iSearch.Claro-Search malware

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Haruhi, Sep 8, 2012.

Page 1 of 2
  1. Haruhi

    Haruhi Private E-2

    I've been lurking and someone over from Reddit sent me to this website. I've followed the directions from [1] http://forums.majorgeeks.com/showthread.php?t=265220 and it looked like the virus was gone for a while but now whenever I open a new Firefox window, it directs me to iSearch-Claro again. Every tab I Open is Claro. this is very annoying and I really need help. Thanks!
     
    Haruhi, Sep 8, 2012
    #1
  2. Haruhi

    Haruhi Private E-2

    Bump for the sake of how annoying this malware is...:cry
     
    Haruhi, Sep 8, 2012
    #2
  3. thisisu

    thisisu Malware Consultant

    Can you run the following batch file that is attached to this post?

    Let me know if it helped or not.
     

    Attached Files:

    thisisu, Sep 9, 2012
    #3
  4. Haruhi

    Haruhi Private E-2

    Um... yeah. I'm so sorry. I have no idea what to do with the .zip file you just attached. I am seriously not computer savvy. Sorry. What should I do with it?
     
    Haruhi, Sep 9, 2012
    #4
  5. thisisu

    thisisu Malware Consultant

    No problem.

    The .zip file I attached is an archive which contains a batch file called: firefox.bat. I would have just attached the .bat file to make it easier but attaching certain files, like .bat, is not allowed on the forums.

    Here is a guide on how to extract files from .zip: http://www.computerhope.com/issues/ch000506.htm

    Once you have firefox.bat on your desktop, run it by double-clicking it. ( If using Vista or Windows 7 do not double click on it but rather, right click and select Run As Administrator. )
     
    thisisu, Sep 9, 2012
    #5
  6. Haruhi

    Haruhi Private E-2

    Ok. I extracted the .zip file to my Desktop. There is an icon there with cogwheels and stuff. I right-clicked and ran as Admin. It closed my current Firefox session, I opened Firefox again with new session. Homepage was Claro-Search...yet again. :cry:cry:cry:cry
     
    Haruhi, Sep 9, 2012
    #6
  7. thisisu

    thisisu Malware Consultant

    thisisu, Sep 9, 2012
    #7
  8. thisisu

    thisisu Malware Consultant

    If the above does not work

    Please read ALL of this message including the notes before doing anything.

    Please follow the instructions in the below link:

    READ & RUN ME FIRST. Malware Removal Guide


    and then attach the requested logs to your next reply when you finish these instructions.
    • **** If something does not run, write down the info to explain to us later but keep on going. ****
    • Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.
    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:

    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes, you could use a flash drive too, but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
    * Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated - our system works the oldest threads FIRST.
    ​
     
    thisisu, Sep 9, 2012
    #8
  9. Haruhi

    Haruhi Private E-2

    Ok.. here we go. I hope. That was a lot to do right then. But I am so thankful for your help right now.
     

    Attached Files:

    Haruhi, Sep 9, 2012
    #9
  10. thisisu

    thisisu Malware Consultant

    Yes I know it is a lot of work to do.

    Download adware cleaner to your desktop.
    Open it and press Delete.
    Attach the generated log and test if the problem still exists.
     
    thisisu, Sep 9, 2012
    #10
  11. Haruhi

    Haruhi Private E-2

    Changed Homepage on Firefox to default, closed Firefox and restored sessions, Claro is STILL homepage. Wtf.

    Here's the AdwareCleaner log.

    I'm so sorry.
     

    Attached Files:

    Haruhi, Sep 9, 2012
    #11
  12. thisisu

    thisisu Malware Consultant

    What do you mean when you say this? Do not "Restore Session" as this will always bring you back to the page you were previously viewing.

    Please close FireFox properly, and then open FireFox and choose the option that is NOT "Restore Session", I think the correct choice is "Go to HomePage".

    If you have questions let me know. Don't worry about apologizing I'm here to help :)

    If you are still having issues:

    [​IMG] Please download OTL by OldTimer.

    • Save it to your desktop.
    • Right mouse click on the OTL icon on your desktop and select Run as Administrator
    • Check the "Scan All Users" checkbox.
    • Check the "Standard Output".
    • Change the setting of "Drivers" and "Services" to "All"
    • Copy the text in the code box below and paste it into the [​IMG] text-field.
      Code:
      activex
netsvcs
    • Now click the [​IMG] button.
    • One report will be created:
      • OTL.txt <-- Will be opened
    • Attach OTL.txt to your next message. (How to attach)
     
    thisisu, Sep 9, 2012
    #12
  13. Haruhi

    Haruhi Private E-2

    Ok, sorry for the confusion. Opening a brand new Firefox after properly closing it is what I meant.

    Problems are still arising. Here's the OTL log.

    EDIT: There was an Extras.txt log. I'll attach it.
     

    Attached Files:

    Last edited: Sep 9, 2012
    Haruhi, Sep 9, 2012
    #13
  14. thisisu

    thisisu Malware Consultant

    [​IMG] Fix items using OTL by OldTimer

    Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
    Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
    Copy the text in the code box below and paste it into the [​IMG] text-field.
    Code:
    [COLOR="DarkRed"]:otl[/COLOR]
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{62A95860-F05D-4F3A-98FE-DB7AB361FBBA}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
IE - HKLM\..\SearchScopes\{62A95860-F05D-4F3A-98FE-DB7AB361FBBA}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-21-1553210162-1582565319-2532465683-1000\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - No CLSID value found
IE - HKU\S-1-5-21-1553210162-1582565319-2532465683-1000\..\URLSearchHook: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - No CLSID value found
IE - HKU\S-1-5-21-1553210162-1582565319-2532465683-1000\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-21-1553210162-1582565319-2532465683-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://isearch.claro-search.com/?q={searchTerms}&affID=115131&tt=120812_bandext_3312_8&babsrc=SP_iclro&mntrId=e8cf4a6a000000000000062100e11362
IE - HKU\S-1-5-21-1553210162-1582565319-2532465683-1000\..\SearchScopes\{62A95860-F05D-4F3A-98FE-DB7AB361FBBA}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
FF - prefs.js..browser.search.defaultenginename: "Claro Search"
FF - prefs.js..browser.search.order.1: "Claro Search"
FF - prefs.js..browser.search.selectedEngine: "Claro Search"
FF - prefs.js..browser.startup.homepage: "http://isearch.claro-search.com/?affID=115131&tt=120812_bandext_3312_8&babsrc=HP_iclro&mntrId=e8cf4a6a000000000000062100e11362"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.1
FF - prefs.js..extensions.enabledItems: youtubedownloader@mybrowserbar.com:4.1
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..searchreset.backup.browser.search.defaultenginename: "Claro Search"
FF - prefs.js..browser.startup.homepage: "http://isearch.claro-search.com/?affID=115131&tt=120812_bandext_3312_8&babsrc=HP_iclro&mntrId=e8cf4a6a000000000000062100e11362"
[2012/05/08 11:24:48 | 000,401,328 | ---- | M] () (No name found) -- C:\Users\Sean and Luann\AppData\Roaming\Mozilla\Firefox\Profiles\rtdkppf8.default\extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi
[2012/09/09 01:32:14 | 000,001,649 | ---- | M] () (No name found) -- C:\Users\Sean and Luann\AppData\Roaming\Mozilla\Firefox\Profiles\rtdkppf8.default\extensions\searchreset@gavinsharp.com.xpi
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-21-1553210162-1582565319-2532465683-1000\..\Toolbar\WebBrowser: (no name) - {687578B9-7132-4A7A-80E4-30EE31099E03} - No CLSID value found.
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2011/04/19 02:32:47 | 000,012,148 | -HS- | C] () -- C:\Users\Sean and Luann\AppData\Local\s121uq0at7k5v60wwl08sp5t287if7yru6nw52
[2011/04/19 02:32:47 | 000,012,148 | -HS- | C] () -- C:\ProgramData\s121uq0at7k5v60wwl08sp5t287if7yru6nw52
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:0B4227B4
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:D1B5B4F1
[COLOR="DarkRed"]:files[/COLOR]
C:\Users\Sean and Luann\AppData\Roaming\Microsoft\Windows\Templates\s121uq0at7k5v60wwl08sp5t287if7yru6nw52
dir "C:\Users\Sean and Luann\AppData\Local\{066F66F2-32B4-4407-AC17-FB88FF06EBD9}" /c
[COLOR="DarkRed"]:reg[/COLOR]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{62A95860-F05D-4F3A-98FE-DB7AB361FBBA}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{62A95860-F05D-4F3A-98FE-DB7AB361FBBA}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
[COLOR="DarkRed"]:commands[/COLOR]
[clearallrestorepoints]
[emptytemp]
    Now click the [​IMG] button.
    If the fix needed a reboot please do it.
    Click the OK button (upon reboot).
    When OTL is finished, Notepad will open. Close Notepad.
    A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
    Attach this log to your next message. (How to attach)
     
    thisisu, Sep 9, 2012
    #14
  15. Haruhi

    Haruhi Private E-2

    Here is the OTL log.
    Claro is still interfering on my PC.
     

    Attached Files:

    Haruhi, Sep 9, 2012
    #15
  16. thisisu

    thisisu Malware Consultant

    • Can you open FireFox, then type the following into the browser bar:
      • about:config
    • Press ENTER.
    • Choose the "I'll be careful I promise" option.
    • In the Search: field, type in:
      • claro
    • Then view the Preference Name column and copy the Preference names here for me to review, or post a screenshot if that is easier. http://take-a-screenshot.org/
     
    thisisu, Sep 9, 2012
    #16
  17. Haruhi

    Haruhi Private E-2

    Here's the SS
     

    Attached Files:

    Haruhi, Sep 9, 2012
    #17
  18. thisisu

    thisisu Malware Consultant

    Right mouse click each of those values and select "Reset" from the menu.
     
    thisisu, Sep 10, 2012
    #18
  19. Haruhi

    Haruhi Private E-2

    When I do that and close Firefox properly and open it again, my homepage/tabs are all Claro-Search.com still. :confused:confused:confused:confused:confused:cry:cry:cry:cry:cry:cry
     
    Haruhi, Sep 10, 2012
    #19
  20. thisisu

    thisisu Malware Consultant

    I was hoping we wouldn't have to be so drastic in handling this but try this one next:

    • Open FireFox, then type the following into the browser bar:
      • about:support
    • Press ENTER.
    • Look to your right to locate and press the "Reset FireFox" button.
    • A little confirmation pop-up should appear, simply press "Reset FireFox" again.

    Let me know if this helped at all.
     
    thisisu, Sep 10, 2012
    #20
  21. Haruhi

    Haruhi Private E-2

    thisisu! Finally cleared up!!! Wow... seriously. thank you. A MILLION times thank you. I really put you through the ringer and I'm sorry about that! I Was getting so worried we'd never get rid of it!!! Ahhhhh. FINALLY!! Some relief. Thank you again, thisisu. Seriously. Thank you...

    I'm not sure if this is customary but is there anyway I can pay you specifically? Paypal account or something? What you just did for me, the amount of labor and such, would have cost me money anywhere else. I feel very guilty. Please, allow me the small pleasure of somehow repaying you?
     
    Haruhi, Sep 10, 2012
    #21
  22. thisisu

    thisisu Malware Consultant

    You're welcome :)

    If you are not having any other malware related problems, it is time to do our final steps:
    • Any programs we had you download and/or install can be removed at this time.
    • If we had you download and run ComboFix, here is how to uninstall it:
      • Press and hold the Windows key [​IMG] and then press the letter R on your keyboard.
      • This opens the Run dialog box.
      • Copy and paste the below text inside the text-field:
        • "%userprofile%\desktop\ComboFix" /uninstall
      • Now press ENTER
      • ComboFix will extract its files one last time and you should receive a notification that ComboFix has been uninstalled shortly after.
    • You can re-enable your Disk Emulation software at this time via DeFogger.
    • If we had you create or download a registry patch or "fix" script, these can be deleted at this time.
    • Go into the C:\MGtools folder and run the MGclean.bat file to remove additional traces of our tools.
    • Now we will toggle System Restore to remove any infected system restore points.
    • Lastly, here is a guide to protect you from future infections: How to Protect yourself from malware!
    • Be safe :)

    I don't even have a Paypal account but thanks for the offer. Don't feel guilty, I'm glad I was able to help :) It is satisfying enough to me.
     
    thisisu, Sep 10, 2012
    #22
  23. Haruhi

    Haruhi Private E-2

    thisisu...I don't even know what to say.

    It came back. It was cleared for almost the whole night and almost all of this morning. But before I went to bed I opened Firefox and my homepage was Claro search engine. Seriously, what a huge let down. I could've sworn resetting Firefox would've done it.


    I'm sorry. What should we do now? God dammit...
     
    Haruhi, Sep 10, 2012
    #23
  24. thisisu

    thisisu Malware Consultant

    Hello, sorry to hear that happened. Let me try to see what happened. Complete the below scans:

    [​IMG] Now download the latest MGtools.exe to the root of your c: drive.
    • Replace your existing MGtools.exe with this one.
    • Now run this new MGtools.exe by double-clicking it. (Vista/7 right-click and select Run as Administrator)
    • When it is finished, attach c:\MGlogs.zip to your next message. (How to attach)

    __

    [​IMG] Please download OTL by OldTimer.

    • Save it to your desktop.
    • Right mouse click on the OTL icon on your desktop and select Run as Administrator
    • Check the "Scan All Users" checkbox.
    • Check the "Standard Output".
    • Change the setting of "Drivers" and "Services" to "All"
    • Copy the text in the code box below and paste it into the [​IMG] text-field.
      Code:
      activex
netsvcs
    • Now click the [​IMG] button.
    • One report will be created:
      • OTL.txt <-- Will be opened
    • Attach OTL.txt to your next message. (How to attach)
     
    thisisu, Sep 10, 2012
    #24
  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Sometimes the easiest way to remove these kinds of issues from Firefox is to do a clean install of Firefox. This means Firefox needs to be completely uninstalled and folders MUST be deleted before resinstalling. I also saw signs of Babylon and Relevant Knowledge in your logs.

    C:\Program Files (x86)\RelevantKnowledge
    C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
     
    chaslang, Sep 10, 2012
    #25
  26. Haruhi

    Haruhi Private E-2

    Here you go
     

    Attached Files:

    Haruhi, Sep 10, 2012
    #26
  27. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Uninstall this >> Anti-phishing Domain Advisor



    We are going to be uninstalling your old version of FireFox and installing the new version. So do the below to save bookmarks:
    • Run FireFox and click Bookmarks.
    • Then select Organize Bootmarks.
    • Then on the next window click File and then select Export. Save the bookmarks.html file to your Desktop for later use in importing.
    Now download and save the installer for the current version of FireFox but DO NOT install it yet. Wait until I tell you to reinstall. Get it here: Mozilla Firefox 15.0.1 Final

    You will need exit FireFox now and use Internet Explorer to continue with the below until we reinstall FireFox.


    Now uninstall FireFox



    Now shut down your protection software (antivirus, antispyware...etc) to avoid possible conflicts.
    • Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
    • Copy the text in the code box below and paste it into the [​IMG] text-field.
    Code:
    :OTL
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = [URL]http://isearch.claro-search.com/?q={searchTerms}&affID=115131&tt=120812_bandext_3312_8&babsrc=SP_iclro&mntrId=e8cf4a6a000000000000062100e11362[/URL]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6E19037A-12E3-4295-8915-ED48BC341614}: C:\Program Files (x86)\RelevantKnowledge
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/09 17:56:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/09/09 01:52:39 | 000,000,000 | ---D | M]
CHR - Extension: Yontoo = C:\Users\Sean and Luann\AppData\Local\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlc\1.0.2_0\
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC)
O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security))
[2012/09/09 17:56:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012/09/09 12:30:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Yontoo
[2012/09/09 12:30:06 | 000,000,000 | ---D | C] -- C:\Users\Sean and Luann\AppData\Local\antiphishing-vmninternethelper1_1dn
[2012/09/09 12:30:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Anti-phishing Domain Advisor
[2012/09/09 12:29:48 | 000,000,000 | ---D | C] -- C:\Users\Sean and Luann\AppData\Roaming\Babylon
[2012/09/09 12:29:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012/09/08 12:05:25 | 000,000,000 | ---D | C] -- C:\Users\Sean and Luann\AppData\Local\{066F66F2-32B4-4407-AC17-FB88FF06EBD9}
:Files
C:\Program Files (x86)\RelevantKnowledge
C:\Users\Sean and Luann\AppData\Roaming\Mozilla
C:\Program Files (x86)\Mozilla Firefox
:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{6E19037A-12E3-4295-8915-ED48BC341614}"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
:Commands
[PURITY]
[EMPTYTEMP] 
[EMPTYFLASH]
[REBOOT]
    • Now click the [​IMG] button.
    • If the fix needed a reboot please do it.
    • Click the OK button (upon reboot).
    • When OTL is finished, Notepad will open. Close Notepad.
    • A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
    • Attach this log to your next message. (See: How to attach)

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • the log from OTL
    • C:\MGlogs.zip
    Now reinstall FireFox from the file previously downloaded.
    Import your bookmarks file. (similar process to exporting).

    Make sure you tell me how things are working now!
     
    chaslang, Sep 10, 2012
    #27
  28. Haruhi

    Haruhi Private E-2

    Here's the logs. Re-installed Firefox, I didn't even import the bookmarks yet and my homepage is still Claro. This seems serious... what are the steps now?
     

    Attached Files:

    Haruhi, Sep 10, 2012
    #28
  29. thisisu

    thisisu Malware Consultant

    Code:
    ========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
    Ignore the above, they are just notes for us.

    Can you double-check that the problem exists in Internet Explorer as well?

    __

    [​IMG] Download SystemLook from one of the links below and save it to your desktop.
    Download Mirror #1
    Download Mirror #2

    If you have a 64-bit system, please download the 64 bit version from here:
    SystemLook (64-bit)

    • Double-click SystemLook.exe to run it.
    • Copy and Paste the content of the following code box into the main text-field:
    Code:
    [COLOR="DarkRed"]:regfind[/COLOR]
{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
*isearch*
[COLOR="DarkRed"]:filefind[/COLOR]
*claro*
[COLOR="DarkRed"]:folderfind[/COLOR]
Anti-phishing*
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan and a file entitled SystemLook.txt will be created on your desktop.
    • Attach that file to your next message. (How to attach)
     
    thisisu, Sep 11, 2012
    #29
  30. Haruhi

    Haruhi Private E-2

    Here's the SystemLook log.


    IE has been running fine. There have been no traces of Claro on it or Chrome for that matter.
     

    Attached Files:

    Haruhi, Sep 11, 2012
    #30
  31. thisisu

    thisisu Malware Consultant

    [​IMG] Fix items using OTL by OldTimer

    Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
    Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
    Copy the text in the code box below and paste it into the [​IMG] text-field.
    Code:
    [COLOR="DarkRed"]:files[/COLOR]
C:\Users\Sean and Luann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_info.claro-search.com_0.localstorage
C:\Users\Sean and Luann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_info.claro-search.com_0.localstorage-journal
C:\Users\Sean and Luann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_isearch.claro-search.com_0.localstorage
C:\Users\Sean and Luann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_isearch.claro-search.com_0.localstorage-journal
C:\Users\Sean and Luann\AppData\Roaming\wklnhst.dat
C:\ProgramData\McAfee
C:\ProgramData\Norton
C:\ProgramData\Tarma Installer
C:\ProgramData\Browser Manager
C:\Windows\is-NJ7MA.exe
C:\Windows\is-NJ7MA.lst
c:\Windows\is-NJ7MA.msg
[COLOR="DarkRed"]:reg[/COLOR]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"BrowserMngrDefaultScope"=-
[HKEY_USERS\S-1-5-21-1553210162-1582565319-2532465683-1000\Software\Microsoft\Internet Explorer\SearchScopes]
"BrowserMngrDefaultScope"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
[-HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
[-HKEY_USERS\S-1-5-21-1553210162-1582565319-2532465683-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
[-HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
[COLOR="DarkRed"]:commands[/COLOR]
[clearallrestorepoints]
[emptytemp]
[resethosts]
    Now click the [​IMG] button.
    If the fix needed a reboot please do it.
    Click the OK button (upon reboot).
    When OTL is finished, Notepad will open. Close Notepad.
    A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
    Attach this log to your next message. (How to attach)
     
    thisisu, Sep 11, 2012
    #31
  32. Haruhi

    Haruhi Private E-2

    The log.
     

    Attached Files:

    Haruhi, Sep 11, 2012
    #32
  33. thisisu

    thisisu Malware Consultant

    [​IMG] Now run C:\MGtools\GetLogs.bat by right-mouse clicking it and then selecting Run as Administrator
    This updates all of the logs inside MGlogs.zip.
    When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

    __

    Claro still present?
     
    thisisu, Sep 11, 2012
    #33
  34. Haruhi

    Haruhi Private E-2

    Waited til after MGTools to check for Claro on Firefox; still there.


    Currently using Chrome for the time being.
    Attached: MGtools log
     

    Attached Files:

    Haruhi, Sep 11, 2012
    #34
  35. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay then there may be an issue with the registry being locked because the below should have been deleted by OTL but they were not
    Please uninstall Firefox and this time do not reinstall yet until we specifically ask you to do so.
    Also make sure that this gets uninstall too >> Mozilla Maintenance Service

    Be patient while doing the below. The fixes can take quite awhile to run. Especially the permissions repairs. It may be best to kick it off and goto bed or do something else. It is better not to run anything while the repairs are going on.



    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.
    Now please re-run the last OTL fix ( in message # 31 ) that thisisu gave to you.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Make sure that you run GetLogs.bat and not the below which you need to delete:
    C:\Users\Sean and Luann\Desktop\Anti-Malware and Virus\MGtools.exe


    Then attach the below logs:
    • the log from OTL
    • C:\MGlogs.zip
    Again DO NOT reinstall Firefox yet. We must make sure all left overs from Firefox and the iclaro stuff is removed first.
     
    Last edited: Sep 11, 2012
    chaslang, Sep 11, 2012
    #35
  36. Haruhi

    Haruhi Private E-2

    The logs are here.
     

    Attached Files:

    Haruhi, Sep 11, 2012
    #36
  37. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    MGtools should not be getting run while OTL is still running. Per your log you had the below running which is also not where OTL.exe should be located.

    C:\Users\Sean and Luann\Desktop\Anti-Malware and Virus\OTL(1).exe

    When we say to put something on your Desktop it means directly in the Desktop folder and not a subfolder.

    Did your PC reboot after running the OTL fix? If not, then please reboot and then run C:\MGtools\GetLogs.bat and attach the new MGlogs.zip. The last logs still showed the same registry entries were not removed by OTL. It may be necessary to uninstall ALL of AVG to fix this as it is possibly that it is getting in the way of the fix.

    Also is your copy of Malwarebytes a paid/licensed version?
     
    chaslang, Sep 11, 2012
    #37
  38. Haruhi

    Haruhi Private E-2

    Ok. Sorry about all that.

    Yes, my MalwareBytes is paid and licensed. Also, did you want me to run MGTools again before or after uninstalling AVG?

    EDIT: And yes, I waited to boot my PC until MGTools was finished.
     
    Last edited: Sep 11, 2012
    Haruhi, Sep 11, 2012
    #38
  39. Haruhi

    Haruhi Private E-2

    Well I uninstalled AVG fully before running MGTools yet again. Here's the log.
     

    Attached Files:

    Haruhi, Sep 11, 2012
    #39
  40. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    All of AVG did not uninstall. The secure search stuff is still present and so is a driver that tries to block the changes to home page and search pages. The fix below will attempt to remove more of this AVG stuff which may be getting in our way.

    Uninstall the below
    Yontoo 1.10.02

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O23 - Service: RelevantKnowledge - Unknown owner - C:\Program Files (x86)\RelevantKnowledge\rlservice.exe (file missing)
    O23 - Service: vToolbarUpdater12.2.6 - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe

    After clicking Fix, exit HJT.

    Now please reboot into safe boot mode to run the below.

    Now shut down your protection software (antivirus, antispyware...etc) to avoid possible conflicts.
    • Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
    • Copy the text in the code box below and paste it into the [​IMG] text-field.
    Code:
    :Services
RelevantKnowledge
vToolbarUpdater12.2.6
:Files
C:\Users\Sean and Luann\AppData\Roaming\Mozilla
C:\Windows\SysNative\drivers\avgtpx64.sys
C:\Program Files (x86)\AVG Secure Search
C:\ProgramData\AVG2012
C:\Program Files (x86)\AVG
C:\Program Files (x86)\Common Files\AVG Secure Search
:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"=-
[HKEY_LOCAL_MACHINE\software\Wow6432Node\microsoft\windows\currentVersion\Run]
"vProt"=-
"HP Software Update"=-
"ROC_roc_dec12"=-
"ROC_ROC_JULY_P1"=-
"SunJavaUpdateSched"=-
[HKEY_USERS\S-1-5-21-1553210162-1582565319-2532465683-1000\Software\Microsoft\Windows\CurrentVersion\run]
"uTorrent"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
"PendingFileRenameOperations"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"BrowserMngrDefaultScope"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
"DisplayName"=-
"URL"=-
"SuggestionsURLFallback"=-
"FaviconURL"=-
"SuggestionsURL"=-
"Key"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
:Commands
[PURITY]
[EMPTYTEMP] 
[EMPTYFLASH]
[REBOOT]
    • Now click the [​IMG] button.
    • If the fix needed a reboot please do it.
    • Click the OK button (upon reboot).
    • When OTL is finished, Notepad will open. Close Notepad.
    • A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
    • Attach this log to your next message. (See: How to attach)

    If your PC did not reboot after running the above OTL fix, then please reboot and reboot into normal mode to continue with the below.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the log from OTL
    • C:\MGlogs.zip
     
    chaslang, Sep 11, 2012
    #40
  41. Haruhi

    Haruhi Private E-2

    Here you go.
     

    Attached Files:

    Haruhi, Sep 11, 2012
    #41
  42. thisisu

    thisisu Malware Consultant

    Nice Chaslang, so it was RelevantKnowledge that was regenerating the iClaro homepage? Latest runkeys look good :)
     
    thisisu, Sep 11, 2012
    #42
  43. Haruhi

    Haruhi Private E-2

    So I should re-install Firefox and try again?
     
    Haruhi, Sep 11, 2012
    #43
  44. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Proably not. It would more likely be that AVG was getting in the way of removal.

    Yes try reinstalling Firefox now and let's see what happens.
     
    chaslang, Sep 12, 2012
    #44
  45. Haruhi

    Haruhi Private E-2

    Still there.
     
    Haruhi, Sep 12, 2012
    #45
  46. thisisu

    thisisu Malware Consultant

    thisisu, Sep 12, 2012
    #46
  47. Haruhi

    Haruhi Private E-2

    Performed that step again.

    Still there. Getting depressed now...:cry
     
    Haruhi, Sep 12, 2012
    #47
  48. thisisu

    thisisu Malware Consultant

    Can you complete the SystemLook instructions here again?

    By the way, do you know where you obtained this infection? If it was a specific website, can you create and attach a text file to your next message with the site that infected you?
     
    thisisu, Sep 12, 2012
    #48
  49. Haruhi

    Haruhi Private E-2

    I have no idea how or where I acquired Claro. I really don't visit many shady places. I do have one website where I watch episodes of shows I Can't get on TV and the website is usually full of pop-ups, but it doesn't ask me to download anything or change my settings.

    www.watchseries.eu

    Attached is the log.
     

    Attached Files:

    Haruhi, Sep 12, 2012
    #49
  50. thisisu

    thisisu Malware Consultant

    We normally do not do this but since this type of hijack is becoming more prevalent and you are still having issues, I'm offering to remote into your computer and try to fix the problem (should be faster if I can see it first hand); if you are interested in this (no problem if you're not) download and install TeamViewer from here and attach YOUR TEAMVIEWER ID and PASSWORD in a text file. I'll remove the attachment once I have it.

    I'll be around for a few hours (currently it is 2:16PM CST).
     
    thisisu, Sep 12, 2012
    #50
Page 1 of 2

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds