Mini Spy

Loading...

Latest Threads

Loading...
 
  1. Before you start!
    All given instructions in this forum are customized for each help request, the tools used may cause damage if used on a computer with different infections. If you think you have similar issues, please post the appropriate logs in our Malware Removal Assistance forum and wait for help.

    Please be aware that removing Malware is a potentially hazardous undertaking. We will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for us to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and we cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.
    We strongly advise you to backup any personal files and folders before you start.

FB downloader removal

Discussion in 'Malware Removal Assistance' started by Matt 75, Feb 26, 2013.

Thread Status:
Not open for further replies.
  1. Matt 75

    Matt 75 New Member

    Reputation:
    0
    Joined:
    Feb 26, 2013
    Messages:
    14
    Likes Received:
    0
    Hi, as stated above I've follwed the steps OTL, JRT and ran the ESNET antivirus which has flagged up a threat.

    I was looking for some advice on what to do next.
    Thank you
     

    Attached Files:

  2. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Hi and welcome to the MalwareTips.com forums!

    I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:
    • I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
    • The fixes are specific to your problem and should only be used for this issue on this machine!
    • The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
    • If you don't know, stop and ask! Don't keep going on.
    • Please reply to this thread. Do not start a new topic.
    • Refrain from running self fixes as this will hinder the malware removal process.
    • It may prove beneficial if you print of the following instructions or save them to notepad as I post them.
    Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.


    Before we start:
    Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

    Because of this, I advise you to backup any personal files and folders before you start.
    <hr />



    Good Evening. .. You can delete the file detected in E:\Downloads\

    In Order to check your computer further I need some log files from your computer......

    STEP 1: Run a scan with OTL by OldTimer
    <ol><li>Download the OTL utility using the below link :
    <><a title="External link" href="http://oldtimer.geekstogo.com/OTL.exe" rel="nofollow external">OTL DOWNLOAD LINK</a> <em>(This link will automatically download OTL on your computer)</em></></li>
    <li>Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    <img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL-logo.png" alt="" title="OTL-logo" width="106" height="118" class="alignnone size-full wp-image-3946" /></li>
    <li>When the window appears, <>underneath Output</> at the top change it to <>Minimal Output</>.</li>
    <li>Check the boxes beside <>LOP Check</> and <>Purity Check</>.</li>
    <li>Click the<> Run Scan</> button.
    <img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL.png" alt="" title="OTL" width="658" height="584" class="alignnone size-full wp-image-3945" /></li>
    <li>When the scan completes, it will open two notepad windows. <>OTL.Txt</> and <>Extras.Txt</>. These are saved in the same location as OTL.
    <>Please post this 2 logs in your first reply.</>.</li></ol>

    Settings You need to Select in OTL
    1. Click the [b]Scan All Users[/b] checkbox.
    2. Change [b]Standard Registry[/b] to [b]All[/b].
    3. Check the boxes beside [b]LOP Check[/b] and [b]Purity Check.[/b]

    <em>Note: If OTL.exe will not run, it may be blocked by malware. Try these alternate versions: <a title="External link" href="http://www.itxassociates.com/OT-Tools/OTL.scr" rel="nofollow external">OTL.scr</a>, or <a title="External link" href="http://oldtimer.geekstogo.com/OTL.com" rel="nofollow external">OTL.com</a>.</em>

    <hr />
     
    Last edited by a moderator: Mar 13, 2014
  3. Matt 75

    Matt 75 New Member

    Reputation:
    0
    Joined:
    Feb 26, 2013
    Messages:
    14
    Likes Received:
    0


    Hi, Thank you for the very quick response. Please see attached files as requested.
    Thank you
     

    Attached Files:

    Last edited by a moderator: Mar 13, 2014
  4. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Hi,

    It's seems this logs are fine only... :)

    You can delete : E:\Downloads\SoftonicDownloader_for_acemoney-lite.exe

    After that follow Step 1,2 & 3 one by one.. :)

    STEP 1: Run a scan with AdwCleaner

    <ol><li>Download AdwCleaner from the below link.
    <><a href="http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner" target="_blank">ADWCLEANER DOWNLAOD LINK</a></> (This link will automatically download Security Check on your computer)</li>

    <li>Close all open programs and internet browsers.</li>
    <li>Double click on <>adwcleaner.exe</> to run the tool.</li>
    <li>Click on <>Delete</>,then confirm each time with <>Ok</>.</li>
    <li>Your computer will be rebooted automatically. A text file will open after the restart.</li>
    <li>Please post the contents of that logfile with your next reply.</li>
    <li>You can find the logfile at <>C:\AdwCleaner[S1].txt</> as well.</li>
    </ol>
    <hr/>

    You should be able to run both scans while in Normal mode...
    STEP 2: Run a scan with Malwarebytes Anti-Malware in Chamelon mode

    <ol>
    <li>Download <>Malwarebytes Chameleon from <a title="External link" href="http://downloads.malwarebytes.org/file/chameleon" rel="nofollow external">here</a> </>and extract it to a folder in a convenient location</li>
    <li>Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.</li>
    <li>If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window <em><>Note:</> Do not attempt to open <>mbam-killer</> as that is not a Chameleon executable and serves a different purpose)</em></li>
    <li>Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for yo</li>
    <li>Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click <>OK</> when it says that the database was updated successful</li>
    <li>Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan</li>
    <li>Upon completion of the scan, if anything has been detected, click on <>Show Result</></li>
    <li>Have Malwarebytes Anti-Malware remove any threats that are detected and click <[b]>Yes</[b]> if prompted to reboot your computer to allow the removal process to complete</li>
    <li>After your computer restarts, open <[b]>Malwarebytes Anti-Malware</[b]> and perform a Full System scan to verify that there are no remaining threats</li>
    Please add both logs in your next reply.
    </ol>

    <hr />

    [SIZE=4]STEP 3: Run a HitmanPro scan[/SIZE]
    <ol>
    <li><[b]>Download the latest official version of HitmanPro</[b]>.
    <a href="http://www.surfright.nl/en/hitmanpro/" rel="nofollow" target="_blank"> <[b]>HITMANPRO DOWNLOAD LINK</[b]></a> <em>(This link will open a download page in a new window from where you can download HitmanPro)</em></li>
    <li>Start HitmanPro by <[b]>double clicking on the previously downloaded file.</[b]> and then following the prompts.
    <img src="http://malwaretips.com/images/removalguide/hpro4.png" alt="[Image: hitmanproscan4.png]" border="0" /></li>
    <li>Once the scan is complete, a screen displaying all the malicious files that the program found will be shown as seen in the image below.After reviewing each malicious object click <[b]>Next</[b]> .
    <img src="http://malwaretips.com/blogs/wp-content/uploads/2012/02/rsz_hpro5.png" alt="[Image: hitmanproscan5.png]" border="0" /></li>
    <li>Click <[b]>Activate free license</[b]> to start the free 30 days trial and remove the malicious files.
    <img src="http://malwaretips.com/images/removalguide/hpro6.png" alt="[Image: hitmanproscan6.png]" border="0" /></li>
    <li>HitmanPro will now start removing the infected objects, and in some instances, may suggest a reboot in order to completely remove the malware from your system. In this scenario, always confirm the reboot action to be on the safe side.
    </ol>
    Add to your next reply, any log that HitmanPro might generate.
    <hr />[/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b]
     
    Last edited by a moderator: Mar 13, 2014
  5. Matt 75

    Matt 75 New Member

    Reputation:
    0
    Joined:
    Feb 26, 2013
    Messages:
    14
    Likes Received:
    0
    [b][b][b][b][b][b][b][b][b][b][b][b][b][b]

    Hi,
    Thank you, please see attached files, Hitman didn't find any threats apart from cookies. It appears to be clear, I will reboot and report any further problems
    Matt
    Edit
    I rebooted the PC open firefox and it went straight to fb downloader search engine, I opened explorer and it did the same. I did opened help in firefox>trouble shooting>reset and tools>internet options>advanced>reset in explorer. Rebooted the PC and it still redirects to fb downloader. i did a quick scan with mbam and it reports no threats detected. I'm confused??
    Any further help will be greatly appreciated.
    Matt[/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b]
     

    Attached Files:

    Last edited by a moderator: Mar 13, 2014
  6. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Hi,

    Open Internet Explorer.--> Tools --> Internet Options --> General Tab See what is the home page there? Let me know what is the home page set over there.
     
  7. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    STEP 1: Run a scan with Shortcut Cleaner

    <ol><li>Download Shortcut Cleaner from the below link.
    <><a href="http://www.bleepingcomputer.com/download/shortcut-cleaner/dl/153/" target="_blank">Shortcut Cleaner</a></> (This link will automatically download Security Check on your computer)</li>
    <li>Close all open programs and internet browsers.</li>
    <li>Double click on <>sc-cleaner.exe</> to run the tool.</li>
    <li>Please post the contents of that logfile with your next reply.</li>
    <li>Log file will open automatically when the scan completes.</li>
    </ol>
    <hr/>
     
    Last edited by a moderator: Mar 13, 2014
  8. Matt 75

    Matt 75 New Member

    Reputation:
    0
    Joined:
    Feb 26, 2013
    Messages:
    14
    Likes Received:
    0


    Hi here is the logfile and the default webpage in Ie >tools> general>internet options: http://search.fbdownloader.com/?channel=sfuk206

    And this is what's in firefox internet options: http://search.fbdownloader.com/?channel=sfuk206

    Thank you for your help so far

    Matt
     

    Attached Files:

    Last edited by a moderator: Mar 13, 2014
  9. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Matt after running Shortcut Cleaner it should be working fine... Please check and confirm everything is working fine now..
     
  10. Matt 75

    Matt 75 New Member

    Reputation:
    0
    Joined:
    Feb 26, 2013
    Messages:
    14
    Likes Received:
    0
    Hi Kuttus,
    Unfortunately Firefox and Ie still defaults to fb downloader search even after running adware cleaner and resetting the default pages in the web browsers. When I restart the PC fb downloader is still there.

    Thanks

    Matt
     
  11. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Please run Shortcut Cleaner


    Please run OTL once again and Please send me one new OTL Log file also...
     
  12. Matt 75

    Matt 75 New Member

    Reputation:
    0
    Joined:
    Feb 26, 2013
    Messages:
    14
    Likes Received:
    0
    please see attached
    Matt
     

    Attached Files:

  13. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    STEP 1: Run the below OTL fix
    <ol><li>Start <>OTL.exe</></li>
    <li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL
    Code:
    
    :OTL
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.fbdownloader.com/?channel=sfuk206
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-GB
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 44 87 9A 4C E1 16 CE 01  [binary data]
    IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
    IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://search.fbdownloader.com/search.php?channel=sfuk206&q={searchTerms}
    FF - prefs.js..browser.search.defaultenginename: "Search"
    FF - prefs.js..browser.search.defaulturl: "http://search.fbdownloader.com/search.php?channel=sfuk206&q="
    FF - prefs.js..browser.search.selectedEngine: "Search"
    FF - prefs.js..browser.startup.homepage: "http://search.fbdownloader.com/?channel=sfuk206"
    FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0
    FF - prefs.js..keyword.URL: "http://search.fbdownloader.com/search.php?channel=sfuk206&q="
    FF - user.js - File not found
    [2013/03/02 01:01:22 | 000,002,384 | ---- | M] () -- C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\0qfxpv3x.default-1362185906533\searchplugins\search.xml
    
    
    :commands
    [emptytemp]
    [reboot]
    
    
    <>NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system</></li>
    <li>Then click the <>Run Fix</> button at the top</li>
    <li>Let the program run unhindered, reboot when it is done</li>
    <li>Attach the new log produced by OTL (C:\_OTL)</li>
    </ol>

    <hr />
     
    Last edited by a moderator: Mar 13, 2014
  14. Matt 75

    Matt 75 New Member

    Reputation:
    0
    Joined:
    Feb 26, 2013
    Messages:
    14
    Likes Received:
    0


    Hi, please see below, I tried to attach but couldn't, i am very pleased to say when I opened firefox there was no sign of fb downloader :) same in Ie.
    Kuttus I love you :D


    All processes killed
    ========== OTL ==========
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
    Prefs.js: "Search" removed from browser.search.defaultenginename
    Prefs.js: "http://search.fbdownloader.com/search.php?channel=sfuk206&q=" removed from browser.search.defaulturl
    Prefs.js: "Search" removed from browser.search.selectedEngine
    Prefs.js: "http://search.fbdownloader.com/?channel=sfuk206" removed from browser.startup.homepage
    Prefs.js: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0 removed from extensions.enabledAddons
    Prefs.js: "http://search.fbdownloader.com/search.php?channel=sfuk206&q=" removed from keyword.URL
    C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\0qfxpv3x.default-1362185906533\searchplugins\search.xml moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Matt
    ->Temp folder emptied: 51016 bytes
    ->Temporary Internet Files folder emptied: 3802139 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 23908061 bytes
    ->Flash cache emptied: 2216 bytes

    User: Public

    User: UpdatusUser
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 7004 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 224919 bytes

    Total Files Cleaned = 27.00 mb


    OTL by OldTimer - Version 3.2.69.0 log created on 03022013_013627

    Files\Folders moved on Reboot...
    C:\Users\Matt\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
    File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

    PendingFileRenameOperations files...

    Registry entries deleted on Reboot...

    matt
     
    Last edited by a moderator: Mar 13, 2014
  15. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    :dance3: :dance3: :dance3: :heart:


    So how's everything else working on the computer now? Just try one more restart on your computer and make sure there is no other issues remaining....... :locomotive:
     
  16. Matt 75

    Matt 75 New Member

    Reputation:
    0
    Joined:
    Feb 26, 2013
    Messages:
    14
    Likes Received:
    0
    Hi,
    Started the PC today opened firefox and fb downloader is still there. Opened Ie and it went straight to MSN. So the problem seems to be with firefox

    Don't know if this matters but Firefox is the main web browser I use very rarely use Ie
    Thanks
    Matt
     
  17. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    STEP 1: Clean your temporary files to gain more hard drive space and remove the junk files
    <ol>
    <li>Download Ccleaner from the below link:
    CCLEANER DOWNLOAD LINK</a> <em>(This link will automatically download Ccleaner on your computer)</em></li>
    <li>Install Ccleaner by following the prompts</li>
    <li>Start Ccleaner and the following should be selected by default, if not, please select:
    <img src="http://i52.tinypic.com/4l5a4i.png" alt="Posted Image" /></li>
    <li>Click <img src="http://i56.tinypic.com/16jox2o.png" alt="Posted Image" /> and choose <img src="http://i40.tinypic.com/5x3nu8.gif" alt="Posted Image" /></li>
    <li>Uncheck <img src="http://i51.tinypic.com/amuvj8.gif" alt="Posted Image" /></li>
    <li>Then go back to <img src="http://i41.tinypic.com/2jb4qyb.gif" alt="Posted Image" /> and click <img src="http://i25.tinypic.com/nf47ev.gif" alt="Posted Image" /> to run it.</li>
    <li>Exit CCleaner.</li>
    </ol>

    [hr]


    After this steps open Ccleaner once again --> Click on Tools --> Uninstall --> In the right bottom Corner you can see an option Save to text File... Click on that one and Save the file on your computer. After that Attach that one also in your next replay..... Find the Steps in the Picture...
    [​IMG]
     
  18. Matt 75

    Matt 75 New Member

    Reputation:
    0
    Joined:
    Feb 26, 2013
    Messages:
    14
    Likes Received:
    0
    Hi kuttus
    Please see attached
     

    Attached Files:

  19. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    STEP 1: Run a scan with Junkware Removal Tool

    Please download Junkware Removal Tool to your desktop from here
    • Turn off your antivirus software now to avoid potential conflicts
    • Double-click to run the tool. For Windows Vista or 7 users, right-click the file and select Run as Administrator
    • The tool will open and start scanning your system
    • Please be patient as this can take a while to complete depending on your system's specifications
    • On completion, a log (JRT.txt) will be saved to your desktop and will automatically open
    • Post the contents of JRT.txt into your next reply

    [hr]

    After running Junkware Removal Tool Run one fresh OTL Scan and update me it's log also...
     
  20. Matt 75

    Matt 75 New Member

    Reputation:
    0
    Joined:
    Feb 26, 2013
    Messages:
    14
    Likes Received:
    0
    Hi Kuttus,
    sorry for delay just been really busy at work. Please see attached
    Thanks
    Matt
     

    Attached Files:

    • JRT.txt
      File size:
      1.2 KB
      Views:
      96
    • OTL.Txt
      File size:
      119.1 KB
      Views:
      53

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads: downloader removal
Forum Title Date
Malware Removal Assistance Win32Downloader.gen removal help requested. Feb 19, 2014
Malware Removal Assistance Win32.Downloader.gen removal help Jun 7, 2013
Malware Removal Assistance fbdownloader removal help Feb 26, 2013
Malware Removal Assistance fb Downloader removal issues Feb 19, 2013
All Software Discussions What's an audio/video downloader that grabs things other programs can't extract? Tuesday at 4:57 PM

Thread Status:
Not open for further replies.
MalwareTips.com is an independent website.All trademarks mentioned on this page are the property of their respective owners.