Cannot entirely remove safesear.ch as homepage

Jessica Ruddell

New Member
Thread author
Apr 21, 2014
11
My son usually uses this computer for watching youtube and surfing the internet. He tends to click on anything and tends to junk up the computer, but this time I can not get it totally removed. I removed/deleted/quarantined everything that adwcleaner, Junkware removal tool, malwarebytes and hitman found when I scanned the computer today. I am not very computer savvy and I don't know what to do. I was going to just reload the whole computer because it is used for nothing more than surfing the web but I don't have a restore disc so I don't know how. Thanks for any help!
 

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Hi,



Please download zoek.zip or zoek.rar by smeenk (
Zoek_icon.png
) from here or here and save it to your Desktop.
Unpack the archive...
  • Close any open browsers
  • Temporarily disable your AntiVirus program. (If necessary)
    If you are unsure how to do this please read this or this Instruction.
  • Double click on zoek.exe to run the tool .
    Please wait while the tool does not start...
  • Copy the text present inside the code box below and paste it into the large window in the zoek tool:
    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

    Code:
    createsrpoint;
    gpt.ini;z 
    C:\Windows\System32\GroupPolicy;v
    C:\Windows\SysWOW64\GroupPolicy;v 
    StandardSearch; 
    emptyfolderscheck; 
    installer-list; 
    installedprogs; 
    uninstall-list;
  • Click on
    Run%20Script%20by%20zoek.png
    button.
    Please wait until a logreport will open (this can be after reboot)
  • Save notepad to your Desktop and attach here zoek-results.log
    Note: It will also create a log in the C:\ directory named "zoek-results.log"
 

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
> Re-run zoek with the script below and attach here fresh zoek log results.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system


Code:
C:\Windows\System32\GroupPolicy\GPT.INI;f
C:\Windows\SysWOW64\GroupPolicy\gpt.ini;f
C:\Windows\System32\GroupPolicy\Machine;fs
C:\Windows\System32\GroupPolicy\User;fs
gdfjhiclilbjdpeejgcgebmmihkkofji;chr
joefoganpblmedgjeigepgjfikhhdnnj;chr
mdpimdkibicpfbooggieeanoolfdfhhf;chr
hfilbhjibhnkbadajilnchkpmkhehadd;chr
autoclean;
emptyalltemp;
emptyclsid;
ipconfig /flushdns;b
emptyfolderscheck;delete
netsh winsock reset;b
 

Jessica Ruddell

New Member
Thread author
Apr 21, 2014
11
> Re-run zoek with the script below and attach here fresh zoek log results.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system


Code:
C:\Windows\System32\GroupPolicy\GPT.INI;f
C:\Windows\SysWOW64\GroupPolicy\gpt.ini;f
C:\Windows\System32\GroupPolicy\Machine;fs
C:\Windows\System32\GroupPolicy\User;fs
gdfjhiclilbjdpeejgcgebmmihkkofji;chr
joefoganpblmedgjeigepgjfikhhdnnj;chr
mdpimdkibicpfbooggieeanoolfdfhhf;chr
hfilbhjibhnkbadajilnchkpmkhehadd;chr
autoclean;
emptyalltemp;
emptyclsid;
ipconfig /flushdns;b
emptyfolderscheck;delete
netsh winsock reset;b

Here you go
 

Attachments

  • zoek-results2.txt
    16.9 KB · Views: 282

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
> Re-run zoek with the script below and attach here fresh zoek log results.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system


Code:
chromelook;
 

Jessica Ruddell

New Member
Thread author
Apr 21, 2014
11
> Re-run zoek with the script below and attach here fresh zoek log results.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system


Code:
chromelook;
here it is. Thank you for all of your help by the way:)
 

Attachments

  • zoek-results3.txt
    1.8 KB · Views: 92

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
> Re-run zoek with the script below and attach here fresh zoek log results.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system


Code:
akhnfnojlpmjnijjhkhpnkgldpplfnao;chr
emptyclsid;
emptyalltemp;
autoclean;
netsh winsock reset;b
ipconfig /flushdns;b
 

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.


  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
 

Jessica Ruddell

New Member
Thread author
Apr 21, 2014
11
Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.


  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Here are the files. I had run this program right before I posted my original thread so I have the addition.txt but it is from the 21st. I am attaching it though.
 

Attachments

  • FRST.txt
    76.6 KB · Views: 116
  • Addition.txt
    10.4 KB · Views: 374

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Open FRST, and click Fix. Attach me that report after it is finished.
 

Attachments

  • fixlist.txt
    945 bytes · Views: 72

Jessica Ruddell

New Member
Thread author
Apr 21, 2014
11
Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Open FRST, and click Fix. Attach me that report after it is finished.
just to confirm. I am saving the fixlist.txt to the desktop where the application and the other text file are located and then I am going to open the application and click fix?
 

Jessica Ruddell

New Member
Thread author
Apr 21, 2014
11
It is still doing the same thing as the pictures I sent you. I just tried to uninstall Chrome and it says I can't because it is open and running though it is not...
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top