Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for BoBrowser

- - - - -
Started by Metallica , Mar 12 2015 04:57 AM
IStartSurf.com

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 12 March 2015 - 04:57 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is BoBrowser?

The Malwarebytes research team has determined that BoBrowser is actually a mix of programs designed to hijack your browser(s) and stop you from changing the settings back.
These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. In this case the hijack was to istartsurf.com. This one also replaces all the shortcuts to Chrome with its own shortcuts.
Typically you will see a mix of detections: PUP.Optional.BoBrowser.A, PUP.Optional.IStartSurf.A, PUP.Optional.WindowsProtectManger.A, PUP.Optional.XTab.A, PUP.Optional.IHProtect.A, PUP.Optional.FastStart.A and more.

How do I know if my computer is affected by BoBrowser?

You may see these entries in your list of installed software:

warning4.png

and these warnings:

main.png

warning1.png

and these icons in your taskbar and on your desktop:

icons.png

How did BoBrowser get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove BoBrowser?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of BoBrowser?
  • The hijacker alters the shortcuts for popular browsers like Internet Explorer, Opera and FireFox. Read here how to clean your shortcuts.
  • If you are using Chrome, you may want to create new shortcuts for Chrome since the hijacker replaced them.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the BoBrowser hijacker. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.

protection1.png


protection.png


Technical details for experts

Signs in a HijackThis log:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}
O2 - BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files\XTab\SupTab.dll
O4 - HKCU\..\Run: [BoBrowser] "C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe"
O23 - Service: ClaraUpdater - ClaraLabs - C:\Program Files\Common Files\ClaraUpdater\ClaraUpdater.exe
O23 - Service: IHProtect Service - XTab system - C:\Program Files\XTab\ProtectService.exe
O23 - Service: WindowsMangerProtect Service (WindowsMangerProtect) - SysTool PasSame LIMITED - C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
Possible signs in a FRST log:

 Internet Explorer Version 11 (Default browser path: "C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe" -- "%1")
 (SysTool PasSame LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
 (XTab system) C:\Program Files\XTab\ProtectService.exe
 (SearchProtect) C:\Program Files\XTab\CmdShell.exe
 (XTab system) C:\Program Files\XTab\HPNotify.exe
 (The BoBrowser Authors) C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe
 HKCU\...\Run: [BoBrowser] => C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe [642696 2015-02-18] (The BoBrowser Authors)
 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}
 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}
 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}
 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}
 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}
 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}
 SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}
 SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}
 SearchScopes: HKCU -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=pcm&utm_campaign=install_ie&utm_content=ds&from=pcm&uid={userspecific}&ts=1426147834&type=default&q={searchTerms}
 SearchScopes: HKCU -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=pcm&utm_campaign=install_ie&utm_content=ds&from=pcm&uid={userspecific}&ts=1426147834&type=default&q={searchTerms}
 SearchScopes: HKCU -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=pcm&utm_campaign=install_ie&utm_content=ds&from=pcm&uid={userspecific}&ts=1426147834&type=default&q={searchTerms}
 SearchScopes: HKCU -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=pcm&utm_campaign=install_ie&utm_content=ds&from=pcm&uid={userspecific}&ts=1426147834&type=default&q={searchTerms}
 SearchScopes: HKCU -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=pcm&utm_campaign=install_ie&utm_content=ds&from=pcm&uid={userspecific}&ts=1426147834&type=default&q={searchTerms}
 BHO: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files\XTab\SupTab.dll [2015-03-10] (Thinknice Co. Limited)
 FF NewTab: hxxp://www.istartsurf.com/newtab/?type=nt&ts=1426147807&from=pcm&uid={userspecific}
 FF DefaultSearchEngine: istartsurf
 FF SelectedSearchEngine: istartsurf
 FF Homepage: hxxp://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}
 FF Extension: No Name - C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\74979c91-c812-44d6-90e1-1ff0491351e5@e3e0c78c-dd15-4ac4-b6a0-08cad184bd23.com [Not Found]
 FF user.js: detected! => C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\user.js [2015-03-12]
 FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\istartsurf.xml [2015-03-12]
 FF Extension: Fast Start - C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\Extensions\[email protected] [2015-03-12]
 FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\[email protected]
 CHR HomePage: Default -> hxxp://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}
 CHR StartupUrls: Default -> "hxxp://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}"
 CHR DefaultSearchKeyword: Default -> istartsurf
 CHR DefaultSearchURL: Default -> http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}
 StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe http://www.istartsurf.com/?type=sc&ts=1426147807&from=pcm&uid={userspecific}
 StartMenuInternet: (HKLM) OperaStable - C:\Program Files\Opera\Launcher.exe http://www.istartsurf.com/?type=sc&ts=1426147807&from=pcm&uid={userspecific}
 ClaraUpdater; C:\Program Files\Common Files\ClaraUpdater\ClaraUpdater.exe [328304 2015-03-12] (ClaraLabs)
 R2 IHProtect Service; C:\Program Files\XTab\ProtectService.exe [158816 2015-03-10] (XTab system)
 R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [493712 2015-03-12] (SysTool PasSame LIMITED)
 C:\Users\{username}\SupTab
 () C:\Users\{username}\Desktop\Facebook.lnk
 () C:\Users\{username}\Desktop\Wikipedia.lnk
 () C:\Users\{username}\Desktop\Youtube.lnk
 () C:\Users\{username}\Desktop\Hotmail.lnk
 () C:\Users\{username}\Desktop\Search.lnk
 () C:\Users\{username}\Desktop\Amazon.lnk
 () C:\Users\{username}\Desktop\BoBrowser.lnk
 () C:\Users\{username}\AppData\Roaming\istartsurf
 () C:\Users\{username}\AppData\Local\BoBrowser
 () C:\ProgramData\WindowsMangerProtect
 () C:\ProgramData\IHProtectUpDate
 () C:\Program Files\XTab
 () C:\Program Files\Common Files\ClaraUpdater
 () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
 () C:\Users\Public\Desktop\Opera.lnk
 () C:\Users\{username}\Desktop\iexplore.lnk
 () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
 () C:\Users\Public\Desktop\Mozilla Firefox.lnk
 () C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

Highlights in the Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 3/12/2015
Scan Time: 9:26:15 AM
Logfile: mbamBoBrowser.txt
Administrator: Yes

Version: 2.01.0.1004
Malware Database: v2015.03.12.03
Rootkit Database: v2015.02.25.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Malwarebytes

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 294271
Time Elapsed: 3 min, 57 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 8
PUP.Optional.XTab.A, C:\Program Files\XTab\ProtectService.exe, 3524, Delete-on-Reboot, [772c61e3ec9e72c4cfcae12d7989aa56]
PUP.Optional.ELEX, C:\Program Files\XTab\HPNotify.exe, 3280, Delete-on-Reboot, [acf7370da1e9c571baa9b6796d95b749]
PUP.Optional.XTab.A, C:\Program Files\XTab\CmdShell.exe, 2492, Delete-on-Reboot, [0f94ae960d7d0630a043555ebf446799]
PUP.Optional.WindowsMangerProtect.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, 2292, Delete-on-Reboot, [e2c1083c7c0e96a0e5b312a5bc4706fa]
PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe, 2960, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec]
PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe, 2220, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec]
PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe, 1004, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec]
PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe, 3700, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec]

Modules: 25
PUP.Optional.SupTab.A, C:\Program Files\XTab\SupTab.dll, Delete-on-Reboot, [1a89b0943654c86ea22f66cf87797987], 
PUP.Optional.BrowserWatch, C:\Program Files\XTab\BrowerWatchCH.dll, Delete-on-Reboot, [148f222295f56ec835cbc5a997690000], 
PUP.Optional.XTab.A, C:\Program Files\XTab\BrowserAction.dll, Delete-on-Reboot, [0f94ae960d7d0630a043555ebf446799], 
PUP.Optional.XTab.A, C:\Program Files\XTab\IeWatchDog.dll, Delete-on-Reboot, [0f94ae960d7d0630a043555ebf446799], 
PUP.Optional.XTab.A, C:\Program Files\XTab\msvcp110.dll, Delete-on-Reboot, [0f94ae960d7d0630a043555ebf446799], 
PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\chrome_elf.dll, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec], 
PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\39.0.2132.4\ffmpegsumo.dll, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec], 
PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\39.0.2132.4\chrome.dll, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec], 
PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\39.0.2132.4\chrome_child.dll, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec], 
PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\39.0.2132.4\pdf.dll, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec], 

Registry Keys: 23
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [1a89b0943654c86ea22f66cf87797987], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, Quarantined, [1a89b0943654c86ea22f66cf87797987], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [1a89b0943654c86ea22f66cf87797987], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [1a89b0943654c86ea22f66cf87797987], 
PUP.Optional.SupTab.A, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [1a89b0943654c86ea22f66cf87797987], 
PUP.Optional.SupTab.A, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [1a89b0943654c86ea22f66cf87797987], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\INPROCSERVER32, Quarantined, [1a89b0943654c86ea22f66cf87797987], 
PUP.Optional.XTab.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IHProtect Service, Quarantined, [772c61e3ec9e72c4cfcae12d7989aa56], 
PUP.Optional.IHProtect.A, HKLM\SOFTWARE\IHProtect, Quarantined, [3a69c18325653afc865cd5de19eadd23], 
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\istartsurfSoftware, Quarantined, [0d9676cec4c6999d0c489f2c19eab947], 
PUP.Optional.BoBrowser.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\BoBrowser.ZRYMY43N4V4WDE2TXAFS5BQHII, Quarantined, [b8eb68dc7a100f274ea1e1d0f2113cc4], 
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [62412d17404a0a2cc0e30f0a17ee2cd4], 
PUP.Optional.BoBrowser.A, HKLM\SOFTWARE\MICROSOFT\MEDIAPLAYER\SHIMINCLUSIONLIST\bobrowser.exe, Quarantined, [faa949fbf6941323e707a60657ace917], 
PUP.Optional.BoBrowser.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\bobrowser.exe, Quarantined, [ccd762e2c8c2cc6aceabc0f2d82b827e], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\SUPTAB, Quarantined, [2e751f25eaa0bd79a3fea8216e95cb35], 
PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsMangerProtect, Quarantined, [e2c1083c7c0e96a0e5b312a5bc4706fa], 
PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, Quarantined, [891a7dc70486d75f76663f7f689be818], 
PUP.Optional.BoBrowser.A, HKCU\SOFTWARE\BoBrowser, Quarantined, [772c172d16743105cec8595923e05ca4], 
PUP.Optional.Qone8, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [267dfb498109bd79d6ccaf6a60a5f808], 
PUP.Optional.IStart.A, HKCU\SOFTWARE\MOZILLA\EXTENDS, Quarantined, [d7ccfe461179c274150e9a0fa85b09f7], 
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\istartsurf uninstall, Quarantined, [475c69db8ffbb284ba8e7614f310738d], 
PUP.Optional.Clara.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ClaraUpdater, Quarantined, [376c49fb0b7f86b0477298fa8380e11f], 
PUP.Optional.Clara.A, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\BoBrowser, Quarantined, [376c49fb0b7f86b0477298fa8380e11f], 

Registry Values: 4
PUP.Optional.IStart.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|[email protected], C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\[email protected], Quarantined, [059ef351dbaf94a25efaf6b240c332ce]
PUP.Optional.SupTab.A, HKLM\SOFTWARE\SUPTAB|ptid, pcm, Quarantined, [2e751f25eaa0bd79a3fea8216e95cb35]
PUP.Optional.IStart.A, HKCU\SOFTWARE\MOZILLA\EXTENDS|appid, [email protected], Quarantined, [d7ccfe461179c274150e9a0fa85b09f7]
PUP.Optional.BoBrowser.A, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|BoBrowser, "C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe", Quarantined, [61429fa5642682b40c37a2fdfa0914ec]

Registry Data: 8
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND, "C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.istartsurf.com/?type=sc&ts=1426147807&from=pcm&uid={userspecific}, Good: (Chrome.exe), Bad: ("C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.istartsurf.com/?type=sc&ts=1426147807&from=pcm&uid={userspecific}),Replaced,[d1d21034b4d62610a5e79f3b9d688e72]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}, Good: (www.google.com), Bad: (http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}),Replaced,[ddc682c2afdbdc5a25c14c8c9f666f91]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}, Good: (www.google.com), Bad: (http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}),Replaced,[495a94b0e9a1979fba2c9b3da95ce41c]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}, Good: (www.google.com), Bad: (http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}),Replaced,[d7cc68dc6f1b1620a83e56823fc6e41c]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}, Good: (www.google.com), Bad: (http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}),Replaced,[9c077bc9abdf2a0c02e46c6c2adba25e]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[a0032420622877bfd49404e18184f010]
PUP.Optional.IStartSurf.A, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}, Good: (www.google.com), Bad: (http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}),Replaced,[a201aa9aec9eee487a6a7c5c9471b44c]
PUP.Optional.IStartSurf.A, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}, Good: (www.google.com), Bad: (http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}),Replaced,[980b6fd59af0c5717c6877619174dd23]

Folders: 164

Files: 573

Physical Sectors: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.