Solved How to remove Safesearch toolbar

[argus]

Scan with RogueKiller

Please download RogueKiller and save the file to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the pre-scan will be done. It shouldn't take more than 2-3 minutes.
• Accept the Terms of use.
• When the Scan button becomes available, please click it. RogueKiller will start a full scan.
• Let this process run uninterrupted!.
• When finished, a Report button will become available. Click it. You will be presented with a logfile.

Please include the content of this logfile in your next reply.

 

[mdm2202]

Thx and good morning. Here it is

 

[argus]

Hi, good morning.



Double-click RogueKiller.exe to run again. (Vista/7/8 right-click and select Run as Administrator)

When "initializing/pre-scan" completes press the Scan button, this may take a few minutes to complete.

When the scan completes open the Registry tab and locate the following detections:

[PUM.Orphan] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad | WebCheck : {E6FB5E20-DE35-11CF-9C87-00AA005127ED} -> Found
[PUM.Orphan] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad | WebCheck : {E6FB5E20-DE35-11CF-9C87-00AA005127ED} -> Found
[PUM.Orphan] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> Found
[PUM.Orphan] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} -> Found
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : https://www.safesearch.net/?p=h&m=ie&c=wi&s=wi -> Found
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : https://www.safesearch.net/?p=h&m=ie&c=wi&s=wi -> Found



Make sure those entries are Checkmarked (ticked) also ensure that all other entries are not Checkmarked.

Hit the Delete button, when complete select "Report" post that log...

 

[mdm2202]

here it is

 

[argus]

[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : https://www.safesearch.net/?p=h&m=ie&c=wi&s=wi -> ERROR [5]
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : https://www.safesearch.net/?p=h&m=ie&c=wi&s=wi -> Not selected



Try again

 

[mdm2202]

Okay will try again. Forgot to say that I think safesearch came when downloading some Adobe update or other...that's what I was unwary

 

[mdm2202]

Okay I selected (checked) 2 items as per your instructions...

 

[mdm2202]

I don't know if I should be checking more than those....because Error 5 line appeared with safesearch as soon as I deleted it, on the registry list

 

[argus]

Try in Safe Mode

http://windows.microsoft.com/en-us/...-safe-mode#start-computer-safe-mode=windows-7

 

[mdm2202]

do you mean go into safemode and do a roguekiller scan after that? It's windows 8 system rather than 7 (as you put above)...so I will go for that. Do you want me to then just give you the registry report or to check and delete and if so which?

 

[argus]

or to check and delete and if so which?

Yes only it.

 

[mdm2202]

sorry don't understand. Check and delete only what?

 

[argus]

Yes.

 

[mdm2202]

Sorry let me get this clear, you want me to do scan in safe mode, look at registry entries and then please tell me again which entries on the list should check and delete....

 

[argus]

Delete this entries:

[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : https://www.safesearch.net/?p=h&m=ie&c=wi&s=wi -> ERROR [5]
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : https://www.safesearch.net/?p=h&m=ie&c=wi&s=wi ->

 

[mdm2202]

Hi this is report after safemode. I don't want to celebrate too soon but just hit IE browser icon and the tool bar was Microsoft....

 

[mdm2202]

Hi Argus , some questions:
- should I keep malware bytes and rogue killer and adwcleaner on the pc and should I use any of them to scan every so often? How often? - Also waiting to hear if you think I'm totally ok re safesearch toolbar or if there's anything else I should do.
- finally (Should I delete my usb drive with system and files back up or scan them too? Will the select tool bar thing have infiltrated them or not? I don't know how these things work - whether it's local
Many thanks

 

[argus]

Only Malwarebytes hold down, other tools we will delete.


The following will implement some post-cleanup procedures:


Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the
  
  icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run and wait until the tool completes his work.
• All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.



I recommended to use MCShield if you will.
It will prevent infection by computer via USB flash drive, mobile phone or any other memory card.
And not only will prevent infection, but it will immediately clean flash drive, memory card or external HDD.

http://www.mcshield.net/

 

[mdm2202]

Argus, you genius, have done it all. Two more things: I have another computer, a backup with windows 7. Obviously I move data from one to the other.
- What should I run to do general debug on that one and make sure that nothing from this one has got into that one?
- Does MCshield mean I don't have to run avast or should I run them together?

I will be recommending your site to friends and make a donation too! Thank you

 

[argus]

MCShield is not Antivirus, Avast and MCshiled can work together.
Backup I can not check, but the computer can.

I think it is clean backup, you had adware, is not a virus.