Logs attached - Delta-Search, Babylon, etc.

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by axlmastr, Jul 12, 2013.

  1. axlmastr

    axlmastr Private E-2

    Logs are attached. User complains of Delta-Search in his browsers and has various small (less than 1 MB) programs in programs list that don't seem to remove themselves the typical way. Not much in a Google search for Delta-Search removal. Also noticed Babylon in some of the logs. Malwarebytes showed some items and they were removed. Thanks in advance.
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What is your relationship to all the people who you are referring to as "user" in these threads you are creating here?


    Uninstall the below very old versions of software:
    Java(TM) 6 Update 23
    Java(TM) SE Runtime Environment 6 Update 1
    Java(TM) SE Runtime Environment 6

    Now install the current version of Sun Java from: Sun Java Runtime Environment Make sure that when you see the form asking about installing Ask Toolbar that you uncheck this.

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-search.com/?babsrc...5D0FF4&affID=119351&tt=040713_xmlful&tsp=4939
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
    O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
    O3 - Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)

    After clicking Fix, exit HJT.

    Please download OTM by Old Timer and save it to your Desktop.
    • Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    Code:
    :Processes
    explorer.exe
    
    :Files
    C:\WINDOWS\Tasks\At1.job
    C:\Documents and Settings\All Users\Application Data\Babylon
    C:\Documents and Settings\Ted\Application Data\Babylon
    C:\Program Files\WebCake
    C:\Documents and Settings\Ted\Application Data\Babylon
    C:\Documents and Settings\Ted\Application Data\DSite
    C:\Documents and Settings\Ted\Application Data\WebCake
    C:\Documents and Settings\All Users\Application Data\
    C:\Documents and Settings\All Users\Application Data\Babylon
    C:\Documents and Settings\All Users\Application Data\safee, suave
    C:\Documents and Settings\All Users\Application Data\Tarma Installer
    C:\Documents and Settings\All Users\Start Menu\Programs\
    C:\Documents and Settings\Ted\Local Settings\temp\*.*
    
    :Reg
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
    "DefaultScope"="{8C1A36A1-F5EF-3B23-94E4-ED31FE1B3197}"
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\VWPT]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Prod.cap]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{8D8654CD-7FBC-4C7E-84E9-371BFA8DB04E}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{9307081B-7444-494C-8CF6-2FA7C0E92BFB}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{9D9785E5-3424-40B6-A287-BA143AD53109}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{A8F0AD53-1AEE-447E-89CD-71C325796F84}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{F5F971A9-DBF8-4EEC-81E3-5F1660573E6C}]
    [-HKEY_USERS\S-1-5-21-1960408961-1343024091-1708537768-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
    [-HKEY_USERS\S-1-5-21-1960408961-1343024091-1708537768-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3}]
    [-HKEY_USERS\S-1-5-21-1960408961-1343024091-1708537768-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}]
    :Commands
    [purity]
    [EmptyTemp]
    [start explorer]
    [Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large [​IMG] button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.

    Now please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • the JRT.TXTlog
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  3. axlmastr

    axlmastr Private E-2

     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No problem. ;) I asked and you answered. Thanks for the detailed information on what you are doing. I'm happy to hear you are assisting people in need. :)

    Thanks! We have always felt that formatting is not the answer that most people want to hear.

    Okay. Just attach the new logs when you finish.
     
  5. axlmastr

    axlmastr Private E-2

    Thanks for the reply and the helpful insight. I have run the suggested tasks and attached logs. From what I see right now it is a drastic improvement over the previous environment. The user is quite happy with it so far. I will update further in a few days after he has surfed a bit. Please tell me if you see anything in the logs that looks like it needs addressing. Thanks chaslang!!! You did it again ;)

    BTW- the other machine that I'm working on was still running the OTM removal and it was only 4 hours in! :-D
     

    Attached Files:

  6. axlmastr

    axlmastr Private E-2

    I just wanted to ask if it's normal for the list of programs in Start>All Programs to be truncated? The original listing was quite long and now it only has a handful of programs listed. I also had Administrative Tools in there and it is showing empty. It there a way to restore the All Programs list as it was prior to the cleaning?
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No! Sorry about that. There was a typo in my last fix that caused. There should have been an additional folder/filename added to the end of the below

    C:\Documents and Settings\All Users\Start Menu\Programs\

    And also the same for the below folder:

    C:\Documents and Settings\All Users\Application Data\

    but it got chopped of somewhere in my editing. We will have to copy it back from the OTM folder. Are you good with copying files/folders in Windows Explorer from one location to another or do I need to write up an explanation on how to? Or even make a batch file to do it for you?
     
  8. axlmastr

    axlmastr Private E-2

    I'm good with copying files in Windows Explorer. Throw me the instructions or if you think a batch file is faster.... I'm doing this remotely for the user.

    He is very happy now not to have those malware nuisances. Now I nee to correct his All Programs menu issue. The other day he mentioned he was confused at what to do when a program he wanted to access was no longer in the All Programs menu lol.
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Copy all files and folders back from here:

    C:\_OTM\MovedFiles\07152013_220630\C_Documents and Settings\All Users\Application Data

    to here

    C:\Documents and Settings\All Users\Application Data

    Then copy all files and folders back from here:

    C:\_OTM\MovedFiles\07152013_220630\C_Documents and Settings\All Users\Start Menu\Programs

    to here

    C:\Documents and Settings\All Users\Start Menu\Programs

    Did that work?
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds