Removal of Search Hijacker Midicair---Ug

[32cassiopeia]

P.S. As I was glancing over the data I cut and pasted for you, I saw the Diigo toolbar in there. Wanted to mention that I did uninstall it, but yet it AND the midicair toolbar still appear in FIREFOX, though not in Chrome. I hardly ever use firefox, but saw it in the data, so checked it out. Clearly the toolbars are still around...Thank you again.

[Jintan]

Firefox does not use the normal installed program list there.

In Firefox, go to Help - Restart with Add-ons Disabled. In that "Firefox Safe Mode" display that opens, place checks next to the following, then click "Make changes and restart".

Reset toolbars and controls

Reset all user preferences to Firefox defaults

Restore default search engines

You can change those later to whatever you prefer, but for now, too many search hijackers have altered things there. Those steps will get rid of the garbage.

----------

Open and update Malwarebytes.

* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform quick scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
* The log is automatically saved by Malwarebytes and can be viewed by clicking the Logs tab in Malwarebytes.
* Copy and Paste the entire report in your next reply. If it calls for a reboot to complete the repairs do that as well then.

---------------

Disable your antivirus program and click here and download the esetsmartinstaller_enu.exe Eset installer. Then click that file to run the scanner.

If you accept the Terms of Use, check the box and click Start. It will take a couple minutes for the scanner to get ready. When the Computer scan settings display shows, check the following boxes:

Remove found threats
Scan unwanted applications

Next to "Current scan targets: Operating memory, Local drives", click the "Change" word. Make sure you place a check next to all disk drives, including any external drives that are attached (no need to check off the floppy or DVD/CD-Rom drives).

Then click the Advanced option, the place a check next to the following (if it is not already checked):

Enable Anti-Stealth technology

Click Start. This scan may take a while, so please be patient.

If infection is found, at the end of the scan click "List of found threats".

In that display, at the bottom, select the option to save the results as a text file, and save that to your desktop. Post that back here please.

Post that log and the Malwarebytes log please.

[32cassiopeia]

Okay...I did the firefox thing. The first time I did it, it did not get rid of the toolbars, but then I went to add ons and then extensions, removed both toolbars from that window, then did the thing you told me to do again and now the toolbars appear to be gone! Hooray! Here is malware: nothing detected! Another hooray!


Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.13.07

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Kailin :: KAILIN-VAIO [administrator]

Protection: Disabled

8/13/2012 10:28:14 PM
mbam-log-2012-08-13 (22-28-14).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 212488
Time elapsed: 3 minute(s), 5 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[32cassiopeia]

There is more to come--sorry! I've got to do the other stuff tomorrow!

[32cassiopeia]

I ended up staying up later than expected....here is the rest from the eset! Thanks!


C:\Users\Kailin\AppData\Local\Temp\ICReinstall\cne t2_revosetup_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
C:\Users\Kailin\AppData\Local\Temp\is1598539481\Bu zzdockSetup-Silent.exe probably a variant of Win32/Adware.ECOHET application cleaned by deleting - quarantined
C:\Users\Kailin\Downloads\cnet2_revosetup_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
C:\Users\Kailin\Downloads\uplayermediaplayer-setup.exe Win32/DownloadAdmin.A.Gen application cleaned by deleting - quarantined

[32cassiopeia]

Hey---I noticed my computer is running faster! Awesome!

[Jintan]

Eset located only adware bundled installers, so looking clean at this point. FYI - cnet2_revosetup_exe.exe. Cnet now adds there own adware installer to their downloads, so I recommend not relying on Cnet anymore. Very poor business choice, and I would hope enough folks catch on to their game to get them maybe even shut down, until they get some smarts about greed.

So I agree, looking good at this point. Before we start cleaning up what our work added there, any other issues we still need to address?

[32cassiopeia]

No, I don't believe so. Everything is running smoothly and fast. Honestly, my computer hasn't been this fast in awhile! Thank you for the information regarding cnet--it's where I go for everything, so it's good to know. I'm ready to clean up!

[Jintan]

Very good. Just a few steps now to finish up here.


The logs show you have slightly outdated versions of vulnerable programs, so Go to each of these sites and update to the latest version (keep your eyes open - they often slide in "opportunities" for things like Google, or McAfee's scanner):

http://www.adobe.com/downloads/
(For Adobe Reader and Flash Player - uncheck the useless McAfee scan, if offered)

http://java.com/en/download/manual.jsp
(For Java 7 Update 5 - trying to slip Ask adware/spyware to systems lately, so watch and uncheck it)

Once you have done that, be sure to go to Programs and Features and uninstall any older, more vulnerable Java versions.

--------

Eset, if you don't plan to use it again, uninstalls through the Control Panel - Programs and Features.


You can also at this time delete the files/folders of the tools we used. To assist with some of that run OTL again. This will help by automatically removing some of the tools we used.

Just click CleanUp, and select Yes. When it finishes removing some of the tools and files we used there just agree to the reboot.


In addition, I like to recommend reviewing the information Here to make sure you stay malware free.

[32cassiopeia]

Many thanks. I will read those posts and comply! Signed into fb today and got a warning that someone in Russia had tried to access my account. Glad I've finally got my system clean. Thanks again so much.

[Jintan]