dimitris1 Posted November 25, 2018 ID:1283017 Share Posted November 25, 2018 hallo After noticing some strange redirecting on my google searches, i downloaded and run adwcleaner.Among 4 or 5 threats, it found a threat which could not delete even after many tries and retries.Part of the log says " ***** [ Firefox URLs ] ***** Not Deleted int.search.tb.ask.com" Next, i downloaded and run Malwarebytes premium trial, which found and deleted some other threats but FAILED TO DETECT the above one.The supposed strange redirecting behaviour continues showing ie many istances of redirecting to "edua29146y.com" which malwarebytes blocks.What should i do next? Link to post Share on other sites More sharing options...
kevinf80 Posted November 25, 2018 ID:1283020 Share Posted November 25, 2018 Hello dimitris1and welcome to Malwarebytes, Run the following: Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.htmlNote: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status... Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans" Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Thank you, Kevin... Link to post Share on other sites More sharing options...
dimitris1 Posted November 25, 2018 Author ID:1283030 Share Posted November 25, 2018 here are the 2 text files... FRST.txt Addition.txt Link to post Share on other sites More sharing options...
kevinf80 Posted November 25, 2018 ID:1283036 Share Posted November 25, 2018 Is this profile known to you and trusted..? FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\zjz1u028.NIKOS [2018-11-25] Link to post Share on other sites More sharing options...
dimitris1 Posted November 25, 2018 Author ID:1283037 Share Posted November 25, 2018 yes its approved by me to use the PC Link to post Share on other sites More sharing options...
kevinf80 Posted November 25, 2018 ID:1283038 Share Posted November 25, 2018 I do not see any indication of Malware or Infection in frst logs, do you still have remaining issues or concerns..? Link to post Share on other sites More sharing options...
dimitris1 Posted November 25, 2018 Author ID:1283043 Share Posted November 25, 2018 the adwcleaner still shows ***** [ Firefox URLs ] ***** Not Deleted int.search.tb.ask.com (Failed to delete it) and i see at least one redirection from a site i visited in the past to an advertising site, plus in several pages of a particular google search , several search results are obviously bad (blocked by malwarebytes due to trojan horse, or opening "edua29146y.com " instead of the normal page-when i choose "open in a new window" the page loads normally) Link to post Share on other sites More sharing options...
kevinf80 Posted November 25, 2018 ID:1283044 Share Posted November 25, 2018 Please download Zemana AntiMalware and save it to your Desktop. Install the program and once the installation is complete it will start automatically. Without changing any options, press Scan to begin. After the short scan is finished, if threats are detected press Next to remove them.Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please re-boot your computer manually. Open Zemana AntiMalware again. Click on icon and double click the latest report. Now click File > Save As and choose your Desktop before pressing Save. Attach saved report in your next message. Link to post Share on other sites More sharing options...
dimitris1 Posted November 26, 2018 Author ID:1283056 Share Posted November 26, 2018 hi, i attach the zemana log and must go sleep...hear you, hopefully, tomorrow! 2018.11.26-01.56.44-i0-t92-d2.txt Link to post Share on other sites More sharing options...
dimitris1 Posted November 26, 2018 Author ID:1283125 Share Posted November 26, 2018 hallo Did you check the zemana log? Link to post Share on other sites More sharing options...
kevinf80 Posted November 26, 2018 ID:1283126 Share Posted November 26, 2018 Yes I did, what is happening with your system now...? Link to post Share on other sites More sharing options...
dimitris1 Posted November 26, 2018 Author ID:1283175 Share Posted November 26, 2018 AdwCleaner[S00].txt Maybe, it is somewhat improved, i dont know for sure.In the google search results i mentioned above, there are still several strange results (web pages) but maybe this is due to the search itself ("do the math 50 todays jazz pianists") but adwcleaner still shows that strange finding which could not remove.I attach the adwcleaner report, maybe it is useful Link to post Share on other sites More sharing options...
kevinf80 Posted November 26, 2018 ID:1283182 Share Posted November 26, 2018 That entry seems to be a search engine in firefox..? Open firefox, select a new tab. Type or copy/paste about:preferences#search into the address bar, hit enter. That will open search options, scroll to "one click search engines" does the problem issue show...? if so highlight then select remove... Link to post Share on other sites More sharing options...
dimitris1 Posted November 26, 2018 Author ID:1283228 Share Posted November 26, 2018 i did it, the "one click search engines" list doesnt include "int.search.tb.ask.com" Link to post Share on other sites More sharing options...
kevinf80 Posted November 27, 2018 ID:1283295 Share Posted November 27, 2018 Run FRST one more time: Type or copy/paste the following in the edit box after "Search:". *ask* Click Search Registry button and post the log (Search.txt) it makes to your reply. Link to post Share on other sites More sharing options...
dimitris1 Posted November 27, 2018 Author ID:1283465 Share Posted November 27, 2018 On 11/25/2018 at 9:35 PM, dimitris1 said: Link to post Share on other sites More sharing options...
dimitris1 Posted November 27, 2018 Author ID:1283466 Share Posted November 27, 2018 hi, again ( sorry for beeing so late to answer, if you have problem with that, i could arrange to respond more quickly) SearchReg.txt Link to post Share on other sites More sharing options...
kevinf80 Posted November 28, 2018 ID:1283486 Share Posted November 28, 2018 Do not worry about reply times, is no big deal... Continue: Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, reset Firefox with clean install, see if that makes any difference.. Make a "Clean" install Firefox: Use the following link for instructions how to back up your bookmarks, same link can be used to import saved Bookmarks:https://support.mozilla.org/en-US/kb/export-firefox-bookmarks-to-backup-or-transfer Next, Remove all synced data from Firefox to stop possible re-infection or exploitation.https://support.mozilla.org/en-US/questions/1037353 Next, Go here: http://www.mozilla.org/en-US/ download save the latest version of Firefox.. We will install this later... Next, Lets totally remove Firefox and start over. Go here: https://support.mozilla.org/en-US/kb/uninstall-firefox-from-your-computer and follow those instructions... Ensure when the uninstall completes to navigate to and delete the firefox installation folder (if present): (32-bit Windows) C:\Program Files\Mozilla Firefox (64-bit Windows) C:\Program Files (x86)\Mozilla Firefox It is essential the installation folder is removed. Re-boot your system when that is completed.... Next, To remove all remaining data and profile information... Press "Windows key + R" to open the Run box In the Run box, type in or copy and paste %APPDATA% Click OK. A Windows Explorer window will appear. In this window, choose/open in succession Mozilla > Firefox > Profiles. Select Delete on each entry in reverse, eg Profiles > Delete. Firefox > Delete. Mozilla > Delete. Re-boot your system when complete! Next, Use the Mozilla Firefox installer to reinstall your Browser.... When Firefox is installed and open select these keys together :- Ctrl - Shift - A that will access Addons manger, this gives access to find addons/extensions, use, start, stop or disable those features etc.... uBlock-Origin can be installed from here: https://addons.mozilla.org/en-GB/firefox/addon/ublock-origin/ <<--- Recommended. Post log from FRST fix, also let me know if any remaining issues or concerns.. Thank you.... Kevin fixlist.txt Link to post Share on other sites More sharing options...
dimitris1 Posted November 28, 2018 Author ID:1283626 Share Posted November 28, 2018 could it be a solution without having to update firefox? I have v 56.0.2 because of having an addon (Scrapbook) which i cant live without and its not supported by later Firefox versions.I know that it is not good practice to stick to firefox older versions, but really is a rather big trouble for me to update, at this time... Link to post Share on other sites More sharing options...
kevinf80 Posted November 28, 2018 ID:1283640 Share Posted November 28, 2018 I would follow the instructions for the clean install, when ready you can download the version of Firefox that you need... Link to post Share on other sites More sharing options...
dimitris1 Posted November 28, 2018 Author ID:1283646 Share Posted November 28, 2018 But , i do proceed with the FRST fix (and clean install of my version of Firefox), is it ok? Link to post Share on other sites More sharing options...
kevinf80 Posted November 28, 2018 ID:1283655 Share Posted November 28, 2018 Yes that is ok, old version of Firefox is available from FileHippo: https://filehippo.com/download_firefox/79038/ Link to post Share on other sites More sharing options...
dimitris1 Posted November 30, 2018 Author ID:1283930 Share Posted November 30, 2018 Hallo i did a clean install, of my version of firefox (uninstall, reboot etc) Only, i didnt delete my profile, bookmarks, history because they are very big (par example 14 GB of data in a profile folder) Is it very important to take this step? The '' int.search.tb.ask.com'' is still at the adwcleaner log Fixlog.txt Fixlog.txt Link to post Share on other sites More sharing options...
kevinf80 Posted November 30, 2018 ID:1283965 Share Posted November 30, 2018 A clean install is not clean if the instructions I gave are not followed, your bookmarks would have been saved: https://support.mozilla.org/en-US/kb/export-firefox-bookmarks-to-backup-or-transfer Lets try refreshing Firefox, see if that clears ask.com... With Firefox running open a new tab, in the address bar type or copy/paste about:support hit enter... In the new window select "Copy to Clipboard" then open Notepad, right click into the text field and select "Paste" save that file and attach to your next reply. Now you can select "Refresh" that will refresh Firefox, run adwcleaner see that has helped... Quote Refreshing Firefox. Note: When using the refresh feature, your bookmarks, browsing history, open tabs, windows, passwords, cookies and web form auto-fill information will be saved. However, your extensions and themes will be removed and your preferences will be reset Link to post Share on other sites More sharing options...
kevinf80 Posted December 5, 2018 ID:1285029 Share Posted December 5, 2018 Any progress..? Link to post Share on other sites More sharing options...
Recommended Posts