Downloaded Tuvaro, malware, cannot delete, redirects.

[aintnorock]

My wife unfortunately hit the wrong button and downloaded Tuvaro, malware that redirects your home screen in IE and Chrome to a Tuvaro Bing search. I've googled it, saw several fixes, and I think I've fixed most of the problem, but whenever I open IE or Chrome, it redirects to this Tuvaro screen.

The program no longer shows up as a current program, I think I've deleted it with Malware Bytes and SpyBot, but it continues to do it. I've search the registry for "tuvaro" and can't find it.

Is there anything that I can do to get it to stop?

 

[Layback Bear]

Try using AdwCleaner from the Bleeping Computer site.

AdwCleaner Download

 

[cottonball]

Welcome to the forum, aintnorock!

Please use the tool Zoek:
Download > http://hijackthis.nl/smeenk/

Select the .zip version, and save to the Desktop.

On the Desktop, right-click the .zip file, and select: Extract to Zoek\, or the option that extracts the tool to its own folder on the Desktop.

Open the new Zoek folder on the Desktop, and double-click zoek.exe to start the program. (Give it a few seconds to appear.)


If your AntiVirus warns you about the program, either allow Zoek to run, or temporarily disable your AV program.
Info on how to disable your security applications > http://www.bleepingcomputer.com/forums/topic114351.html


Next, copy/paste the entire script in the code box below to the input field of Zoek:

createsrpoint; 
process; 
filesrcm; 
startupall; 
installedprogs;
installer-list; 
uninstall-list;
hijackthis; 
firefoxlook; 
chromelook;  
srinfo; 
DIR /S /A:L "%systemdrive%\*">>"%temp%\log.txt";b

Now...

• Close any open Browsers.
• Click the Run script button, and wait. It takes a few minutes to run all the script.
• When the tool finishes, the zoek-results.log is opened in Notepad.
• The log is also found on the systemdrive, normally C:\
• If a reboot is needed log is opened after the reboot.

:ar: Please post the zoek-results.log in your reply.


Thanks!

 

[Layback Bear]

aintnorock please follows cottonball suggestions and recommendations.

 

[aintnorock]

I've been way behind in email and just saw the replies. I will try Cottonballs suggestion tomorrow.

 

[aintnorock]

Welcome to the forum, aintnorock!

:ar: Please post the zoek-results.log in your reply.


Thanks!

attached is the log file

View attachment zoek-results.txt

 

[cottonball]

This one is a bummer.
You got Tuvaro after installing free software that bundled it into their installer.
The problem is finding what was installed!!

Please run Zoek again.

Next, copy/paste the entire script inside the code box below to the input field of Zoek:

iedefaults;
CHRdefaults;
autoclean;
emptyclsid;
emptyalltemp;
createsrpoint;

Now...

Close any open Browsers.

Click the Run script button, and wait. It takes a few minutes to run all the script.

When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed log is opened after the reboot.

:ar: Please post the zoek-results.log in your reply.

 

[aintnorock]

latest log results

here's the latest:

thanks for your help

 

[cottonball]

Any progress?

Are you still getting redirections in IE and Chrome to a Tuvaro Bing search?

 

[aintnorock]

Any progress?

Are you still getting redirections in IE and Chrome to a Tuvaro Bing search?

Yes I am getting the redirect. No progress has been made.

 

[Jacee]

Detailed 'manual' instructions to remove Tuvaro re-direct: How to Remove Tuvaro.com Virus from IE/FF/Chrome (Tuvaro.com Redirect Virus Removal Guide) | Anvisoft KnowledgeBase