Bueno Search .....

Viruses and worms
1

…I have spent hours trying to get of this toolbar. It does NOT appear in the list of progs in Control Panel/Uninstall a Program. I have Spybotted, Avasted, Malwarebyted, MS Security Essentials, Troubleshooter …all to no affect and I’m feeling really stupid. Pointers please?

2

Hi,

Please download Farbar Recovery Scan Tool (
http://www.mcshield.net/personal/magna86/Images/FRST_canned.png
) by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

3

Thank you for your interest. Files attached as required.

4

Hi,

FRST’s FixList

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Start C:\Program Files\PC Performer C:\Users\Bailey\AppData\Roaming\BabSolution C:\Program Files\AmiExt\flashEnhancer C:\Users\Bailey\AppData\Roaming\PerformerSoft C:\Users\Bailey\AppData\Roaming\BabSolution C:\ProgramData\Babylon C:\Users\Bailey\AppData\Local\Temp\*.dll C:\Users\Bailey\AppData\Local\Temp\*.exe Task: {0641F38F-E14A-4EBC-9A16-BBC24F4F49E4} - System32\Tasks\PC Performer => C:\Program Files\PC Performer\PCPerformer.exe <==== ATTENTION Task: {AA531DA6-2CB8-46F2-8E3C-0B160934220A} - System32\Tasks\EPUpdater => C:\Users\Bailey\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-12-12] () <==== ATTENTION SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.buenosearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=FC2F001CBF1B1183&affID=128012&tsp=5156 SearchScopes: HKCU - {CB7C789C-EF69-495B-B916-7165B41092B8} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYES&apn_uid=FB3081CE-434C-4B50-85E6-57D47229DBA7&apn_sauid=C75D6D6E-4D75-41A0-92A5-228F120299AE FF NewTab: hxxp://www.buenosearch.com/?babsrc=NT_ss&mntrId=FC2F001CBF1B1183&affID=128012&tsp=5156 FF HKLM\...\Firefox\Extensions: [ext@flashenhancer.com] - C:\Program Files\AmiExt\flashEnhancer\ff Hosts: CMD: ipconfig /flushdns End

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.

Zoek’s Scan

Please download zoek.zip or zoek.rar by smeenk (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here or here and save it to your Desktop.
Unpack the archive…

[*]Close any open browsers
[*] Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this or this Instruction.

[*]Double click on zoek.exe to run the tool .
Please wait while the tool does not start…

[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:

ResetHosts;
Uninstall-List;
FFDefaults;
EmptyCLSID;
EmptyFoldersCheck;Delete
AutoClean;
Reboot;

[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”

5

It appears all went well…attached is the results log.

6

Logs says the same thing. Tell me, how is the computer behavior?

7

An interesting thing. I have F/fox set to open (in Tools/Options/General) www.google.co.uk. In fact, when I open a new tab I get

https://www.google.es/?gfe_rd=cr&ei=4Mr_Uuq_A6iI8QfO3oHIDQ

I am in Spain so obviously my IP address is Spanish but I have not had, in the past, this issue. Perhaps this instancew has nothing to do with the problem you helped with (?).

I am interested in knowing what the data I sent you contained or how you decided to solve the problem.

8

Hi ColinWB,
I do not see what the problem is, Google is set for home page only diferent region. You can set up whatever you want for home page, that’s your freely choice.

I am interested in knowing what the data I sent you contained or how you decided to solve the problem.
These tools are diagnostic nature, a program that scan your computer and create logs that can be used to display various startup, configuration, and file information from your computer. This programs are mainly used in varius security forums to provide a detailed overview of what programs are automatically starting when you start Windows and that allow us to quickly ascertain whether or not malware may be running on your computer.

In addition to being able to remove a large amount of the most common and current malware, adware … these tools displays a report that can be used by trained helpers to remove malware using his scripts powers and abilities.

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

9

Much obliged.

Out.