I followed the safesaver removal guide but it still appears...

[Jen]

Hi All,

Yesterday (1 Jan 2014) I noticed that safesaver links, ads and popups were appearing when I was browsing the BBC News site.

I have run a scan using Microsoft Security Essentials; run CC Cleaner and removed all files etc it found; gone into my system and removed all unfamiliar and new programmes - there were quite a few I removed, but none called safesaver. I then followed your guide fully, which removed quite a few items - but the issue has not been resolved fully - the links and popups still appear.

Many thanks for your help.

Jen

 

[TwinHeadedEagle]

Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)

Open FRST, and click Fix. Attach me that report after it is finished.



1. Please download ComboFix by sUBs from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guidehttp://www.bleepingcomputer.com/combofix/how-to-use-combofix carefully.
Note: ComboFix must be downloaded to your Desktop.

--------------------------------------------------------------------
2. Temporarily disable your AntiVirus program.
If you are unsure how to do this please read http://www.techsupportforum.com/forums/f50/how-to-disable-your-security-applications-490111.htmlthis or this Instruction.


Note: Do not forget to turn on this option after the cleaning.

--------------------------------------------------------------------
3. Run ComboFix. Click on I Agree!

ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix's window while it is running.
If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart computer once more.

--------------------------------------------------------------------
4. When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
Attach log reports ( ComboFix.txt) back to topic.

 

[Jen]

Thanks for your reply. I have attached the FRST Fixlog. I tried to use Combofix, but it kept telling me that it detected McAfee running. I can't understand why this would be the case as I use Microsoft Security Essentials now (which I successfully disabled) and have deleted McAfee - it no longer appears in my programmes list.

 

[Jen]

Update: on relogging that Fix attachment you sent has solved the problem! Thanks so much for your prompt assistance.

Jen

 

[TwinHeadedEagle]

We're not yet done, there were signs of dangerous virus in the logs, are you still with me?

 

[Jen]

Yes, and I now have AdChoices adware instead - just appeared when I was browsing Radio Times TV Guide...

 

[TwinHeadedEagle]

Run ComboFix and ignore McAfee warning...

 

[Jen]

Ok, finally done - it took 35 minutes to run ComboFix, so it must have been badly infected.

 

[TwinHeadedEagle]

How are the things now?

 

[Jen]

Safesaver is definitely gone, which is the main thing - but I still have the AdChoices ads appearing which is clogging up my browser with nonsense, and I think slowing loading times down.

 

[TwinHeadedEagle]

Re-run FRST, press Scan and attach report.



Then...



Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure the following options are checked:
  
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center/Action Center
  • Windows Update
  • Windows Defender
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

Then...



Please download zoek.zip or zoek.rar by smeenk (

) from here or here and save it to your Desktop.
Unpack the archive...

• Close any open browsers
• Temporarily disable your AntiVirus program. (If necessary)
  If you are unsure how to do this please read this or this Instruction.
  
• Double click on zoek.exe to run the tool .
  Please wait while the tool does not start...
  
• Copy the text present inside the code box below and paste it into the large window in the zoek tool:

createsrpoint;
StandardSearch;
installer-list;
installedprogs;
uninstall-list;

• Click on
  
  button.
  Please wait until a logreport will open (this can be after reboot)
  
• Save notepad to your Desktop and attach here zoek-results.log
  Note: It will also create a log in the C:\ directory named "zoek-results.log"