Solved IE Browser hijacked: suspect Delta search is the culprit

[webgal318]

I have done the following without any success

Ran ADW cleaner at least 3 times and restarted each time
Ran thorough scan with MSE: negative
Performed full scan with Malwarebytes and SuperAntispyware: deleted all adware/spyware
I went to IE options and disabled all BHO that were in the list and I tried to reset my home page to https:google.com and CNN.com - Breaking News, U.S., World, Weather, Entertainment & Video News. The browser tries to load the pages that I set as defaut and it just hangs.

I am sending you this message with Google Chrome Browser.

 

[VistaKing]

Click here DDS

:ar: Click on Download Now button

:ar: When the download is complete . Drag the DDS program from the Downloads folder to your Desktop

:ar: Double click the DDS icon on the Desktop then click the Run button to run the tool.

:ar: Place a check next to attach.txt and click Start . When done, DDS will open two logs

• DDS.txt
• Attach.txt

:ar: Save two logs onto your desktop and upload them with your reply

 

[webgal318]

DDS files attached

Here you go!
Thanks a bunch!

Sylvia

 

[VistaKing]

Run Farbar Recovery Scan Tool

64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[webgal318]

Log files FRST.txt and Addition.txt

Here you go and thanks again!

Sylvia

 

[VistaKing]

Open notepad . Inside notepad paste the highlighted text below


start
() C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
HKLM\...\InprocServer32: [Default-cscui] <==== ATTENTION!
HKLM-x32\...\Run: [HOSTS Anti-Adware_PUPs] - C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe [302961 2013-07-29] ()
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
CHR DefaultSearchURL: (Delta Search) - http://www1.delta-search.com/?q={searchTerms}&affID=119351&tt=gc_&babsrc=SP_ss&mntrId=0EDDE0CA94F101E3
CHR DefaultSuggestURL: (Delta Search) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
S2 HOSTS Anti-PUPs; C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe [285795 2013-07-29] ()
2013-07-29 21:51 - 2013-07-29 21:51 - 00000000 ____D C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs
2013-07-29 21:51 - 2013-07-29 21:51 - 00001152 _____ C:\Users\Sylvia\Desktop\Desinstaller_HOSTS_Anti-PUPs.lnk
C:\Users\Sylvia\g2ax_customer_downloadhelper_win32_x86.exe
end


Click on File select Save as
Location: Desktop
File Name: Fixlist.txt
Save as type : All files

Click on the SAVE button. Close notepad

Open FRST64.exe and click on the [Fix] button . Once complete it will create a new log named Fixlog.txt on your desktop.

Restart the PC

Then scan the PC with RogueKiller

RogueKiller for 64bit <==== Download Link

:ar: Click on one of the links above that goes with your Windows 7 bit versions

:ar: Save to the Desktop.

:ar: Close all windows and browsers

:ar: Right click on

and choose

:ar: Press: SCAN

:ar: provide the RKreport.txt (Mode: Scan) in your reply.

 

[webgal318]

RK report

I am attaching the report. I did not delete anything since you did not tell me to do that yet.

Thanks again.

-Sylvia

 

[VistaKing]

Run RogueKiller once again Click on the Delete button and then the Fix Host button.

Upload the Fixlog.txt file should be on your desktop.

 

[webgal318]

RK report

OK. I deleted and then hit the Fix Host button.

Thanks again.

Sylvia

 

[VistaKing]

That's the wrong log.

What happened to the Fixlog.txt file ?

 

[webgal318]

Fixlog file

Hello again

I got really busy all of a sudden so I am just getting back to you with the correct file.

Please check the fixlog.txt file.

Thanks again!

 

[VistaKing]

Take a look at this link to remove Delta Search from Chrome

:ar: Remove Delta Search (Uninstall Guide)

 

[webgal318]

Browser was hijacked by Delta and is now fixed

I checked IE add-ons and clicked on the <SEARCH PROVIDERS> tab. Google was the only one listed but I highlighted it anyway then clicked on search for more providers hyperlink at the bottom of the screen.
I then selected Google and I was then prompted to update it which I did.
After updating Google, my page loaded just fine.
At present time the only Search Providers listed are Google and Bing. Google is set to number 1 and Bing to 2.

 

[VistaKing]

Is this inside Google Chrome or IE ? I noticed that inside Google Chrome

 

[webgal318]

IE browser

This was inside IE. Iwas using Chrome for posting my threads because IE wasn't working.

 

[VistaKing]

The Delta Search is inside Google Chrome . Click on the 3 bar button on the far right side select Settings and remove Delta Search from Search section .

 

[webgal318]

Delta toolbar is gone

Thanks for the tip. I removed the Delta, Conduit, Blekko, MyWebSearch toolbars as well.

 

[VistaKing]

How's the PC running ?

Download Junkware Removal Toolkit

Click here Junkware Removal Tool to download

Drag the JRT.exe from the Downloads folder to your Desktop

Right click JRT.exe and choose

Once done upload the JRT.txt file