[zep516]

I'd "reset sync" and carry on with the rest of the instructions, not sure why the stop an clear is not present , everyone seems to say that, so perhaps I'll change the instructions next time,

Joe

[Advertisements]

Reinstalled and imported bookmarls/   Appears to not be highjacked anymore

[groch]

Reinstalled and imported bookmarls/   Appears to not be highjacked anymore

[zep516]

Download Security Check by screen317 from http://rocketgrannie...curityCheck.exe
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE: If SecurityCheck aborts and you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED! try rebooting the system and then run SecurityCheck again.

[groch]

I'm getting a "webpage not available" trying to access the link.   Also tried http://www.spywareinfoforum.org/and also got "not available"

[zep516]

Sorry that website is offline, how is the computer ? sounds like things are ok to me and we can remove our tools we used.

[groch]

Computer is fine.   I'm pretty sure the hijack occurred installing a freeware video editor install from Cnet, a site I thought was reputable.  The question I have is that I never saw any of the SearchMore install menus that the Malwarebytes posting for this Hijack showed as examples.   Also, Windows defender never alarmed.   I thought it defaulted to scan downloads.   I need to remove the downloaded file.

[zep516]

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).


Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run.
• The program will run for a few seconds and display a notepad report.
  Paste it for my review.

[groch]

# DelFix v1.011 - Logfile created 29/11/2015 at 16:56:20

# Updated 18/08/2015 by Xplode

# Username : Family - OFFICE

# Operating System : Windows 10 Home  (64 bits)

 

~ Removing disinfection tools ...

 

Deleted : C:\FRST

Deleted : C:\AdwCleaner

Deleted : C:\AdwCleaner[R1].txt

Deleted : C:\AdwCleaner[R2].txt

Deleted : C:\AdwCleaner[S1].txt

Deleted : C:\log.txt

Deleted : C:\Users\Family\Desktop\adwcleaner_5.022.exe

Deleted : C:\Users\Family\Desktop\JRT.txt

Deleted : C:\Users\Family\Downloads\Addition.txt

Deleted : C:\Users\Family\Downloads\Fixlog.txt

Deleted : C:\Users\Family\Downloads\FRST.txt

Deleted : C:\Users\Family\Downloads\FRST64.exe

Deleted : C:\Users\Family\Downloads\JRT.exe

Deleted : C:\Users\Family\Downloads\OTL (1).exe

Deleted : HKLM\SOFTWARE\AdwCleaner

 

~ Cleaning system restore ...

 

Deleted : RP #14 [Removed iSEEK AnswerWorks English Runtime | 11/27/2015 15:53:12]

Deleted : RP #16 [Restore Point Created by FRST | 11/28/2015 14:59:15]

Deleted : RP #17 [JRT Pre-Junkware Removal | 11/28/2015 16:56:02]

Deleted : RP #18 [JRT Pre-Junkware Removal | 11/28/2015 17:01:31]

 

New restore point created !

 

~ Resetting system settings ... OK

 

########## - EOF - ##########

[zep516]

Thanks. I'll leave the topic open for a day just in case.

Joe

[groch]

Thank you Joe.   After my other help sessions complete I donated to the helper.   Do you have a PayPal or Venmo account?

Thank you

[zep516]

https://paypal.me/computerhelpUS

I just set that up so lets see if it works

[zep516]

You usually get infected because your security settings are too low.

Here are a number of recommendations that will help tighten them, and which will contribute to making you a less likely victim:

Safe Computing Practices please read Here


Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Thanks
Joe