I followed the safesaver removal guide but it still appears...

Jen

New Member
Thread author
Jan 2, 2014
6
Hi All,

Yesterday (1 Jan 2014) I noticed that safesaver links, ads and popups were appearing when I was browsing the BBC News site.

I have run a scan using Microsoft Security Essentials; run CC Cleaner and removed all files etc it found; gone into my system and removed all unfamiliar and new programmes - there were quite a few I removed, but none called safesaver. I then followed your guide fully, which removed quite a few items - but the issue has not been resolved fully - the links and popups still appear.

Many thanks for your help.

Jen
 

Attachments

  • Addition.txt
    27 KB · Views: 79
  • AdwCleaner[S1].txt
    938 bytes · Views: 77
  • aswMBR.txt
    2.2 KB · Views: 78
  • FRST.txt
    32.2 KB · Views: 137
  • JRT.txt
    623 bytes · Views: 64
  • mbam-log-2014-01-02 (15-19-34).txt
    2 KB · Views: 82
  • MBAM-log-2014-01-02 (15-24-13).txt
    2 KB · Views: 76

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)

Open FRST, and click Fix. Attach me that report after it is finished.



1. Please download ComboFix by sUBs from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guidehttp://www.bleepingcomputer.com/combofix/how-to-use-combofix carefully.
Note: ComboFix must be downloaded to your Desktop.


--------------------------------------------------------------------
2. Temporarily disable your AntiVirus program.
If you are unsure how to do this please read http://www.techsupportforum.com/forums/f50/how-to-disable-your-security-applications-490111.htmlthis or this Instruction.


Note: Do not forget to turn on this option after the cleaning.

--------------------------------------------------------------------
3. Run ComboFix. Click on I Agree!

ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix's window while it is running.
If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart computer once more.


--------------------------------------------------------------------
4. When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
Attach log reports ( ComboFix.txt) back to topic.
 

Attachments

  • fixlist.txt
    2.1 KB · Views: 133

Jen

New Member
Thread author
Jan 2, 2014
6
Thanks for your reply. I have attached the FRST Fixlog. I tried to use Combofix, but it kept telling me that it detected McAfee running. I can't understand why this would be the case as I use Microsoft Security Essentials now (which I successfully disabled) and have deleted McAfee - it no longer appears in my programmes list.
 

Attachments

  • Fixlog.txt
    27.8 KB · Views: 134

Jen

New Member
Thread author
Jan 2, 2014
6
Update: on relogging that Fix attachment you sent has solved the problem! Thanks so much for your prompt assistance.

Jen
 

Jen

New Member
Thread author
Jan 2, 2014
6
Yes, and I now have AdChoices adware instead - just appeared when I was browsing Radio Times TV Guide...
 

Jen

New Member
Thread author
Jan 2, 2014
6
Ok, finally done - it took 35 minutes to run ComboFix, so it must have been badly infected.
 

Attachments

  • ComboFix.txt
    25.7 KB · Views: 90

Jen

New Member
Thread author
Jan 2, 2014
6
Safesaver is definitely gone, which is the main thing - but I still have the AdChoices ads appearing which is clogging up my browser with nonsense, and I think slowing loading times down.
 

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Re-run FRST, press Scan and attach report.



Then...



Please download Farbar Service Scanner and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.




Then...



Please download zoek.zip or zoek.rar by smeenk (
Zoek_icon.png
) from here or here and save it to your Desktop.
Unpack the archive...
  • Close any open browsers
  • Temporarily disable your AntiVirus program. (If necessary)
    If you are unsure how to do this please read this or this Instruction.
  • Double click on zoek.exe to run the tool .
    Please wait while the tool does not start...
  • Copy the text present inside the code box below and paste it into the large window in the zoek tool:
Code:
createsrpoint;
StandardSearch;
installer-list;
installedprogs;
uninstall-list;
  • Click on
    Run%20Script%20by%20zoek.png
    button.
    Please wait until a logreport will open (this can be after reboot)
  • Save notepad to your Desktop and attach here zoek-results.log
    Note: It will also create a log in the C:\ directory named "zoek-results.log"
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top