Evercookies?!

Viruses and worms
1

Hi.
I downloaded xtab.exe accidentally and it apparently downloaded evercookies, too. I tried more than 8 antivirus programs, none of them found it. The only one that did was SpyHunter4 (which doesn’t delete). And even if it did, it’s absolutely pointless, because the evercookies use several mechanisms to recreate the cookie virus. To be exact, I’ve got these viruses: delta-homes.com, conduit search, key-find.com, Media, squirrelweb and several others (they change from time to time). Tried the samy.pl/evercookie/ thing, but it of course didn’t work at all. I wrote to Samy Kamkar (the creator of evercookies) about my problem, he wrote what should delete them, but it didn’t work for me.
I seem to have such a persistent virus-evercookie in my computer that even its creator isn’t able to help me. I use Google Chrome and sometimes Internet Explorer, both of them keep recreating these evercookies, whatever I do. I used Norton 360, which didn’t help (it called it SONAR.SuspBeh!gen3). And I tried the free version of avast!, too.
I’m not asking for a removal advice, because it is impossible, I’m sure of it. (yeah, someone could actually maybe do something about it, it’s been around for five years, thanks, antivirus guys. doing great work.)
So, what could help? Do you think a full hard-disk clean would do the magic? Or just Windows re-install? How do I get rid of them so I can start using the internet again?
Thank you for the help.

2

Hello

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

3

Sending the logs from FRST.

4

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]
Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Press the Fix button just once and wait.
[*]If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
[*]When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
bitsadmin /reset /allusers;b
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

5

Sending the Fixlog.

6

Run Zoek.

7

When I start Zoek, it results in Bluecreen or immediate removal by antivirus programs claiming it’s a virus. Cannot run.

8

Disable Antivirus and download new zoek, is not virus.

Download Rar version and unpack in folder.

9

Managed to do it. Sending the zoek-results file.

10

Re-run zoek and run this script:

createsrpoint;
autoclean;
dihmnpngfonlhjmgkflpnibiaaliendo;chr
bdngekjahnmlkinegnhdmmbcfnmbclnn;chr
aneodkojaglhnkkdbbdnmmmgimlcaogo'chr
C:\Users\Jan Campbell\AppData\Local\Google\Chrome\User Data\Default\Preferences;f
emptyalltemp;

Please attach it to your reply.

11

Here’s the log.

12

Download JavaRa and uninstall Java.

https://singularlabs.com/software/javara/javara-download/

Download new version Java here:

http://javadl.sun.com/webapps/download/AutoDL?BundleId=107100

Is everything ok now?

13

No, even more evercookies have been added now. As I said before, I’m afraid it is impossible. Should I clean the hard-disk and re-install Windows, does it help? It indeed is impossible to delete the evercookies.

14

Re-install Windows will assist the 100%