Delta Search?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Verlanderfan, Jul 27, 2013.

  1. Verlanderfan

    Verlanderfan Private E-2

    I have a new (to me, but technically used) computer, and every time I open Firefox, Delta Search appears instead of Google. It's a Toshiba Satellite C655D with 64-bit Windows 7. I already went through the Read and Run Me First procedure. Attached to this post are the logs and reports from the different scans, except for the Hitmanpro log, which I got this error in trying to upload:

    "HitmanPro_20130727_1150.log:

    Your file of 488.1 KB bytes exceeds the forum's limit of 375.0 KB for this filetype."
     

    Attached Files:

  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Rerun RogueKiller and on the scheduled tasks tab please have it fix these entries:

    • ¤¤¤ Scheduled tasks : 3 ¤¤¤
    • [V1][ROGUE ST] Safe Saver-chromeinstaller.job : C:\Program Files (x86)\Safe Saver\Safe Saver-chromeinstaller.exe - /installcrx /agentregpath='Safe Saver' /extensionfilepath='C:\Program Files (x86)\Safe Saver\33254.crx' /appid=33254 /srcid='000198' /subid='0' /zdata='0' /bic=D32E92C9483A4E8E9F8AF5521E5EEBB7IE /verifier=46ee49152e94c651abd98d46c78a9f02 /installerversion=1_27_153 /installerfullversion=1.27.153.8 /installationtime=1374356881 /statsdomain=hxxp://stats.statsdatasrv.com /errorsdomain=hxxp://errors.statsdatasrv.com /waitforbrowser=300 /extensionid=mehnejgknjfgfdmijlaloodhdgnbgdgn /extensionversion=1.23.29 /extensionpublickey=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDh8zr3vZG2sEyTC0s09rpLQje4YuZMMcPUWbgJ8HLXy085wOJzhmtrMQzxRhBa9NGavjCnLFH9h6NTZnpKa317RRUFOVrat+pOLMxCox+qPZgLyHgk91mjc/6MjTnesAmSt9BKY4egsqAuIxOiE+kX6vDyqXceiz/QXQKhg4WqSQIDAQAB /allusers /allprofiles /externallog='' [7][x][x][x][x][x][x][x] -> FOUND
    • [V2][SUSP PATH] EPUpdater : C:\Users\ramos\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe [-] -> FOUND
    • [V2][ROGUE ST] Safe Saver-chromeinstaller : C:\Program Files (x86)\Safe Saver\Safe Saver-chromeinstaller.exe - /installcrx /agentregpath='Safe Saver' /extensionfilepath='C:\Program Files (x86)\Safe Saver\33254.crx' /appid=33254 /srcid='000198' /subid='0' /zdata='0' /bic=D32E92C9483A4E8E9F8AF5521E5EEBB7IE /verifier=46ee49152e94c651abd98d46c78a9f02 /installerversion=1_27_153 /installerfullversion=1.27.153.8 /installationtime=1374356881 /statsdomain=hxxp://stats.statsdatasrv.com /errorsdomain=hxxp://errors.statsdatasrv.com /waitforbrowser=300 /extensionid=mehnejgknjfgfdmijlaloodhdgnbgdgn /extensionversion=1.23.29 /extensionpublickey=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDh8zr3vZG2sEyTC0s09rpLQje4YuZMMcPUWbgJ8HLXy085wOJzhmtrMQzxRhBa9NGavjCnLFH9h6NTZnpKa317RRUFOVrat+pOLMxCox+qPZgLyHgk91mjc/6MjTnesAmSt9BKY4egsqAuIxOiE+kX6vDyqXceiz/QXQKhg4WqSQIDAQAB /allusers /allprofiles /externallog='' [7][x][x][x][x][x][x][x] -> FOUND
    Now delete these folders if they show:

    C:\Program Files (x86)\Safe Saver
    C:\Users\ramos\AppData\Roaming\BABSOL~1


    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.
     
  3. Verlanderfan

    Verlanderfan Private E-2

    Could you please clarify? There doesn't appear to be a tab that says "scheduled tasks" on Roguekiller Do you mean the Registry tab?
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please run the below procedure instead.

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.delta-search.com/?babsrc=HP_ss&mntrId=966B00266C580CE2&affID=119351&tsp=4949
    O2 - BHO: CrossriderApp0033254 - {11111111-1111-1111-1111-110311321154} - C:\Program Files (x86)\Safe Saver\Safe Saver-bho.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search.com Bar - {9f85f783-362b-4373-afb4-4999ef33aa35} - C:\Program Files (x86)\searchcom_004\searchcom_002X.dll
    O2 - BHO: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll
    O3 - Toolbar: Search.com Bar - {9f85f783-362b-4373-afb4-4999ef33aa35} - C:\Program Files (x86)\searchcom_004\searchcom_002X.dll
    O3 - Toolbar: Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll
    O4 - HKLM\..\Run: [Anti-phishing Domain Advisor] "C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe"
    O23 - Service: BrowserDefendert - Unknown owner - C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe

    After clicking Fix, exit HJT.

    Now uninstall the below Programs:
    BrowserDefender
    Delta Chrome Toolbar
    Delta toolbar
    Java(TM) 6 Update 17
    Safe Saver
    Search.com Bar

    Now install the current version of Sun Java from: Sun Java Runtime Environment Make sure that when you see the form asking about installing Ask Toolbar that you uncheck this.



    Please download OTM by Old Timer and save it to your Desktop.
    • Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    Code:
    :Processes
    explorer.exe
     
    :Services
    BrowserDefendert
     
    :Files
    C:\Users\ramos\AppData\Roaming\Babylon
    C:\Users\rAll Users\AppData\Roaming\Babylon
    C:\Users\ramos\AppData\Roaming\BabSolution
    C:\ProgramData\Anti-phishing Domain Advisor
    C:\ProgramData\BrowserDefender
    C:\Program Files (x86)\Delta
    C:\Program Files (x86)\Safe Saver
    C:\windows\tasks\Safe Saver-chromeinstaller.job
    C:\windows\tasks\Safe Saver-codedownloader.job
    C:\windows\tasks\Safe Saver-enabler.job
    C:\windows\tasks\Safe Saver-updater.job
    C:\Users\ramos\AppData\Local\Temp\*.*
     
    :Reg
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
    "Anti-phishing Domain Advisor"=-
    [HKEY_LOCAL_MACHINE\software\Wow6432Node\microsoft\windows\currentVersion\Run]
    "Anti-phishing Domain Advisor"=-
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
    "DefaultScope"="{99BB46F7-037A-423F-B7B7-48595D52948D}"
    "bProtectorDefaultScope"=-
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{4ED63B50-3978-4B36-918A-936F0E0C5877}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311321154}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9f85f783-362b-4373-afb4-4999ef33aa35}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{9f85f783-362b-4373-afb4-4999ef33aa35}"=-
    "{82E1477C-B154-48D3-9891-33D83C26BCD3}"=-
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
    "Tabs"="res://ieframe.dll/tabswelcome.htm"
    :Commands
    [purity]
    [EmptyTemp]
    [start explorer]
     
    
    [Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large [​IMG] button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.



    Now please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
    Now run a new scan with Hitman Pro and save a new log to attach.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).



    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • the JRT.TXTlog
    • the Hitman Prolog. If it is still too large, compress it into a ZIP file and attach that.
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  5. Verlanderfan

    Verlanderfan Private E-2

    Okay, I've uninstalled all from the list of programs that I was supposed to uninstall except BrowserDefender, but it's not showing up on my Uninstaller program. I can, however, find it on the program data file. Should I just delete it?
     
  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

  7. Verlanderfan

    Verlanderfan Private E-2

    It doesn't appear to show up on Revo Uninstaller's list of uninstallable programs.
     
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Just continue on with the rest of the instructions. ;)
     
  9. Verlanderfan

    Verlanderfan Private E-2

    There's definitely visible progress: The Delta Search dealio seems to be off of Firefox and Internet Explorer, but it's still present on Chrome. Also, I got three of the files to upload, but despite the fact that I'm certain I've run it since the last instruction to do so, the MGlogs file wouldn't upload, and the explanation that it gave for this was that I've already uploaded it to this thread. Should I try running it again to make sure that it's sufficiently recent?
     

    Attached Files:

  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You need to attach the correct text file log from Hitman. That was not a log. It was a link to a file.

    You did not follow the instructions to run C:\MGtools\GetLogs.bat If you had run this, you would have a new log.
     
  11. Verlanderfan

    Verlanderfan Private E-2

    Sorry, apparently I missed the specifics of the MGtools portion of the message the first time around.

    With regard to the Hitman Pro log: Please excuse my technical-tardedness, but if that wasn't the correct file, than I can't seem to find it. The only two Hitman Pro files that I can find are the log (which is too large to upload), and the evidently incorrect one which I've uploaded most recently, which I thought was just a compressed version of the file that was too large. Assuming that I've already compressed the log which is too large, where would I find the version which is both correct and small enough?
     

    Attached Files:

  12. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    If you have already compressed the log that is too large (the one we need to see) then you should have no troubles attaching it to a post in this forum. If you cannot find the log that you compressed, simply run the tool again, (check the tutorial for running ;)) and then try again.
     
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The correct log file is on the Desktop

    ----a-w 499,794 2013-07-27 15:50:38 C:\Users\ramos\Desktop\HitmanPro_20130727_1150.log

    The problem is that the ZIP file that was created and attached ( this one )

    ----a-w 3,018 2013-07-29 22:55:49 C:\Users\ramos\Desktop\HitmanPro_20130727_1150.log.zip

    Did not put the log file into the ZIP file. It put a link to the log file in the ZIP which is not going to do us any good since we cannot link to the user's Desktop ;)
     
  14. Verlanderfan

    Verlanderfan Private E-2

    Sorry this is so late, I've been a bit occupied. Attached should be the newly compressed, correct Hitman log.
     

    Attached Files:

  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay many of those items shown the Hitman log were fix by my previous fix. So please run a new scan with Hitman Pro and attach a new log. It should hopefully be much much smaller and easy to attach now.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds