Jump to content

Removal instructions for BoBrowser


Recommended Posts

  • Staff

What is BoBrowser?

The Malwarebytes research team has determined that BoBrowser is actually a mix of programs designed to hijack your browser(s) and stop you from changing the settings back.

These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. In this case the hijack was to istartsurf.com. This one also replaces all the shortcuts to Chrome with its own shortcuts.

Typically you will see a mix of detections: PUP.Optional.BoBrowser.A, PUP.Optional.IStartSurf.A, PUP.Optional.WindowsProtectManger.A, PUP.Optional.XTab.A, PUP.Optional.IHProtect.A, PUP.Optional.FastStart.A and more.

How do I know if my computer is affected by BoBrowser?

You may see these entries in your list of installed software:

warning4.png

and these warnings:

main.png

warning1.png

and these icons in your taskbar and on your desktop:

icons.png

How did BoBrowser get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove BoBrowser?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.

  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of BoBrowser?
  • The hijacker alters the shortcuts for popular browsers like Internet Explorer, Opera and FireFox. Read here how to clean your shortcuts.
  • If you are using Chrome, you may want to create new shortcuts for Chrome since the hijacker replaced them.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the BoBrowser hijacker. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.

protection1.png

protection.png

Technical details for experts

Signs in a HijackThis log:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}R0'>http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}R1'>http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}R1'>http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}R1'>http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}R0'>http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}O2'>http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}O2 - BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files\XTab\SupTab.dllO4 - HKCU\..\Run: [BoBrowser] "C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe"O23 - Service: ClaraUpdater - ClaraLabs - C:\Program Files\Common Files\ClaraUpdater\ClaraUpdater.exeO23 - Service: IHProtect Service - XTab system - C:\Program Files\XTab\ProtectService.exeO23 - Service: WindowsMangerProtect Service (WindowsMangerProtect) - SysTool PasSame LIMITED - C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
Possible signs in a FRST log:

 Internet Explorer Version 11 (Default browser path: "C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe" -- "%1") (SysTool PasSame LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (XTab system) C:\Program Files\XTab\ProtectService.exe (SearchProtect) C:\Program Files\XTab\CmdShell.exe (XTab system) C:\Program Files\XTab\HPNotify.exe (The BoBrowser Authors) C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe HKCU\...\Run: [BoBrowser] => C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe [642696 2015-02-18] (The BoBrowser Authors) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific} HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific} HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific} SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms} SearchScopes: HKCU -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=pcm&utm_campaign=install_ie&utm_content=ds&from=pcm&uid={userspecific}&ts=1426147834&type=default&q={searchTerms} SearchScopes: HKCU -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=pcm&utm_campaign=install_ie&utm_content=ds&from=pcm&uid={userspecific}&ts=1426147834&type=default&q={searchTerms} SearchScopes: HKCU -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=pcm&utm_campaign=install_ie&utm_content=ds&from=pcm&uid={userspecific}&ts=1426147834&type=default&q={searchTerms} SearchScopes: HKCU -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=pcm&utm_campaign=install_ie&utm_content=ds&from=pcm&uid={userspecific}&ts=1426147834&type=default&q={searchTerms} SearchScopes: HKCU -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=pcm&utm_campaign=install_ie&utm_content=ds&from=pcm&uid={userspecific}&ts=1426147834&type=default&q={searchTerms} BHO: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files\XTab\SupTab.dll [2015-03-10] (Thinknice Co. Limited) FF NewTab: hxxp://www.istartsurf.com/newtab/?type=nt&ts=1426147807&from=pcm&uid={userspecific} FF DefaultSearchEngine: istartsurf FF SelectedSearchEngine: istartsurf FF Homepage: hxxp://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific} FF Extension: No Name - C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\74979c91-c812-44d6-90e1-1ff0491351e5@e3e0c78c-dd15-4ac4-b6a0-08cad184bd23.com [Not Found] FF user.js: detected! => C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\user.js [2015-03-12] FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\istartsurf.xml [2015-03-12] FF Extension: Fast Start - C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\Extensions\istart_ffnt@gmail.com [2015-03-12] FF HKLM\...\Firefox\Extensions: [istart_ffnt@gmail.com] - C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\istart_ffnt@gmail.com CHR HomePage: Default -> hxxp://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific} CHR StartupUrls: Default -> "hxxp://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}" CHR DefaultSearchKeyword: Default -> istartsurf CHR DefaultSearchURL: Default -> http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms} StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe http://www.istartsurf.com/?type=sc&ts=1426147807&from=pcm&uid={userspecific} StartMenuInternet: (HKLM) OperaStable - C:\Program Files\Opera\Launcher.exe http://www.istartsurf.com/?type=sc&ts=1426147807&from=pcm&uid={userspecific} ClaraUpdater; C:\Program Files\Common Files\ClaraUpdater\ClaraUpdater.exe [328304 2015-03-12] (ClaraLabs) R2 IHProtect Service; C:\Program Files\XTab\ProtectService.exe [158816 2015-03-10] (XTab system) R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [493712 2015-03-12] (SysTool PasSame LIMITED) C:\Users\{username}\SupTab () C:\Users\{username}\Desktop\Facebook.lnk () C:\Users\{username}\Desktop\Wikipedia.lnk () C:\Users\{username}\Desktop\Youtube.lnk () C:\Users\{username}\Desktop\Hotmail.lnk () C:\Users\{username}\Desktop\Search.lnk () C:\Users\{username}\Desktop\Amazon.lnk () C:\Users\{username}\Desktop\BoBrowser.lnk () C:\Users\{username}\AppData\Roaming\istartsurf () C:\Users\{username}\AppData\Local\BoBrowser () C:\ProgramData\WindowsMangerProtect () C:\ProgramData\IHProtectUpDate () C:\Program Files\XTab () C:\Program Files\Common Files\ClaraUpdater () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk () C:\Users\Public\Desktop\Opera.lnk () C:\Users\{username}\Desktop\iexplore.lnk () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk () C:\Users\Public\Desktop\Mozilla Firefox.lnk () C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

Highlights in the Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 3/12/2015Scan Time: 9:26:15 AMLogfile: mbamBoBrowser.txtAdministrator: YesVersion: 2.01.0.1004Malware Database: v2015.03.12.03Rootkit Database: v2015.02.25.01License: FreeMalware Protection: DisabledMalicious Website Protection: DisabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x86File System: NTFSUser: MalwarebytesScan Type: Threat ScanResult: CompletedObjects Scanned: 294271Time Elapsed: 3 min, 57 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 8PUP.Optional.XTab.A, C:\Program Files\XTab\ProtectService.exe, 3524, Delete-on-Reboot, [772c61e3ec9e72c4cfcae12d7989aa56]PUP.Optional.ELEX, C:\Program Files\XTab\HPNotify.exe, 3280, Delete-on-Reboot, [acf7370da1e9c571baa9b6796d95b749]PUP.Optional.XTab.A, C:\Program Files\XTab\CmdShell.exe, 2492, Delete-on-Reboot, [0f94ae960d7d0630a043555ebf446799]PUP.Optional.WindowsMangerProtect.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, 2292, Delete-on-Reboot, [e2c1083c7c0e96a0e5b312a5bc4706fa]PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe, 2960, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec]PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe, 2220, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec]PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe, 1004, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec]PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe, 3700, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec]Modules: 25PUP.Optional.SupTab.A, C:\Program Files\XTab\SupTab.dll, Delete-on-Reboot, [1a89b0943654c86ea22f66cf87797987], PUP.Optional.BrowserWatch, C:\Program Files\XTab\BrowerWatchCH.dll, Delete-on-Reboot, [148f222295f56ec835cbc5a997690000], PUP.Optional.XTab.A, C:\Program Files\XTab\BrowserAction.dll, Delete-on-Reboot, [0f94ae960d7d0630a043555ebf446799], PUP.Optional.XTab.A, C:\Program Files\XTab\IeWatchDog.dll, Delete-on-Reboot, [0f94ae960d7d0630a043555ebf446799], PUP.Optional.XTab.A, C:\Program Files\XTab\msvcp110.dll, Delete-on-Reboot, [0f94ae960d7d0630a043555ebf446799], PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\chrome_elf.dll, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec], PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\39.0.2132.4\ffmpegsumo.dll, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec], PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\39.0.2132.4\chrome.dll, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec], PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\39.0.2132.4\chrome_child.dll, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec], PUP.Optional.BoBrowser.A, C:\Users\{username}\AppData\Local\BoBrowser\Application\39.0.2132.4\pdf.dll, Delete-on-Reboot, [61429fa5642682b40c37a2fdfa0914ec], Registry Keys: 23PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [1a89b0943654c86ea22f66cf87797987], PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, Quarantined, [1a89b0943654c86ea22f66cf87797987], PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [1a89b0943654c86ea22f66cf87797987], PUP.Optional.SupTab.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [1a89b0943654c86ea22f66cf87797987], PUP.Optional.SupTab.A, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [1a89b0943654c86ea22f66cf87797987], PUP.Optional.SupTab.A, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [1a89b0943654c86ea22f66cf87797987], PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\INPROCSERVER32, Quarantined, [1a89b0943654c86ea22f66cf87797987], PUP.Optional.XTab.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IHProtect Service, Quarantined, [772c61e3ec9e72c4cfcae12d7989aa56], PUP.Optional.IHProtect.A, HKLM\SOFTWARE\IHProtect, Quarantined, [3a69c18325653afc865cd5de19eadd23], PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\istartsurfSoftware, Quarantined, [0d9676cec4c6999d0c489f2c19eab947], PUP.Optional.BoBrowser.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\BoBrowser.ZRYMY43N4V4WDE2TXAFS5BQHII, Quarantined, [b8eb68dc7a100f274ea1e1d0f2113cc4], PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [62412d17404a0a2cc0e30f0a17ee2cd4], PUP.Optional.BoBrowser.A, HKLM\SOFTWARE\MICROSOFT\MEDIAPLAYER\SHIMINCLUSIONLIST\bobrowser.exe, Quarantined, [faa949fbf6941323e707a60657ace917], PUP.Optional.BoBrowser.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\bobrowser.exe, Quarantined, [ccd762e2c8c2cc6aceabc0f2d82b827e], PUP.Optional.SupTab.A, HKLM\SOFTWARE\SUPTAB, Quarantined, [2e751f25eaa0bd79a3fea8216e95cb35], PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsMangerProtect, Quarantined, [e2c1083c7c0e96a0e5b312a5bc4706fa], PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, Quarantined, [891a7dc70486d75f76663f7f689be818], PUP.Optional.BoBrowser.A, HKCU\SOFTWARE\BoBrowser, Quarantined, [772c172d16743105cec8595923e05ca4], PUP.Optional.Qone8, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [267dfb498109bd79d6ccaf6a60a5f808], PUP.Optional.IStart.A, HKCU\SOFTWARE\MOZILLA\EXTENDS, Quarantined, [d7ccfe461179c274150e9a0fa85b09f7], PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\istartsurf uninstall, Quarantined, [475c69db8ffbb284ba8e7614f310738d], PUP.Optional.Clara.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ClaraUpdater, Quarantined, [376c49fb0b7f86b0477298fa8380e11f], PUP.Optional.Clara.A, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\BoBrowser, Quarantined, [376c49fb0b7f86b0477298fa8380e11f], Registry Values: 4PUP.Optional.IStart.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|istart_ffnt@gmail.com, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\istart_ffnt@gmail.com, Quarantined, [059ef351dbaf94a25efaf6b240c332ce]PUP.Optional.SupTab.A, HKLM\SOFTWARE\SUPTAB|ptid, pcm, Quarantined, [2e751f25eaa0bd79a3fea8216e95cb35]PUP.Optional.IStart.A, HKCU\SOFTWARE\MOZILLA\EXTENDS|appid, istart_ffnt@gmail.com, Quarantined, [d7ccfe461179c274150e9a0fa85b09f7]PUP.Optional.BoBrowser.A, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|BoBrowser, "C:\Users\{username}\AppData\Local\BoBrowser\Application\bobrowser.exe", Quarantined, [61429fa5642682b40c37a2fdfa0914ec]Registry Data: 8PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND, "C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.istartsurf.com/?type=sc&ts=1426147807&from=pcm&uid={userspecific}, Good: (Chrome.exe), Bad: ("C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.istartsurf.com/?type=sc&ts=1426147807&from=pcm&uid={userspecific}),Replaced,[d1d21034b4d62610a5e79f3b9d688e72]PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}, Good: (www.google.com), Bad: (http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}),Replaced,[ddc682c2afdbdc5a25c14c8c9f666f91]PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}, Good: (www.google.com), Bad: (http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}),Replaced,[495a94b0e9a1979fba2c9b3da95ce41c]PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}, Good: (www.google.com), Bad: (http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}),Replaced,[d7cc68dc6f1b1620a83e56823fc6e41c]PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}, Good: (www.google.com), Bad: (http://www.istartsurf.com/web/?type=ds&ts=1426147807&from=pcm&uid={userspecific}&q={searchTerms}),Replaced,[9c077bc9abdf2a0c02e46c6c2adba25e]PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[a0032420622877bfd49404e18184f010]PUP.Optional.IStartSurf.A, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}, Good: (www.google.com), Bad: (http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}),Replaced,[a201aa9aec9eee487a6a7c5c9471b44c]PUP.Optional.IStartSurf.A, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}, Good: (www.google.com), Bad: (http://www.istartsurf.com/?type=hp&ts=1426147807&from=pcm&uid={userspecific}),Replaced,[980b6fd59af0c5717c6877619174dd23]Folders: 164Files: 573Physical Sectors: 0(No malicious items detected)(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Link to post
Share on other sites

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.