Unable to remove some adware

Hello,

@Clarkwong : please share the logfile generated by AdwCleaner when you used it. They are in C:\AdwCleaner.

@nutech2014 : please open your own topic, we'll help you there.

# AdwCleaner v5.035 - Logfile created 19/02/2016 at 09:00:12
# Updated 18/02/2016 by Xplode
# Database : 2016-02-18.5 [Server]
# Operating system : Windows 10 Home  (x64)
# Username : Owner - OWNER-PC
# Running from : C:\Users\Owner\Downloads\adwcleaner_5.035 (1).exe
# Option : Cleaning
# Support : http://toolslib.net/forum


***** [ Services ] *****


***** [ Folders ] *****


[-] Folder Deleted : C:\Users\Owner\AppData\Local\YSearchUtil
[-] Folder Deleted : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Local\YSearchUtil


***** [ Files ] *****


[-] File Deleted : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bakijjialdiiboeaknfpmflphhmljfkd
[-] File Deleted : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\iagcajndpnfncplednpbnkahadegklfa


***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


[-] Task Deleted : GoogleUpdateTaskUserS-1-5-21-773325539-3909646172-2599382993-1000Core
[-] Task Deleted : GoogleUpdateTaskUserS-1-5-21-773325539-3909646172-2599382993-1000UA
[-] Task Deleted : GoogleUpdateTaskUserS-1-5-21-773325539-3909646172-2599382993-1000Core
[-] Task Deleted : GoogleUpdateTaskUserS-1-5-21-773325539-3909646172-2599382993-1000UA


***** [ Registry ] *****


[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! SearchSet


***** [ Web browsers ] *****


*************************


:: "Tracing" keys removed :: Winsock settings cleared


########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1544 bytes] ##########

@Nuctech2014 : Open your own topic please. (click on the "new thread" button on the top right corner on this page).

Thanks.

Hello,

@Clarkwong : please share the logfile generated by AdwCleaner when you used it. They are in C:\AdwCleaner.

 

@nutech2014 : please open your own topic, we'll help you there.

---

fr33tux, 2016-02-20 15:48:49 (UTC)

As per request, the following is the result of using the latest adwcleaner

# AdwCleaner v5.036 - Logfile created 24/02/2016 at 05:48:58
# Updated 22/02/2016 by Xplode
# Database : 2016-02-22.2 [Server]
# Operating system : Windows 7 Home Premium  (x64)
# Username : user - USER-PC
# Running from : C:\Users\user\Downloads\Programs\adwcleaner_5.036.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

***** [ Files ] *****

[-] File Deleted : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_st.chatango.com_0.localstorage
[-] File Deleted : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_st.chatango.com_0.localstorage-journal
[-] File Deleted : C:\Windows\SysNative\drivers\kisknl_del.sys

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Shared Tools\MsConfig\StartupReg\QvodTerminal

***** [ Web browsers ] *****

[-] [C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Deleted : hxxp://websearch.fastosearch.info/?pid=1319&r=2014/06/18&hid=10562822683258151075&lg=EN&cc=MY&unqvl=55
[-] [C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Deleted : hxxp://www.omniboxes.com/?type=hp&ts=1425164643&from=obw&uid=ST9640320AS_5WX40R4VXXXX5WX40R4V
[-] [C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Homepage] Deleted : hxxp://search.conduit.com/?ctid=CT3310393&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SPC6ED4181-F5B0-4760-9EEA-38A3898CC883&SSPV=

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [903 bytes] - [18/02/2016 05:02:49]
C:\AdwCleaner\AdwCleaner[C2].txt - [1303 bytes] - [18/02/2016 12:29:12]
C:\AdwCleaner\AdwCleaner[C3].txt - [1471 bytes] - [18/02/2016 14:54:41]
C:\AdwCleaner\AdwCleaner[C4].txt - [7038 bytes] - [18/02/2016 16:19:00]
C:\AdwCleaner\AdwCleaner[C5].txt - [2165 bytes] - [24/02/2016 05:48:58] C:\AdwCleaner\AdwCleaner[S1].txt - [799 bytes] - [18/02/2016 04:49:21]
C:\AdwCleaner\AdwCleaner[S2].txt - [741 bytes] - [18/02/2016 05:06:49]
C:\AdwCleaner\AdwCleaner[S3].txt - [707 bytes] - [18/02/2016 07:52:24]
C:\AdwCleaner\AdwCleaner[S4].txt - [1220 bytes] - [18/02/2016 09:41:51]
C:\AdwCleaner\AdwCleaner[S5].txt - [1157 bytes] - [18/02/2016 10:29:31]
C:\AdwCleaner\AdwCleaner[S6].txt - [1355 bytes] - [18/02/2016 14:53:51]
C:\AdwCleaner\AdwCleaner[S7].txt - [7652 bytes] - [18/02/2016 16:16:03]
C:\AdwCleaner\AdwCleaner[S8].txt - [718 bytes] - [19/02/2016 05:46:37]
C:\AdwCleaner\AdwCleaner[S9].txt - [2804 bytes] - [24/02/2016 05:44:49]

########## EOF - C:\AdwCleaner\AdwCleaner[C5].txt - [2891 bytes] ##########

FYI, i enabled the Sync Now features on the Firefox to keep my bookmarks, password and tabs. Will it be one of the cause for the removal of hao123 failed?

Hello,

Great !

Yes, please disable the synchronization temporary.

I'll need more information :

• Download ZHPDiag from Nicolas on his website
• Then run it with administrator's rights (with right click)
• Then upload the log file on up2share (you will find it on your desktop, just drop the file on the upload zone)
• Then post the link in your reply

What i got when i running the program

https://up2sha.re/file?f=9tr4I3SonEA6

Hello,

I'm waiting a feedback from the developer.. Sorry for the bug.

Hello,

I'm waiting a feedback from the developer.. Sorry for the bug.

---

fr33tux, 2016-02-24 10:17:19 (UTC)

Its is ok since i have waited long for the solution. Just wondering, i ever try to find the registry of hao123 and deleted it, at first it was on both firefox and chrome, then after my effort only manage to clear chrome one.

THe developer is looking at the bug.

In the meantime, we'll use FRST :

1. Download FRST
2. Right-click on the file -> "Execute as Administrator"
3. Click on the "Scan" button
4. The logfile is saved as FRST.txt , and additional informations are in Addition.txt.
5. Please host them on Up2Share and share the generated links.

Regards,

THe developer is looking at the bug.

In the meantime, we'll use FRST :

1. Download FRST
2. Right-click on the file -> "Execute as Administrator"
3. Click on the "Scan" button
4. The logfile is saved as FRST.txt , and additional informations are in Addition.txt.
5. Please host them on Up2Share and share the generated links.

Regards,

---

fr33tux, 2016-02-24 12:37:37 (UTC)

https://up2sha.re/file?f=mdGvciFR7Ws9

https://up2sha.re/file?f=k1j3oMOBS1WP

Thats the result of scanning

Hello,

Sorry for the delay.

We'll try to use MBAM hoping it will remove all elements I found in the logfile. Otherwise, we'll remove them "manually" :

• Download MalwareBytes Anti Malware here.
• Launch MalwareByte's Anti Malware from your desktop
• Click on the tab Settings -> Detection & Protection -> PUP/PUM and check "Treat these detections like malware".
• Tab Exam choose Threats, click on Scan now, and click on Launch the exam.
• If something is detected, choose to Quarantine everything. If it asks you to reboot the computer, do it.
• After the reboot (or at the end of the exam), launch Malwarebytes -> click on History -> Application logs -> Select the last exam log -> Show.
• Click on Export -> text file (*.txt) -> Choose the desktop as destination, name the file "report-mbam" for example, and click on Save.
• Paste the logfile in your next answer.

Regards,