Websearch.lookforithere.info removal did not work

[ebojorq]

 

[Fiery]

Hi ebojorq and welcome to MalwareTips!

I'm Fiery and I would gladly assist you in removing the malware on your computer.

PLEASE NOTE: The first 3 posts of ALL new members require approval by mods/admins. Please be patient if you don't see your post immediately after submitting it.

Before we start:

• Note that the removal process is not immediate. Depending on the severity of your infection, it could take a long time.
• Malware removal can be dangerous. I cannot guarantee the safety of your system as malware can be unpredictable. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system. Therefore, I would advise you to backup all your important files before we start.
• Please be patient and stay with me until I give you the green lights and inform you that your PC is clean.
• Some tools may be flagged by your antivirus as harmful. Rest assure that ALL the tools we use are safe, the detections are false positives.
• The absence of symptoms does not mean your PC is fully disinfected.
• If you are unclear about the instructions, please stop and ask. Following the steps in the order that I post them in is vital.
• Lastly, if you have requested help on other sites, that will delay and hinder the removal process. Please only stick to one site.

<hr>
Please download Junkware Removal Tool to your desktop from here

• Turn off your antivirus software now to avoid potential conflicts
• Double-click to run the tool. For Windows Vista or 7 users, right-click the file and select Run as Administrator
• The tool will open and start scanning your system
• Please be patient as this can take a while to complete depending on your system's specifications
• On completion, a log (JRT.txt) will be saved to your desktop and will automatically open
• Post the contents of JRT.txt into your next reply

Download OTL by Old Timer from here and save it to your Desktop.

• Double click on OTL.exe to run it.
• Click the Scan All Users checkbox.
• Check the boxes beside LOP Check and Purity Check
• Click on Run Scan at the top left hand corner.
• When done, two Notepad files will open.
  • OTL.txt <-- Will be opened
  • Extra.txt <-- Will be minimized
• Please attach the contents of these 2 Notepad files in your next reply.

If you don't know how to attach the files, please follow the instructions here: http://malwaretips.com/Thread-How-to-use-the-attachment-system?pid=16072#pid16072

 

[ebojorq]

thanks a lot, Fiery. I will backup my important data and follow your instructions. I'll come back with the log files when I'm done.

 

[ebojorq]

I'm finally back, Fiery.

Here are the log files created by the two programs you instructed me to use.

It creates the two files you told plus "EXTRAS.TXT". This extras one was created by OTL.

Attached are the three files.

After running the two programs it keeps trying to open lookforithere as home page even though it is not listed as homepage either in IE nor Chrome which are the only browsers I have installed.

 

[Fiery]

Hi,

Please disconnect your PC from the internet while I analyse your log and come up with a fix.

 

[Fiery]

Hi,

Download Malwarebytes Anti-Rootkit from here to your Desktop

• Unzip the contents to a folder on your Desktop.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Make sure there is a check next to Create Restore Point and click the Cleanup button to remove any threats. Reboot if prompted to do so.
• After the reboot, perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If there are threats, click Cleanup once more and reboot.
• When done, please post the two logs in the MBAR folder(mbar-log.txt and system-log.txt)

Download & SAVE to your Desktop RogueKiller or from here

• Quit all programs that you may have started.
• Please disconnect any USB or external drives from the computer before you run this scan!
• For Vista or Windows 7, right-click and select Run as Administrator to start
• Wait until Prescan has finished, then click on "Scan" button
• Wait until the Status box shows "Scan Finished"
• Click delete and wait until it saids deleting finished
• Click on "Report" and copy/paste the content of the Notepad into your next reply.
• The log should be found in RKreport[1].txt on your Desktop
  Exit/Close RogueKiller+

 

[ebojorq]

I'm sorry I didn't answer before. I just saw this message and didn't get a notification by mail. I'll try what you say and come back with results.

 

[ebojorq]

Here are the results of anti-rootkit and rogue killer.

Anti-Rootkit finished the scan saying it hadn't found any malware, but I continue to see the lookforithere redirection everytime I start Google Chrome from the shortcut. When I open it to show for example my mail, it doesn't show up.

Roguekiller found three files and deleted them. Besides, it created a folder in my desktop: RK_Quarantine.

I'm about to see if it solved the issue but I want to reboot my computer first. I'll come back as soon as this is done.

 

[ebojorq]

Nope... I restarted my computer, unisntalled Chrome, restarted again, reinstalled Chrome and it still opens lookforithere as homepage eventhough it's not the one that appears in the settings page for Google Chrome.

What's worse, before all this McAfee used to block the page as unsafe. Now it doesn't even detect it.

When I open IE 10, though, it doesn't show this page.

 

[ebojorq]

Nope... I restarted my computer, unisntalled Chrome, restarted again, reinstalled Chrome and it still opens lookforithere as homepage eventhough it's not the one that appears in the settings page for Google Chrome.

What's worse, before all this McAfee used to block the page as unsafe. Now it doesn't even detect it.

When I open IE 10, though, it doesn't show this page.

My bad.

I confused the home page (which I had changed already) with the "open at start up" page.

I deleted it from there and I'm all set now.

Thank you very much for your help!!

 

[Fiery]

Ah ok

Anything else you need help with?