Start.qone8.com

Viruses and worms
41

The search engine is google in all three browsers. It was the first thing I did before consulting. However to open any browser appears as a new tab:
start.qone8.com …

42

I just noticed that I did not get an all user OTL scan

Could you re-run the scan and ensure that all users is selected please

43

I have to paste any script ?
And how I selected all users ??
Thanks.

44

Good I ve pasted: BASESERVICES
%SYSTEMDRIVE%*.exe
c:\program files (x86)\Google\Desktop
c:\program files\Google\Desktop
dir “%systemdrive%*” /S /A:L /C

I sellect all and post the OTL

45

This is the most obstinate version that I have come across… Normally one maybe two fixes kill this

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
IE - HKU\S-1-5-21-1571150509-1092675849-722137386-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1571150509-1092675849-722137386-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" =
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.useDBForOrder: ""
O2:64bit: - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.

:Files
C:\Users\Alberto\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml
C:\Users\Alberto\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

46

Very funny to me that this is the most obstinate version that you have come across. Goddd :frowning:

I post the log with selecting all users: Its right?

47

Are you still getting it coming as your main search engine ?

48

Yes …
Comes opening a new tab in all browsers because keeping open the last session.
When not saved the last session appears as the first tab, though Google the search engine that II have set.

49

OK in IE could you visit here http://windows.microsoft.com/en-gb/windows-vista/change-or-choose-a-search-provider-in-internet-explorer get a new search provider (i.e. Bing) this will not be for long
Make this your main search engine
Then delete the Google search engine
Does it still appear

50

Yes, still appears it : http://start.qone8.com/?type=sc&ts=1381697851&from=tugs&uid=TOSHIBAXMK6465GSXN_Z0LCS14DSXXZ0LCS14DS

How to restore the search engine Google please?

51

To restore Google follow the same process as used to get bing

Could you check in internet options that you have only one home page set

52

Yes, I have only one home page set : http://www.google.com/

53

These type of programmes really annoy me - especially when they find new ways to hide

For 32bit systems, please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1
Download Mirror #2

For 64bit systems, download SystemLook from here.

[*]Double-click SystemLook.exe to run it.
[*]Copy the content of the following codebox into the main textfield:

:regfind 
start.qone8.com
start.qone8
qone8

[*]Click the Look button to start the scan.
[*]When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

54

Here you are …

55

After this fix could you re-run system look please

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:Reg
[-HKEY_USERS\S-1-5-21-1571150509-1092675849-722137386-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\qone8.com]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\qone8.com]
[HKEY_USERS\S-1-5-21-1571150509-1092675849-722137386-1000\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit]
"LastKey"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit]
"LastKey"=-

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

56

Still appears: http://start.qone8.com/?type=sc&ts=1381697851&from=tugs&uid=TOSHIBAXMK6465GSXN_Z0LCS14DSXXZ0LCS14DS

Posting …

57

And the system look

58

OK I will have to do a bit more research on where this could be generated

59

Rigth, thanks. I will wait.

60

Still searching with no real answer yet