IE Browser hijacked: suspect Delta search is the culprit

Click here DDS

Click on Download Now button

When the download is complete . Drag the DDS program from the Downloads folder to your Desktop

Double click the DDS icon on the Desktop then click the Run button to run the tool.

Place a check next to attach.txt and click Start . When done, DDS will open two logs

• DDS.txt
• Attach.txt

Save two logs onto your desktop and upload them with your reply

Run Farbar Recovery Scan Tool


64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

FRST.txt and Addition.txt will be on the Desktop

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

Open notepad . Inside notepad paste the highlighted text below


start
() C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
HKLM\...\InprocServer32: [Default-cscui] <==== ATTENTION!
HKLM-x32\...\Run: [HOSTS Anti-Adware_PUPs] - C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe [302961 2013-07-29] ()
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
CHR DefaultSearchURL: (Delta Search) - http://www1.delta-search.com/?q={searchTerms}&affID=119351&tt=gc_&babsrc=SP_ss&mntrId=0EDDE0CA94F101E3
CHR DefaultSuggestURL: (Delta Search) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{googl e:cursorPosition}sugkey={google:suggestAPIKeyParameter}
S2 HOSTS Anti-PUPs; C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe [285795 2013-07-29] ()
2013-07-29 21:51 - 2013-07-29 21:51 - 00000000 ____D C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs
2013-07-29 21:51 - 2013-07-29 21:51 - 00001152 _____ C:\Users\Sylvia\Desktop\Desinstaller_HOSTS_Anti-PUPs.lnk
C:\Users\Sylvia\g2ax_customer_downloadhelper_win32_x86.exe
end


Click on File select Save as
Location: Desktop
File Name: Fixlist.txt
Save as type : All files

Click on the SAVE button. Close notepad

Open FRST64.exe and click on the [Fix] button . Once complete it will create a new log named Fixlog.txt on your desktop.

Restart the PC

Then scan the PC with RogueKiller

RogueKiller for 64bit <==== Download Link

Click on one of the links above that goes with your Windows 7 bit versions

Save to the Desktop.

Close all windows and browsers

Right click on and choose

Press: SCAN

provide the RKreport.txt (Mode: Scan) in your reply.

Run RogueKiller once again Click on the Delete button and then the Fix Host button.

Upload the Fixlog.txt file should be on your desktop.

That's the wrong log.

What happened to the Fixlog.txt file ?