Browser Hijack & Word Doc Problems

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by harvastmoon, Apr 19, 2016.

  1. harvastmoon

    harvastmoon Private E-2

    My Chrome browser is being redirected to searchengage.com and portions of a word document I was working on began deleting itself and I couldn't stop it, also the screen turned upside down.
    Attached are: a. MBAM Log
    b. RougeKiller Log
    c. TDSSKiller Log
    d. HitmanPro - Cannot run; it stopped after a few minutes. (screen pic attached)
    e. MGlogs.zip

    I would appreciate any help. Thank You.
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your Malwarebytes log does not show that you fixed anything. Did you save the log before fixing? You need to fix everything that it reports and then save the log. Please run a new scan and make sure that it comes up clean. If not, fix what it finds and then save a new log to attach here.

    Are the below Chrome Addon's things that you added?

    [PUP][CHROME:Addon] Default : Add Tasks to Do It (Tomorrow) [eimhlfnbjllicocigjdalpodkokffbmm] -> Found
    [PUP][CHROME:Addon] Default : S?a l?i "Missing Plug-in" [plkplgmhfkkhokgkdkblfcnfeccpippe] -> Found
     
  3. harvastmoon

    harvastmoon Private E-2

    Not sure what happened because I was sure that I did something with MBAM items found.
    I looked again and found this log in the MBAM folder. It isn't in .txt form though, is this the way it should look? I'm confused, any I went back, and see that these items were just quarentined and so I permanently deleted them. I started another scan and will post if you wish.

    1. [PUP][CHROME:Addon] Default : Add Tasks to Do It (Tomorrow) [eimhlfnbjllicocigjdalpodkokffbmm] -> Found
    I had used this at one time but don't need it any more.


    2. [PUP][CHROME:Addon] Default : S?a l?i "Missing Plug-in" [plkplgmhfkkhokgkdkblfcnfeccpippe] -> Found
    I don't recognize this.
     

    Attached Files:

  4. harvastmoon

    harvastmoon Private E-2

    Latest MBAM Log attached.
     

    Attached Files:

  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Uninstall the below program. If you do not find it or it will not uninstall, just keep going.
    i-beta.com extension


    Now please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, Win7, 8 or 10, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.

    Please download AdwCleaner by Xplode and save to your Desktop.
    • Right click onAdwCleaner.exe and select Run As Administrator unless running Windows XP where you should just double click to run the tool.
      Vista/Windows 7/8/10 users right-click and select Run As Administrator
    • Accept any prompts for permission to run and then click the I agree button to accept the Terms of Use
    • Click on the Scan button.
    • AdwCleaner will begin...be patient as the scan may take some time to complete.
    • After the scan has finished, you may just see a popup stating that no malicious programs were found. Just click OK to continue.
    • Now click the LogFile button and the report will open in Notepad.
      (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
    • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
    • Attach the logfile to your next next reply.
    • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.



    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7, Win8 or Win10, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the JRT.TXT log
    • the log from AdwCleanerlog
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  6. harvastmoon

    harvastmoon Private E-2

    Ran and attached the logs.
    1. Adaware- don't recognize anything I might want to keep.
    2. Word Docs seem to working fine.
    3. My browser still shows the SE icon (see Pic)
    4. New icons have appeared on the desktop, (see pic)
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Are you sure about this before we continue? I do see that you have Digital Coupon Printer installed. If you do not want this then you should first uninstall it before we do anything else.

    Check your browser addon's to see if there are any that you do not want. You may see "Search Engage" in the list that you can remove.

    No problems there. Just some files that used to be hidden until we had you enable viewing of hidden and system files in the Read and Run Me and a bunch of files from Word.
     
  8. harvastmoon

    harvastmoon Private E-2

    1. Deleted Digital Coupon printer... never can get anything to print out anyway!
    3. Browser extensions option will not let me uncheck the SearchEngage addon (See Pic).
     

    Attached Files:

  9. harvastmoon

    harvastmoon Private E-2

    Also just received a Java update alert so I let it update and it failed. (see pic).
     

    Attached Files:

  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay run Adware Cleaner again and this time have it cleanup all that it finds and then immediately reboot your PC after the cleanup.

    After reboot, continue with the below new scan.

    Please download the latest version of FRST the below link.

    Farbar Recovery Scan Tool and save it to your Desktop.

    Note: Make sure you download the proper version ( 32 bit or 64 bit ) for your PC. Only one will run, the correct one. So it you make a mistake and download the wrong one, go back and get the other.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your next reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
     
  11. harvastmoon

    harvastmoon Private E-2

    Attached requested Logs
     

    Attached Files:

  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Download the attached fixlist.txt file found at the bottom of this message and save fixlist.txt on your Desktop. Make sure you save it as a txt file.
    • You should now have both fixlist.txt and FRST64.exe on your Desktop.
    • Now I want you to disconnect your PC connection to the internet by unplugging the cable ( if it is wireless then temporarily shutdown the wireless network ).
    • Run FRST64.exe by right clicking on it and selecting Run As Adminstrator
    • Click the Fix button just once and wait.
    • Your computer should reboot after the fix runs.
    • Reconnect your internet connection after reboot so you can come back here to continue.
    • The tool will make a log on the Desktop (Fixlog.txt) please attach this new log to your next reply (attach or paste)
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • Fixlog.txt
    • C:\MGlogs.zip
    Please attach the above two log first before you continue with the below.

    Also at this point, I want to double check the status of Poweliks by having you run another scan with FRST like in my last message and attach the new FRST.txt log.
     

    Attached Files:

  13. harvastmoon

    harvastmoon Private E-2

    1. Ran FRST64.exe - Computer didn't reboot after running the fix.
    2. Reconnected internet and ran GetLogs.bat
    3. Attached Logs.
     

    Attached Files:

  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Are you having anymore issues with Search Engage? If yes, in which browser?
     
  15. harvastmoon

    harvastmoon Private E-2

    Yes It is still showing up in the chrome browser setting and extension tabs and still won't let me disable it.(see pics)
    Also attached the FRST log your requested in you previous post.
     

    Attached Files:

    Last edited: Apr 27, 2016
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

  17. harvastmoon

    harvastmoon Private E-2

    I reset Chrome settings and nothing changed, then I reset Chrome settings again and rebooted the computer, my home page now opens to Google but search engage in the chrome settings. same as pics from my previous post. Also when I open a new tab in Chrome it doesn't open google. (see Pic)
     

    Attached Files:

  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay then the next option that is now going to be necessary is to uninstall Chrome and delete all Chrome related folders. The reset is probably not working because there are bad things hanging around in the Chrome folders that are just reinstalling the junk! But before we try this, I have to check whether it could be for another reason. Do you use some kind of Google Sync software to synchronize Chrome between other PCs? If so this could be the cause.
     
  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    One more thing, I had noticed in previous logs that you had Firefox installed. I assume that it is also having problems! Can you delete/disable the Addon's in Firefox? If not, it may be necessary to try a reset on it first and then an uninstall! If you leave any one browser with this still enabled, it is possible that it works it way back into other browsers too.
     
  20. harvastmoon

    harvastmoon Private E-2

    Ok, I'll do these steps and let you know what happens.
     
  21. harvastmoon

    harvastmoon Private E-2

    I have a question before I begin.
    When I delete Chrome browser, will it also delete Chrome HTML documents that are on my computer?
     
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Actually see my previous messages again. I did not tell you to UNINSTALL ( not delete ) Chrome yet. I asked questions.

    But as part of the uninstall, we will be deleting the folders in which Chrome installs information. This does not remove HTML documents that are located elsewhere. But it will remove your Chrome bookmarks so you will probably want to back them up first. See the below:

    http://juan2geek.com/how-to-backup-and-restore-entire-google-chrome-setting/

    Since we will be uninstalling Firefox ( which I also asked about ), you should also backup bookmarks for Firefox if you need them. See the info in the below link:

    Reset Firefox to Defaults
     
  23. harvastmoon

    harvastmoon Private E-2

    I haven't uninstalled anything yet. Only backed up my bookmarks.
    I rarely use firefox so I am not worried about any book marks there. I will open it up and see if there is anything unusual with it.
    As far as syncing anything I have google drive and icloud sync.
     
  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay so then let's uninstall Firefox and Chrome and also i-beta.com

    Uninstall the below programs. If you do not find them or they will not uninstall, just keep going.
    Google Chrome
    Google Drive
    Google Update Helper
    i-beta.com extension
    Mozilla Firefox 43.0.4 (x86 en-US)
    Mozilla Maintenance Service

    Use only Internet Explorer for now. Let me know if you have Search Engage issues with it.

    We will be deleting all folders related to Firefox and Chrome below!

    Please download OTM by Old Timer and save it to your Desktop.
    • Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of the code box
    • Make sure that you scroll all the way to the bottom of the code box to get the whole fix!
    Code:
    :Processes
    explorer.exe
    
    
    :Files
    C:\Users\Lynda\AppData\LocalGoogle
    C:\Users\Lynda\AppData\Roaming\IObit
    C:\Users\Lynda\AppData\Local\Google
    C:\Users\Lynda\Desktop\Google Drive.lnk
    C:\ProgramData\IObit
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
    C:\Program Files (x86)\IObit
    C:\Program Files (x86)\Google\Chrome
    C:\Program Files (x86)\Google
    C:\Program Files\Mozilla Firefox
    C:\Users\Lynda\AppData\Roaming\Mozilla\Firefox
    C:\Users\Lynda\AppData\Local\Google\Chrome  
    C:\Program Files (x86)\i-beta
    C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore
    C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA
    C:\Windows\TEMP\*.*
    C:\Users\Lynda\AppData\Local\Temp\*.*
    :Commands
    [purity]
    [EmptyTemp]
    [start explorer]
    [Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
    • Now click the large [​IMG] button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.

    Now please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, Win7, 8 or 10, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7, Win8 or Win10, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • the JRT.TXT log
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  25. harvastmoon

    harvastmoon Private E-2

    OK will does this now.
     
  26. harvastmoon

    harvastmoon Private E-2

    I'm sorry but I haven't been able to perform this step yet please don't close out my post I will try to get to it sometime today thanks
     
  27. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay. I will be out of town until next Wed. Hopefully one of the other helpers here can continue with you.
     
    Kestrel13! likes this.
  28. harvastmoon

    harvastmoon Private E-2

    Finally able to get this done. Using IE and don't see any signs of SE(Search Engage) anywhere. Here are the logs.

    There is another problem which I am not sure is related but about 2 weeks ago I was not able to open yahoo emails on my iphone 5s. when I tried to open up an email to view it cycled back to the Inbox & won't go to any other folder. I was able to access yahoo email from my pc, but 2 days ago I started having yahoo email problems on the PC as well. Are these possibly related?
     

    Attached Files:

  29. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Perhaps there is an issue with Yahoo itself. It is not a malware problem.

    Your MGlogs.zip file is not updated properly. Perhaps you did not wait for it to complete before uploading the log. Please follow my previous instructions for running GetLogs.bat and attach a new MGlogs.zip file.
     
  30. harvastmoon

    harvastmoon Private E-2

    Sorry about that. here is the file.
     

    Attached Files:

  31. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That's better. :) All clean now.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your Windows version in this link: Disable And Enable System Restore
      • For Windows 8 and 8.1 system restore see this link: Win 8 System Restore - How to enable/disable
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.
    8. After doing the above, you should work thru the below link:
     
  32. harvastmoon

    harvastmoon Private E-2

    Ok, thank you so much for your help and patience. This is the first place I come to with any questions or problems.:)
    Oh one last question, since I deleted google browser and google drive can I just install them again normally?
     
  33. harvastmoon

    harvastmoon Private E-2

    I just reinstalled google chrome browser and all of my previous extensions and book marks came back including SE(Search Engage)!
     
  34. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Then I suspect that you are using Google Sync or something similar and that put the junk right back on your PC. All the more reason not to use Chrome. It is a problematic browser as far as I'm concerned. We have more problems with it and Firefox than we do IE. So do you have Chrome setup to resync with something in the cloud?
     
    Kestrel13! likes this.
  35. harvastmoon

    harvastmoon Private E-2

    I do have an iCloud account and also a Google account that I sign into but I'm not sure if it syncs. It must because when I reinstalled chrome browser everything came back, like all my bookmarks. Where do I check to see if it is syncing?
     
  36. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I suggest that you go to your sync dashboard and Stop and Clear

    • https://www.google.com/settings/chrome/sync

    • Then you will probably have to uninstall Chrome on all PCs/devices ( like smart phones,...etc ) where you use it, delete all folders ( and make sure ALL are deleted ) and once you are sure that every Chrome folder has been deleted, you can try installing again.
     
  37. harvastmoon

    harvastmoon Private E-2

    OK, I'll do that and let you know what happens.
     
  38. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'll be waiting for the results. :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds