help with spigot

Viruses and worms
1

browser is being redirected and have other probles as well. adwords cleaner malwarebytes and avast dont seem to see the problem. appreciate your help!

2

Run AdwCleaner.
Instructions: http://forum.avast.com/index.php?topic=53253.0

3

already did. says no problems.

4

Post your OTL log then.

5

AdwCleaner v2.113 - Logfile created 02/27/2013 at 13:28:45

Updated 23/02/2013 by Xplode

Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

User : MXS Asus - MXSASUS-PC

Boot Mode : Normal

Running from : C:\Users\MXS Asus\Downloads\adwcleaner.exe

Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility{98889811-442D-49DD-99D7-DC866BE87DBC}

***** [Internet Browsers] *****

-\ Internet Explorer v9.0.8112.16464

[OK] Registry is clean.

-\ Google Chrome v25.0.1364.97

File : C:\Users\MXS Asus\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

AdwCleaner[S1].txt - [1133 octets] - [27/02/2013 13:28:45]

########## EOF - C:\AdwCleaner[S1].txt - [1193 octets] ##########

6

Bump…

Was the previous post the right information and can I post anything else to help? I dont beleive that Malwarebytes generated a report.

Much appreciated!
M

7

if you open malwarebytes then click the logs tab…you should find it

you also have to attach (not copy and paste) OTL log

8

Pondus-
Thanks for the response-

I must sound like an idiot, but I dont see a way to attach with this interface- There are insert options on the second row, but where is the attach button?

Much appreciated-
ZS

9

it is just belowe the box you type in here…

attachment and other options…

10

Thanks Pondus!

Here they are-
m

11

and OTL log…

12

Sorry- Is this it?

13

yes…

removal expert is notified…

14

Thanks so much!
I am leaving for work and wont get to see this again until late tonight-
Much appreciated!
ZS

15

What browsers are being redirected and where to ?

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:OTL
[2012/09/14 13:40:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MXS Asus\AppData\Roaming\Mozilla\Extensions\{ea278cf8-93cd-484f-b951-57360482d33a}

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

16

I’ve only tried Chrome and IE- They both are beign redirected to Yahoo- Sometimes Spigot is in the URL-

So I need to cut and paste the code into OTL and go ahead and run it?

Thanks so much!
ZS

17

I ran the code in OTL but still have the redirect when I search in google

18

First time I have heard of Yahoo redirecting… I can remove that from IE for Chrome you will need to do it manually

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:OTL
IE - HKU\S-1-5-21-3645107631-2241616355-2416082582-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.yahoo.com?type=800236&fr=spigot-yhp-ie
IE - HKU\S-1-5-21-3645107631-2241616355-2416082582-1002\..\SearchScopes\{FC5529EC-8F51-490F-A187-52F50BECEF80}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=800236&p={searchTerms}

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

19

Thanks, but I dont know how to manually fix chrome-

When I type a search in the url line it redirects as follows-
http://search.yahoo.com/search?fr=chr-greentree_gc&ei=utf-8&ilc=12&type=800236&p=test

I have set the default page to google

20

Details for resetting Chrome here http://support.google.com/chrome/bin/answer.py?hl=en&answer=95426