Remove Claro-search engine?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by FMLsrsly, Jul 30, 2012.

  1. FMLsrsly

    FMLsrsly Private E-2

    Hi,

    I was stupid to install something that started this problem and now I need help.
    I've Google.com set as my home page on FireFox but I'm experiencing problems when opening new tabs because it opens this page: isearch.claro-search.com/?affID=114164&tt=3012_5&babsrc=NT_iclro&mntrId=9cc67150000000000000001e8ca94e64 . This shit is also opening on other internet browsers, like Google Chrome together with a new google tab.

    How do I remove it? Help would be very much appreciated since I suck at computers. And english.
     
  2. thisisu

    thisisu Malware Consultant

    Hello FMLsrsly :)

    [​IMG] Please download OTL by OldTimer.

    • Save it to your desktop.
    • Double click on the OTL icon on your desktop.
    • Check the "Scan All Users" checkbox.
    • Check the "Standard Output".
    • Change the setting of "Drivers" and "Services" to "All"
    • Copy the text in the code box below and paste it into the [​IMG] text-field.
      Code:
      activex
      netsvcs
      /md5start
      afd.sys
      i8042prt.sys
      ipsec.sys
      netbt.sys
      svchost.exe
      tcpip.sys
      /md5stop
      %windir%\$ntuninstallkb*. /30
      %windir%\system32\drivers\*.sys /lockedfiles
      
    • Now click the [​IMG] button.
    • One report will be created:
      • OTL.txt <-- Will be opened
    • Attach OTL.txt to your next message. (How to attach)
     
  3. FMLsrsly

    FMLsrsly Private E-2

    Hi,
    I've done everything you wrote and here's the OTL.txt
     

    Attached Files:

    • OTL.Txt
      File size:
      169.7 KB
      Views:
      28
    Last edited by a moderator: Aug 2, 2012
  4. thisisu

    thisisu Malware Consultant

    [​IMG] From Add/Remove Programs (via Control Panel), please uninstall the below:
    • Java(TM) 6 Update 30

    [​IMG] Fix items using OTL by OldTimer

    Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
    Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
    Copy the text in the code box below and paste it into the [​IMG] text-field.
    Code:
    [COLOR="DarkRed"]:otl[/COLOR]
    IE - HKU\S-1-5-21-1659004503-1644491937-1417001333-1004\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://isearch.claro-search.com/?q={searchTerms}&affID=114164&tt=3012_5&babsrc=SP_iclro&mntrId=9cc67150000000000000001e8ca94e64
    IE - HKU\S-1-5-21-1659004503-1644491937-1417001333-1004\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://blekko.com/?source=c3348dd4&tbp=rbox&q={searchTerms}
    FF - prefs.js..browser.search.defaultenginename: "Claro Search"
    FF - prefs.js..browser.search.order.1: "Claro Search"
    FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=616163&ilc=12"
    FF - prefs.js..keyword.URL: "http://isearch.claro-search.com/?affID=114164&tt=3012_5&babsrc=KW_iclro&mntrId=9cc67150000000000000001e8ca94e64&q="
    [2012-07-26 14:04:00 | 000,006,531 | ---- | M] () -- C:\Program\mozilla firefox\searchplugins\babylon.xml
    [2011-12-16 23:14:50 | 000,002,067 | ---- | M] () -- C:\Program\mozilla firefox\searchplugins\blekkotb.xml
    CHR - homepage: http://isearch.claro-search.com/?affID=114164&tt=3012_5&babsrc=HP_iclro&mntrId=9cc67150000000000000001e8ca94e64
    CHR - homepage: http://isearch.claro-search.com/?affID=114164&tt=3012_5&babsrc=HP_iclro&mntrId=9cc67150000000000000001e8ca94e64
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
    O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
    [2012-07-26 14:03:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Yo\Application Data\Babylon
    [2012-07-26 14:03:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Babylon
    [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [COLOR="DarkRed"]:commands[/COLOR]
    [emptytemp]
    [resethosts]
    
    Now click the [​IMG] button.
    If the fix needed a reboot please do it.
    Click the OK button (upon reboot).
    When OTL is finished, Notepad will open. Close Notepad.
    A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
    Attach this log to your next message. (How to attach)

    __

    Let me know if the problem still persists after completing the above.
     
  5. FMLsrsly

    FMLsrsly Private E-2

    It seems it didn't work for some reason, I'll attach the log here.
     

    Attached Files:

    Last edited by a moderator: Aug 2, 2012
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please stop quoting Thisisu! It puts your post into moderation each time. :major
     
  7. thisisu

    thisisu Malware Consultant

    This was in your OTL fix log
    Code:
    Use Chrome's Settings page to change the HomePage.
    The Claro-search homepage / search engine should have been removed from all browsers except Google Chrome. It seems you will have to edit it yourself through Chrome's settings. I do not know where exactly because I do not use Chrome but another route you could take is to uninstall and reinstall Google Chrome to see if that helps.

    Please rescan with OTL (same way you did before) so I can check for any remnants :)
     
  8. FMLsrsly

    FMLsrsly Private E-2

    Thank you, thisisu. The search engine was still there, opening a claro search tab and a Google tab (this was my setting) on Google Chrome and opening on FireFox whenever I opened a new tab. I uninstalled them and reinstalled them and it seems that did the trick. I'll post the OTL report too.



    And to TimW: I'm sorry, it's just a bad habit I have from other forums. Haven't been on this one before.
     

    Attached Files:

    • OTL.Txt
      File size:
      167.6 KB
      Views:
      12
  9. thisisu

    thisisu Malware Consultant

    Very good :) Your OTL log is clean now.

    If you are not having any other malware related problems, it is time to do our final steps:
    • Any programs we had you download and/or install can be removed at this time.
    • If we had you download and run ComboFix, here is how to uninstall it:
      • Press and hold the Windows key [​IMG] and then press the letter R on your keyboard.
      • This opens the Run dialog box.
      • Copy and paste the below text inside the text-field:
        • "%userprofile%\desktop\ComboFix" /uninstall
      • Now press ENTER
      • ComboFix will extract its files one last time and you should receive a notification that ComboFix has been uninstalled shortly after.
    • You can re-enable your Disk Emulation software at this time via DeFogger.
    • If we had you create or download a registry patch or "fix" script, these can be deleted at this time.
    • Go into the C:\MGtools folder and run the MGclean.bat file to remove additional traces of our tools.
    • Now we will toggle System Restore to remove any infected system restore points.
    • Lastly, here is a guide to protect you from future infections: How to Protect yourself from malware!
    • Be safe :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds