Babylon / Hao123 Removal (General Solution?)

Dear support team:

I'm a new visitor here and am dealing with the same problem many people have: malware that redirects on startup to <[country_code].hao123.com/?tn=bbl_hp_hao123_[country_code]&babsrc=NT_ss&mntrId=C65000FF6F252FD5>, and does not go away by changing the home page in my Firefox browser. In my case I was downloading free software to convert video formats in advance of a deadline, didn't take enough time to check that all of the software packages were well-reviewed, and got stuck with this malware. Uninstalling those original software packages didn't help.

I've looked here for an initial solution, followed all the initial malware removal steps listed here, and ran Hitman, MalwareBytes, TDSSKiller, RogueKiller, and MGtools (log files attached). I'm not running Chrome, just Firefox and Opera (Opera is unaffected by the malware). Unfortunately Chaslang's recommendations for commands to run in OLT appear to be box-specific, so I still have to start a new thread.

I did think to install and run OldTimer, and I've got useful log information, but I'm afraid I'm going to have to post again as the maximum number of attachments per post is five.

I also looked here for more recent info about the same problem. I think once I apply the proper fix using OldTimer I should be set about making changes to my user.js file using that info.

Do you have the time to provide a general solution to removing this piece of malware in your response? That may keep the number of new postings down. I realize that the OTL commands to fix the problems are going to be unique to different users because the malware creates slightly different links for different countries -- and probably with signatures that vary depending on the initial software that installed the toolbar as well. So my inference is that if I'm adjusting registry keys that might differ from one box to the next, hence the new post. If you might explain how you're generating suggested OTL fix commands based on these particular log files, that would be great! Thank you so much for your time. OTL.txt follows in the next post.

Best,

Richard

 

As promised, here is the log file from my initial run of OldTimer, as well as a log file that Babylon created when it first attacked my system. You can see the clear connection between the Babylon software and the "hao123" home page link in Firefox. I'm just not sure what to do about it...I pulled this setup log file out of "C:\Users\[me]\AppData\Roaming\Babylon".

EDIT: I should mention that I tried deleting "C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml" based on advise in a previous thread. I'm still opening up to the hao123 page as my default home page in Firefox.

 

Excuse me, it's my first time using this site - I might have seen a window stating that the files were attached, but NoScript blocked the actual upload from taking place. Here are the logs.

 

Okay, PUPs deleted. But JRT is aborting one or two instructions after it checks Firefox. (The window closes too quickly for me to see if there's an error message, and starting JRT from a command line displays output in a new window anyway.) I don't get a log on my desktop or in my %temp% directory. Antivirus software is disabled and I'm running as administrator. Thoughts?

 

Sure thing! Here's the log.

 

I'm getting a browser redirect to <tw.hao123.com/?tn=bbl_hp_hao123_tw&babsrc=NT_ss&mntrId=C65000FF6F252FD5> regardless of what I set my Firefox home address to. That's the original symptom. So, I'm inferring that I still have malware installed. I previously attached the Babylon log file that shows the redirect being established, and would like to know how to make it go away -- especially in case this software does anything more malicious than redirect my browser.

 

Thank you very much! That did the trick, all problems resolved. I appreciate your time!