posted

Hello Ed48

 


I would like to welcome you to Malwarebytes support, my name is William and I will be helping you out today.

.

In order for us to get started on your problem, I will need to get a couple of diagnostic reports from the computer to help me see where the problem could be and help me decide the best way to start.

Please download " Farbar Recovery Scan Tool (FRST)" from one of the following links, and save it to your Desktop (please note that some web browsers will automatically save all downloads in your Downloads folder, so in those cases please move them to the desktop.)
.

Note: You need to run the version compatible with your computer. If you are not sure which version applies to your computer, then download both of them and try to run them. Only one of them will run on your computer, and that will be the right version.

.
For 32-bit (x86) editions of Windows: >> FRST.exe <<

For 64-bit (x64) editions of Windows: >> FRST64.exe <<

.

  1. Run the “FRST” download that works on your computer
  2. When the tool opens click “Yes” for the disclaimer in order to continue using “FRST”.
  3. Under the section called “Whitelist” make sure all boxes are checked
  4. Under the section called “Optional Scan” I would like you to have a check mark next to “Addition.txt”
  5. Press the “Scan” button.
  6. When the scan is done, it will save the reports to the same location as FRST (if you had saved “FRST” on your desktop, then the reports will be saved on the desktop).
  7. Please attach the “FRST.txt” and the “Addition.txt” log file to your next reply to me (it is best if you do not copy and paste it into an e-mail).

.

.
It would be better for you and for me if you can attach the reports to the email instead of copying and pasting them, the email system changes the format of them and makes them very hard to read.
.

If you are not used to attaching files to e-mails, then just look for a button in the toolbar above where you write your message that has a paperclip icon, and that should be the attachment button. You can also get the idea on how to attach files to an email from watching this video – >> How to attach files <<

.
When you reply back to me you should have Two reports for me
FRST.txt
Addition.txt

.

Link to post
Share on other sites
  • Staff
gringo_pr

gringo_pr

Posted
  • Staff
Posted


After running the fix I have made below I would like you to restart the computer and after the computer has been restarted I would like you to check the computer and let me know how the computer is doing and if the problem still exists.

.
I have attached a file to this email named Fixlist.txt, I need you to download this file and save it next to the Farbar Recovery Scan Tool (“FRST”) program (right next to each other is best)

Run the program called “FRST” again but, this time, I would like you to press the “Fix” button just once and wait.

.
When it has finished running it will make a report named fixlog.txt next to “FRST”. Please attach this report to your next reply to me.

 

fixlist.txt

Link to post
Share on other sites
  • Staff
gringo_pr

gringo_pr

Posted
  • Staff
Posted

I would like to reset Chrome back to defaults to completely clear out what is going on with Chrome.

You can keep your “Bookmarks” if you want to keep them, but you have to export them first – >> Export Bookmarks << – Everything else should be removed.

Then I need you to go to >> Google Sync << and sign into your account.
Scroll down until you see the “reset sync” button and click on the button
At the prompt click on “Ok”.

.
Reset Your Browser Settings
.

  1. In the top-right corner of the browser window, click the “Chrome Menu” icon (Three horizontal lines)
  2. Select “Settings”.
  3. At the bottom, click “Show advanced settings…”
  4. Scroll down until you see “Reset settings”, Then click on the button “Reset Settings”.
  5. In the dialog that appears, click “Reset”.

.
Close Chrome and restart it and check it out for me please

.

Regards,

William Rowland – “Gringo_pr”

Link to post
Share on other sites
ed48

ed48

Posted
  • Author
Posted

I did what you asked, and Chrome opened to my regular home page, i.e., Google.  As I have continued to play around with this problem, I have discovered something.  After my attempt to download the “CenturyLink Compatibility Pack,” which seems to have started my problems, clicking on each of my small icon shortcuts to the browsers, located in the taskbar at the bottom of my screen, would take me to the centurylink opening page that we have been trying to remove.  After attempting to download the Compatibility Pack, I also noticed some new shortcuts to the browsers had been added to my home screen.  Clicking on those also took me to the centurylink opening screen.  I just discovered something else a few minutes ago.  If I go to the windows start button in the lower left corner of the screen, click on All Programs, and then open each browser one at a time, they will each open to my normal Google home page.  However, if I click on the newly added shortcuts to the browsers on my home screen, they still go to the centurylink opening page.  Perhaps that info will help you determine what is happening.

 

Link to post
Share on other sites
  • Staff
gringo_pr

gringo_pr

Posted
  • Staff
Posted


Hello ed48



Now I need you to download this script that I have made for you --> fixlist.txt

It needs to be saved Next to the  "Farbar Recovery Scan Tool" (FRST) program (If asked to overwrite existing one please allow)

Run FRST again but this time press the Fix button just once and wait.


When finished, it will make a log (fixlog.txt) next to FRST. Please attach the contents of this file to your reply.


NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system


Gringo

 

Link to post
Share on other sites
ed48

ed48

Posted
  • Author
Posted

I have opened the three browsers several times since your fix, and they always open to my home page, Google.  Can I assume that the centurylink.net is now completely removed from my computer?  If so, I am greatly indebted to you for your time and expertise.  Thank you.  I would be happy to pay you for your help if that is appropriate.  Please advise.

Obviously, I (and you) do not want to go through this exercise again.  I was wondering if Malwarebytes Anti-Malware Premium would have prevented centurylink.net from capturing my computer if I had had the software installed.  I would appreciate any advice for future protection you are willing to offer me.  Again, thank you.

ed48

Link to post
Share on other sites
  • Staff
gringo_pr

gringo_pr

Posted
  • Staff
Posted

Hello Ed48

 

I can't say if it would have stopped it or not but it would not have hurt and as far as paying me - no need to do that - just say good things about us over here

 

You are more than welcome and It has been a pleasure helping you.  *:-)*
.

If there anything else that I can assist you with then just let me know and I’ll be happy to look into it for you. If not, then this ticket will auto close in a couple of days and at that time, you will be receiving a survey from us so you will be able to rate our service to you and to leave a comment about the service you received from me.

.
Have a nice day and goodbye.


Gringo

Link to post
Share on other sites
ed48

ed48

Posted
  • Author
Posted

I will be happy to give you an A+ grade.  One last question:  Given my negative experience with the beginning stages of switching to Windows 10 (the so-called compatibility pack), I am nervous about having to spend large chunks of time learning how to use 10 and dealing with potential problems and a new way of doing things.  From your 30,000 foot view of the computer world, do you have an opinion about the advisability of switching to 10.  Just wondering.  My computer is 4+ years old, so I assume I will buy a new one in the coming years with Windows 10 pre-installed on it.

Thanks again for all you've done to help me.

Ed48

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.