Cleanserp removal

Viruses and worms
1

I have got the above on my computer. Avast does not find it - why? It forces the search engine in Chrome to be cleanserp.net

Malware bytes cannot find it either.

What will find it and get rid of it?

2

Try this >> https://www.malwarebytes.com/adwcleaner/

If still a problem, see instructions here >> https://forum.avast.com/index.php?topic=194892.0
scroll down to step 2 and follow Farbar Recovery Scan Tool instructions and attach requested logs

3

Thanks for the suggestions.

Having unintalled Chrome I downloaded adwcleaner. It found a few things that Malwarebytes did not. Still had the same problem when Chrome reinstalled. Also tried running it with Chrome installed and all it did then was to remove ask.com as a search engine.

Ran Farbar - files attached. I did have a quick look through them and the tutorial but they are a bit complicated. Spotted a couple of items marked attention but nothing leapt aout at me but that might be my lack of knowledge.

Currently removed Chrome and installed Firefox.

Thanks for any more suggestiions,

Julian

4
. I did have a quick look through them and the tutorial but they are a bit complicated.
That is why you need to wait for the malware expert. They are notified but it may take some time before online
5
Currently removed Chrome and installed Firefox.
It may need to be installed for him to fix, anyway he will tell you
6

Thanks. Can live without Chrome for a while but use it on mobile devices with eveything synchronised so would be good to get it back.

7
  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad
GroupPolicy: Restriction - Chrome <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKU\S-1-5-21-3777003649-1785386235-1068956831-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://192.168.1.98/ie.html
CHR HKU\S-1-5-21-3777003649-1785386235-1068956831-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bbjllphbppobebmjpjcijfbakobcheof] - hxxps://clients2.google.com/service/update2/crx
EmptyTemp:
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on Desktop
  • Open again FRST and click on button Fix
  • Wait until FRST finishes
  • fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.
8

Thanks very much for the code. I ran it as instructed. The log file is attached.

On the basis the log file appeared to show success I have installed Chrome again and it is working fine.

Thanks to you and Pondus fo your help.

Having Avast on the PC it seems does not protect from everything and even though Malwarebytes and adwcleaner both removed a few suspect items it took a rather specialist piece of software and some expert knowledge to get things back to normal. A rather worrying situation.

Thanks again for your help.

Julian

9

Glad to help. :slight_smile:

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.