safetydefender problem

Discussion in 'Malware Help (A Specialist Will Reply)' started by mrblacksmith, Apr 27, 2006.

  1. mrblacksmith

    mrblacksmith Private E-2

    Hi,

    I have tried to remove safetydefender for a couple of days now. I've succeeded in removing the popup/nagscreen saying the computer is infected, but I can't get rid of the startpage problem. Ive performed a number of actions but now I'm starting to loose hope, so I join majorgeeks as a final resort. Maybe you can help me?

    I'm using a swedish win xp but I don't know if that makes things harder or if some scripts I've run have failed. Anyway, could you have a look at the hjt-log please?

    Thanks!
    MrBlackSmith
     

    Attached Files:

  2. mrblacksmith

    mrblacksmith Private E-2

    Maybe I'd tell you some about what I've done so far, I've run the following:

    Ad-Aware SE
    Spybot Search & Destroy
    Microsoft Windows Defender
    WebRoots SpySweeper (bought it(!))
    I'm using Norton AV: Removed files from Norton AntiVirus Quarantine (had none)

    Followed "SpywareQuake Removal Procedure"

    I attach smitfiles.txt from the last attempt (have done it 3 times)
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Majorgeeks!

    Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

    Skip Windows Defender in the below procedure and uninstall it since you have SpySweeper (paid version). I would like to see a log from Spy Sweeper though.
    • Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
    • Make sure you check version numbers and get all updates.
    • Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.
    • After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:
    • When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)
      • Bitdefender
      • Panda Scan
      • HijackThis
    .
     
  4. mrblacksmith

    mrblacksmith Private E-2

    Impressive fast response - respect! I'll get to it ASAP and post the results here. Thanx!
     
  5. mrblacksmith

    mrblacksmith Private E-2

    OK, now I've run all the steps according to the attached result.txt.

    The result: safetydefender.com is not opened when I open IE, but if I save a startpage, that isn't started either. Not a big problem, but still a sign of some malfunction.

    Could you please check the logs?

    Thank you!
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You forgot to attach a new HJT log. After running all those scans we really need to see what remains.

    You may just be having problems changing your startpage due to run Spy Sweeper. It protects/locks all the pages and you have to approve the changes for them to occur.

    Let's get an installed programs list from HijackThis too!
    • Run HijackThis, click Open the Misc Tools section
    • Click Open Uninstall Manager
    • Click Save List (generates uninstall_list.txt)
    • Click Save, to save it to a file where you can find it.
    • Attach the uninstall_list.txt file to your next message.
     
  7. mrblacksmith

    mrblacksmith Private E-2

    ok, here icomes a couple of new logs.

    Thanks!
     

    Attached Files:

  8. mrblacksmith

    mrblacksmith Private E-2

    When I tried to change the IE home/start page it wasn't set and I got no info from spysweeper that I needed to verify/allow the change - the change was simply ignored. Then I opened SpySweeper and temporarily unchecked "Shields - IE Hijack Shield", changed the start page and the checked back the shield.

    And now it works. Phew. Thanks for all your help, u're fantastic!

    Still, I'm curious about all the reported issues that couldn't be fixed by the various apps in the steps taken. Do I still have an infected machine or not?
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please be more specific! The only item I saw in your logs that was an issue is a registry key referred to as a Dialer by Panda. Do you know what Switch Uninstall showing in your install programs list is? If not then you should uninstall it. If the uninstall does not work, you can use the below to remove it from the uninstall list (only use this if uninstalling does not work).

    Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. it to your Desktop. We will use it later after a reboot into safe mode.
    You should uninstall all the old versions of Sun Java that you have installed. You already have the latest 5.0 update 6 installed. Also you should update FireFox to the current version.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds