inbox.com infection

One of my club members has a problem on his laptop. When he opens his browser (Chrome) it opens at the page inbox,dot,com. Typed it like that as typing the actual address creates a link which I didn't want to publish as I am not sure how this nastie is spread! So I just reset his homepage to Google as he had before. I then thought I had better check this out and have spent the last hour reading all I can find on the net. It would appear to be malware. I am running a ull scan on his machine at the moment and then intend to run Malwarebytes and Ccleaner later. There seem to be so many different theories of how to get rid of this and none seem conclusive. The thing I have found is that just when you think you have got rid of it, two weeks or so later it comes back! I did a search here but can find no reference to inbox,dot,com. Can anyone offer any assistance please? I would really like to help this member.

EDIT: If all else fails when I set this new lappy up for this chap I installed Macrium reflect so I have a back up image dated 23rd June 2013 so can restore to that is really necessary.

Have you tried these programs

AdwCleaner

Click here AdwCleaner

Click on Download Now button

Save to the Desktop

Right-click on AdwCleaner.exe and choose

Click on Clean and confirm the prompt.


Upload the log : The log file is at C:\AdwCleaner[n].txt

Junkware Removal Toolkit

Click here Junkware Removal Tool to download

Drag the JRT.exe from the Downloads folder to your Desktop

Right click JRT.exe and choose

Once done upload the JRT.txt file

Well all scans are now complete and I attach the two log files. From my naive view it looks like Adwcleaner has found and deleted the offending software. But will leave the proper interpretation to you!
Thanks

AdwCleaner[S2].txt
JRT.txt

Has your issue been fixed ?

VistaKing said:

Has your issue been fixed ?

So far so good but this problem has a habit, apparently, of seeming to be cured and then rearing it's ugly head again some few days later.
I will return the lappy to my friend tomorrow and no doubt he will come back to me if it happens again. Will mark this as Solved and raise again if I need to later. Thanks again:)

Lets run this on the laptop .

Run Farbar Recovery Scan Tool


64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

FRST.txt and Addition.txt will be on the Desktop

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

After the scan should I click the Fix button?

No upload the logs please .

Thanks here they are:
FRST.txt
Addition.txt

I still see some stuff listed .

Malwarebytes

I see its already installed . Follow the steps below

Update the definitions and do a full scan

On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.

Log looks like this : mbam-log-yyyy-mm-dd

Log located : C:\Users\{Your UserName}\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs or C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs


Once done rerun FRST from the Desktop not a USB Drive . Drag the FRST64 from the USB to the desktop . Click on Scan and upload the new FRST.txt log .