Downloaded Tuvaro, malware, cannot delete, redirects.

aintnorock · 09 Jan 2014

My wife unfortunately hit the wrong button and downloaded Tuvaro, malware that redirects your home screen in IE and Chrome to a Tuvaro Bing search. I've googled it, saw several fixes, and I think I've fixed most of the problem, but whenever I open IE or Chrome, it redirects to this Tuvaro screen.

The program no longer shows up as a current program, I think I've deleted it with Malware Bytes and SpyBot, but it continues to do it. I've search the registry for "tuvaro" and can't find it.

Is there anything that I can do to get it to stop?

Layback Bear · 09 Jan 2014

Try using AdwCleaner from the Bleeping Computer site.

AdwCleaner Download

cottonball · 09 Jan 2014

Welcome to the forum, aintnorock!

Please use the tool Zoek:
Download > http://hijackthis.nl/smeenk/

Select the .zip version, and save to the Desktop.

On the Desktop, right-click the .zip file, and select: Extract to Zoek\, or the option that extracts the tool to its own folder on the Desktop.

Open the new Zoek folder on the Desktop, and double-click zoek.exe to start the program. (Give it a few seconds to appear.)

If your AntiVirus warns you about the program, either allow Zoek to run, or temporarily disable your AV program.
Info on how to disable your security applications > http://www.bleepingcomputer.com/forums/topic114351.html

Next, copy/paste the entire script in the code box below to the input field of Zoek:

Code:

createsrpoint; 
process; 
filesrcm; 
startupall; 
installedprogs;
installer-list; 
uninstall-list;
hijackthis; 
firefoxlook; 
chromelook;  
srinfo; 
DIR /S /A:L "%systemdrive%\*">>"%temp%\log.txt";b

Now...

Close any open Browsers.
Click the Run script button, and wait. It takes a few minutes to run all the script.
When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed log is opened after the reboot.

Please post the zoek-results.log in your reply.

Thanks!

Layback Bear · 09 Jan 2014

aintnorock please follows cottonball suggestions and recommendations.

aintnorock · 17 Jan 2014

I've been way behind in email and just saw the replies. I will try Cottonballs suggestion tomorrow.

aintnorock · 21 Jan 2014

cottonball said:

Welcome to the forum, aintnorock!

Please post the zoek-results.log in your reply.

Thanks!

attached is the log file

zoek-results.txt

cottonball · 22 Jan 2014

This one is a bummer.
You got Tuvaro after installing free software that bundled it into their installer.
The problem is finding what was installed!!

Please run Zoek again.

Next, copy/paste the entire script inside the code box below to the input field of Zoek:

Code:

iedefaults;
CHRdefaults;
autoclean;
emptyclsid;
emptyalltemp;
createsrpoint;

Now...

Close any open Browsers.

Click the Run script button, and wait. It takes a few minutes to run all the script.

When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed log is opened after the reboot.

Please post the zoek-results.log in your reply.

aintnorock · 24 Jan 2014

here's the latest:

thanks for your help

cottonball · 27 Jan 2014

Any progress?

Are you still getting redirections in IE and Chrome to a Tuvaro Bing search?

aintnorock · 27 Jan 2014

cottonball said:

Any progress?

Are you still getting redirections in IE and Chrome to a Tuvaro Bing search?

Yes I am getting the redirect. No progress has been made.

Downloaded Tuvaro, malware, cannot delete, redirects.

Downloaded Tuvaro, malware, cannot delete, redirects.

latest log results