cannot uninstall Snap.Do from control panel

Viruses and worms
1

Hi

I’ve downloaded Gimp (free photos editing software) and my browser (Chrome) was immediately hijacked by Snap.Do and Search.Us. Managed to uninstall Search.US (I think), ran Malwarebytes which found and deleted loads of junk. Also ran adwcleaner and found + deleted loads of “smartbar” keys associated with Snap.Do in registry.

Snap.Do and Search.Us tabs no longer show, only Chrome ,so seems to be a step in right direction. Problem is that Snap.Do and Snap.Do Engine are still in control panel + machine is now a slow as can be. No matter what I do I can’t uninstall those 2 programmes from control panel.

Any help would be hugely appreciated.

Ta

2

also attach OTL diagnostic log

3

Done.

4

Also noticed a new icon pinned on taskbar and identical to Google Chrome but called “Search”. Here’s what it reads:

An administrator has installed Google Chrome on this system, and it is available for all users. The system-level Google Chrome will replace your user-level installation now.

Happened when the browser was hijacked. cannot delete/unpin from taskbar.

5

Hi,

Please download aswMBR and save it to your desktop.

Double click aswMBR.exe to start the tool.

[*]Select Yes if prompted to download the Avast database.
[*]Click Scan
[*]Upon completion of the scan ( Scan finished successfully ) click Save log and save it to your desktop, and post that log in your next reply for review.
Note: do NOT attempt any Fix yet.

Please download Farbar Recovery Scan Tool by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Under Optional Scan ensure “List BCD” and “Driver MD5” are ticked.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

6

Thanks. Done.

7

I see no signs of Snap.do in the logs. Do you still have a problem?

Shortcut you mentioned is deleted by Adwcleaner…

8

Hi

There are 2 entries in the Farbar Addition.txt log

Snap.Do (x32 Version: 1.167.1.12640)
Snap.Do Engine (HKCU Version: 1.167.1.12640)

9

That are leftovers, we’ll deal with it later. Do you have problems in browsers?

10

No. Chrome opens as normal as far as I can see.

11

Ok, let’s recheck system one more time…

  1. Please download ComboFix by sUBs from here and save it to your Desktop.
    If you are unsure how ComboFix works please read this guide carefully.
    note: ComboFix must be downloaded to your Desktop.
  1. Temporarily disable your AntiVirus program.
    If you are unsure how to do this please read this or this Instruction.

Instructions how to disable avast:

[*]Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
[*]In the window that opens on the top right corner, click Settings.
[*]In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.
[*]=> Again, right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
[*]In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note: Do not forget to turn on this option after the cleaning.

  1. Run ComboFix. Click on I Agree!

ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix’s window while it is running.
If you see a message like “Illegal operation attempted on a registry key that has been marked for deletion” just restart computer once more.

  1. When the tool is finished, it will produce a log report for you. (typical location: C:[b]ComboFix.txt[/b] )
    Attach log reports ( ComboFix.txt) back to topic.
12

Hi

I attach log.

13

OK, computer is clean, any problems?

14

Looks good except for annoying Search icon pinned on taskbar that keeps giving me the “the system-level Google Chrome will replace your user-level installation now” message + Snap.do and Snap engine leftovers in control panel.

15

Re-run Adwcleaner, press Scan, and after that Clean. Attach me the report.

Re-run MalwareBytes, and press Quick Scan. Attach me the report.

http://imageshack.us/a/img841/7292/thisisujrt.gif
Please download Junkware Removal Tool to your desktop.

[]Shut down your protection software now to avoid potential conflicts.
[]Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select “Run as Administrator”.
[]The tool will open and start scanning your system.
[]Please be patient as this can take a while to complete depending on your system’s specifications.
[]On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
[]Post the contents of JRT.txt into your next message.

16

Done.

17

Hi, did the last 2 logs reveal anything suspicious? One thing I’ve noticed since Chrome was hijacked by Snap.Do and Snap.Do Engine is that browsing the internet is now much slower i.e. 15 to 20 seconds to load a page, opening another tab, browsing in general.

Ta.

18

Re-run FRST and attach the fresh report…

19

Here there are. Thanks.

20

Please download zoek.zip or zoek.rar by smeenk (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here or here and save it to your Desktop.
Unpack the archive…

[*]Close any open browsers
[*] Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this or this Instruction.

[*]Double click on zoek.exe to run the tool .
Please wait while the tool does not start…

[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:

emptyclsid;
shortcutfix;
emptyalltemp; 
autoclean;

[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”