Hello, I have a problem with GooSavve Adware and can't get rid of it. It was installed along webbing adware, which I could remove with help of http://malwaretips.com/blogs/remove-webbing-virus/.
Please help!
Please help!
Open MalwareTips from your Home Screen or desktop. Follow discussions, find answers and pick up where you left off.
If you cannot find an install option, update your browser or use its bookmark option to keep MalwareTips close.
After installation, open the app and sign in. Enable push notifications in Preferences if you want alerts. On iPhone and iPad, push requires a Home Screen web app and iOS or iPadOS 16.4 or later.
Sign in to manage notificationsInstallation is optional. Your notification settings stay under your control.
createsrpoint;
autoclean;
emptyalltemp;
ihhcgneclekbpieljoldmlgdfnpmailc;chr
ipconfig /flushdns;b
Zoek.exe v5.0.0.0 Updated 27-09-2014
Tool run by Thesa on 30.09.2014 at 14:06:14,14.
Microsoft Windows 8.1 Pro 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: E:\Dateien\Desktop\zoek.exe [Scan all users] [Script inserted]
==== Older Logs ======================
C:\zoek-results2014-09-30-074733.log 68069 bytes
==== System Restore Info ======================
30.09.2014 14:06:42 Zoek.exe System Restore Point Created Succesfully.
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== Batch Command(s) Run By Tool======================
==== Deleting Files \ Folders ======================
C:\Users\Thesa\.android deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\WINDOWS\SysNative\config\systemprofile\Searches deleted
==== Chromium Look ======================
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
flliilndjeohchalpbbcdekjklbdgfkk - No path found[]
NNeixtCCoup - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ejlhlnfeadboekhnmajdgmofcijfjdab
HTML Coupon - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eohjkphdfajdfhpmdaedemmgmbidbldc
GooSavve - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc
WWebbing - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ingmgdifdjbjlfeigpnbliegaociknki
NeixtCoup - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nibeelphjbmmehlpljhkbccgdbmmhpin
GooSavve - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc
NNeixtCCoup - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ejlhlnfeadboekhnmajdgmofcijfjdab
HTML Coupon - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eohjkphdfajdfhpmdaedemmgmbidbldc
GooSavve - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc
WWebbing - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ingmgdifdjbjlfeigpnbliegaociknki
NeixtCoup - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\nibeelphjbmmehlpljhkbccgdbmmhpin
NNeixtCCoup - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ejlhlnfeadboekhnmajdgmofcijfjdab
HTML Coupon - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eohjkphdfajdfhpmdaedemmgmbidbldc
GooSavve - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc
WWebbing - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ingmgdifdjbjlfeigpnbliegaociknki
NeixtCoup - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nibeelphjbmmehlpljhkbccgdbmmhpin
GooSavve - Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc
NNeixtCCoup - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ejlhlnfeadboekhnmajdgmofcijfjdab
HTML Coupon - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eohjkphdfajdfhpmdaedemmgmbidbldc
GooSavve - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc
WWebbing - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ingmgdifdjbjlfeigpnbliegaociknki
NeixtCoup - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\nibeelphjbmmehlpljhkbccgdbmmhpin
NNeixtCCoup - Thesa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ejlhlnfeadboekhnmajdgmofcijfjdab
HTML Coupon - Thesa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eohjkphdfajdfhpmdaedemmgmbidbldc
GooSavve - Thesa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc
WWebbing - Thesa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ingmgdifdjbjlfeigpnbliegaociknki
NeixtCoup - Thesa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nibeelphjbmmehlpljhkbccgdbmmhpin
==== Chromium Startpages ======================
C:\Users\Thesa\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "http://www.google.com/",
"startup_urls": [ "http://search.conduit.com/?ctid=CT3...=SPF6D1DC74-A61D-42C2-B491-E7A691CB481F&SSPV=", "http://websearch.searchandfly.info/...hid=17810449134802125547&lg=EN&cc=DE&unqvl=62" ],
==== Chromium Fix ======================
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc deleted successfully
C:\Users\Thesa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ihhcgneclekbpieljoldmlgdfnpmailc deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eohjkphdfajdfhpmdaedemmgmbidbldc deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eohjkphdfajdfhpmdaedemmgmbidbldc deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eohjkphdfajdfhpmdaedemmgmbidbldc deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eohjkphdfajdfhpmdaedemmgmbidbldc deleted successfully
C:\Users\Thesa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eohjkphdfajdfhpmdaedemmgmbidbldc deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ejlhlnfeadboekhnmajdgmofcijfjdab deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ejlhlnfeadboekhnmajdgmofcijfjdab deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ejlhlnfeadboekhnmajdgmofcijfjdab deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ejlhlnfeadboekhnmajdgmofcijfjdab deleted successfully
C:\Users\Thesa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ejlhlnfeadboekhnmajdgmofcijfjdab deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ingmgdifdjbjlfeigpnbliegaociknki deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ingmgdifdjbjlfeigpnbliegaociknki deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ingmgdifdjbjlfeigpnbliegaociknki deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ingmgdifdjbjlfeigpnbliegaociknki deleted successfully
C:\Users\Thesa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ingmgdifdjbjlfeigpnbliegaociknki deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nibeelphjbmmehlpljhkbccgdbmmhpin deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\nibeelphjbmmehlpljhkbccgdbmmhpin deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nibeelphjbmmehlpljhkbccgdbmmhpin deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\nibeelphjbmmehlpljhkbccgdbmmhpin deleted successfully
C:\Users\Thesa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nibeelphjbmmehlpljhkbccgdbmmhpin deleted successfully
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
==== Deleting Registry Keys ======================
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk deleted successfully
==== Empty IE Cache ======================
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Thesa\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Thesa\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
==== Empty FireFox Cache ======================
No FireFox Profiles found
==== Empty Chrome Cache ======================
C:\Users\Thesa\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
Flash Cache Emptied Successfully
==== Empty All Java Cache ======================
Java Cache cleared successfully
==== C:\zoek_backup content ======================
C:\zoek_backup (files=140 folders=56 1206505 bytes)
==== Empty Temp Folders ======================
C:\Users\Administrator\AppData\Local\Temp emptied successfully
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Thesa\AppData\Local\Temp will be emptied at reboot
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\WINDOWS\Temp successfully emptied
C:\Users\Thesa\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== EOF on 30.09.2014 at 14:16:24,09 ======================

Members who viewed this thread in the last 5 minutes