Author Topic: Vista opening Firefox goes to PuP! Help remove! http://src-click-download.xyz (Read 22878 times)

keny · « **on:** November 24, 2016, 05:18:22 pm »

Vista, when opening, Firefox goes to one of number different of sites automatically. http://src-click-download.xyz (or) .sce-clicksoft.pw (or) http://src-click-download.xyz (or) sce-clicksoft.pw/UX
Seems to slow complete system down. Ran Tweaking twice but no help. I think it is a PUP.
How do I fix this problem
Thank in advance
Kenny

email address removed for privacy

Boggin · « **Reply #1 on:** November 24, 2016, 05:32:50 pm »

Download AdwCleaner which is a program specifically designed to deal with PuPs.

https://www.malwarebytes.com/adwcleaner/

Click on Scan and it may list some items when complete in a lower pane it considers adware.

Uncheck any you want to keep then click on Logfile which will show you what else it has found and will delete when you close the log and hit Clean.

It will produce a final report of what it has removed after the reboot.

keny · « **Reply #2 on:** November 24, 2016, 05:56:55 pm »

thanks Boggin, Will try your suggestion now. Thanks for the fast reply!

keny · « **Reply #3 on:** November 24, 2016, 07:34:24 pm »

Hi Boggin Ran adwcleaner found 199 threats, and removed all, after rebook....No help for my problem. Ran adwcleaner again and found no problem, but still no help with my problem. tried to post log file, but it would not cut and paste post! Thanks Kenny

Willy2 · « **Reply #4 on:** November 24, 2016, 07:38:15 pm »

- Run the Junkware Removal Tool as well.
http://www.bleepingcomputer.com/download/junkware-removal-tool/

keny · « **Reply #5 on:** November 24, 2016, 09:30:42 pm »

Hi Willy2 The JRT ran ok and found some items and deleted them. Yet the problem my computer has is still there. Log file here: unkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.9 (09.30.2016)
Operating System: Windows Vista (TM) Home Premium x86
Ran by Dick (Administrator) on Thu 11/24/2016 at 21:22:51.01
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 18
Successfully deleted: C:\Program Files\mozilla firefox\defaults\pref\itms.js (File)
Successfully deleted: C:\ProgramData\esellerate (Folder)
Successfully deleted: C:\Windows\System32\Tasks\DriverNavigator Scheduled Scan (Task)
Successfully deleted: C:\Windows\Tasks\DriverNavigator Scheduled Scan.job (Task)
Successfully deleted: C:\Users\Dick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\04IZ3MGL (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Dick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\081SE7VK (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Dick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6RPQOF4R (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Dick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9CDHQ8XD (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Dick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I09MULM4 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Dick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJP2VYCB (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Dick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W6W4169K (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\04IZ3MGL (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\081SE7VK (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6RPQOF4R (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9CDHQ8XD (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I09MULM4 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJP2VYCB (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W6W4169K (Temporary Internet Files Folder)
Registry: 2
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Main\\SearchAssistant (Registry Value)
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Search\\SearchAssistant (Registry Value)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 11/24/2016 at 21:26:10.31
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

satrow · « **Reply #6 on:** November 24, 2016, 10:12:22 pm »

The final step, once any malware/adware/redirects have been removed, is to Reset Firefox (and/or any other browser installed that has the same issue): https://malwaretips.com/blogs/reset-firefox-settings/

Still_Game · « **Reply #7 on:** November 24, 2016, 11:23:47 pm »

Kenya - I would advise you to go to your initial post and edit it to remove your email address. Otherwise, bots will harvest your address and you're likely to receive quantities of spam - possibly including malware that could add to your problems.

Willy2 · « **Reply #8 on:** November 24, 2016, 11:39:14 pm »

- Sometimes one can, at this stage, simply manually change the startup page.

Boggin · « **Reply #9 on:** November 25, 2016, 01:02:43 am »

I had removed your email address before I first responded, but with it being late, I'd forgotten to Save.

As an additional check for malware, run the free version of MBAM and then reset the Hosts file to default.

https://www.malwarebytes.com/mwb-download/

MS used to have a fixit for this, but has been withdrawn like a lot of support, so you now have to do this manually.

Even though any malware has been removed, it can leave entries in the Hosts file which will continue to plague.

https://www.malwarebytes.com/mwb-download/

keny · « **Reply #10 on:** November 25, 2016, 08:26:01 am »

tried manually change the startup page, no help! Will try malwarebyte now. Thanks everyone for the help!

keny · « **Reply #11 on:** November 25, 2016, 09:37:40 am »

Hi Everyone, I ran malwarebytes and it found 33 PUP's then deleted them. Malwarebytes said it made a log file, but I can not find it. Very slow reboot After Reboot, I then ran SuperAntiSpyware, Found two threats & removed them, listed here: .happy-good-click.pw [ C:\USERS\DICK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YMBDLBON.DEFAULT-480038213834\COOKIES.SQLITE ]
.sce-clicksoft.pw [ C:\USERS\DICK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YMBDLBON.DEFAULT-1480038213834\COOKIES.SQLITE ]

Things are different now! These two, .happy-good-click.pw and .sce-clicksoft.pw are the same Threats Firefox was lunching to,
but now Firefox lunches to: file:///C:/PROGRA~1/MOZILL~1/ A long list of files, is this OK? Any Suggestions?

keny · « **Reply #12 on:** November 25, 2016, 09:52:40 am »

Hi Everyone, I did a Refresh on FireFox and now FireFox lunches to it's normal home page. Still reboots very slow. and DeskGram for loading photos from a PC to Instagram does not work now. Is there a easy to use program for FireFox to load photos and video to Instagram that is free! DeskGram has a monthly charge. And Malwarebytes seems to have removed U-block. Should I re install it?
Thanks for all the help. The Computer is much better now. Kenny

Boggin · « **Reply #13 on:** November 25, 2016, 10:37:58 am »

You can reinstall uBlock but I don't know anything about loading photos.

See what a Google search brings up for a free program.

keny · « **Reply #14 on:** November 25, 2016, 11:24:43 am »

Problem Again. When opening firefox it goes to: file:///C:/PROGRA~1/MOZILL~1/ Looks like a FireFox refresh only worked the one time. Any suggestions? Thanks Again! Kenny

Boggin · « **Reply #15 on:** November 25, 2016, 01:54:14 pm »

Going back through the thread, it looks like I doubled up with the MBAM link instead of the one for resetting the Hosts file.

Run another scan with MBAM and then follow this tutorial to see if that resolves - https://support.microsoft.com/en-gb/kb/972034

keny · « **Reply #16 on:** November 25, 2016, 02:53:19 pm »

OK, Thanks, will try Mbam again now! Kenny

keny · « **Reply #17 on:** November 25, 2016, 03:41:31 pm »

Hi Boggin, I ran mbam again & found no threats. follow the instruction for Host file. No help still, Firefox lunches to file:///C:/PROGRA~1/MOZILL~1/ thanks any additional suggestions? Kenny

Boggin · « **Reply #18 on:** November 25, 2016, 03:53:45 pm »

Have you tried running Firefox without add-ons ?

https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode

satrow · « **Reply #19 on:** November 26, 2016, 01:11:30 am »

Are you running Firefox from a shortcut? If so, please use Explorer (or the command line/Run box) to start it directly: C:\Program Files (x86)\Mozilla Firefox\Firefox.exe or C:\Program Files\Mozilla Firefox\Firefox.exe.

It's looking like *something* did an incomplete job in cleaning up (MBam or SAS?) were both of these updated before running them?

Can you export and attach the MBam logs for us to check:

Boggin · « **Reply #20 on:** November 26, 2016, 02:11:02 am »

The default for MBAM is now to treat PuPs and PuMs as malware, but MBAM auto updates on installation - but I agree, something still seems to be in there.

keny · « **Reply #21 on:** November 26, 2016, 06:17:48 am »

Can you export and attach the MBam logs for us to check: Mbam was a new download. SAS has been updated, should I deleted it and do a new download? Mbam says it make a log file, but I can not find it. Can you tell me where it would be? I try firefox from the command line now. Let you know. Thanks Again Kenny

satrow · « **Reply #22 on:** November 26, 2016, 06:41:13 am »

The image in my previous message should enable you to access the MBam logs.

keny · « **Reply #23 on:** November 26, 2016, 06:43:35 am »

Success, Firefox runs correctly from command line. I deleted the Shortcut, did a refresh on Firefox, then created an new shortcut. It works correctly. I did not try running Firefox from Safe Mode. Still can not find Mbam log files. Thanks for all the help! Kenny ( Satrow, I Will Try to look at Logs files and get you a copy)

keny · « **Reply #24 on:** November 26, 2016, 06:51:09 am »

Scan Date: 11/25/2016
Scan Time: 8:33:33 AM
Logfile: mbamlogNov25.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.11.25.09
Rootkit Database: v2016.11.20.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows Vista Service Pack 2
CPU: x86
File System: NTFS
User: Dick

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 382024
Time Elapsed: 23 min, 34 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 5
PUP.Optional.SpyHunter, HKLM\SOFTWARE\ENIGMASOFTWAREGROUP\SpyHunter, Quarantined, [83fa388c4456241210f90a9e35ce639d],
PUP.Optional.Bandoo.AppFlsh, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{482A80B4-9475-40D2-B8F1-E90418B51C89}, Quarantined, [ef8e09bbff9bbc7aecf75f612ad844bc],
PUP.Optional.Bandoo.AppFlsh, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{8E7CBE45-08DD-4D0D-9FB0-0EE1C0239023}, Quarantined, [49346b597a2010269152f1cf659d29d7],
PUP.Optional.Bandoo.AppFlsh, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{98C7B90B-AEB2-45E1-8576-4440792C1216}, Quarantined, [fd80655f445688aede05437d907209f7],
PUP.Optional.SpyHunter, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ESGIGUARD, Quarantined, [502deed682183afc2585b7f01de637c9],

Registry Values: 4
PUP.Optional.Bandoo.AppFlsh, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{482A80B4-9475-40D2-B8F1-E90418B51C89}|AppPath, C:\PROGRA~1\WI371A~1\Datamngr\ToolBar, Quarantined, [ef8e09bbff9bbc7aecf75f612ad844bc]
PUP.Optional.Bandoo.AppFlsh, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{8E7CBE45-08DD-4D0D-9FB0-0EE1C0239023}|AppPath, C:\PROGRA~1\WI371A~1\Datamngr\ToolBar, Quarantined, [49346b597a2010269152f1cf659d29d7]
PUP.Optional.Bandoo.AppFlsh, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{98C7B90B-AEB2-45E1-8576-4440792C1216}|AppPath, C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar, Quarantined, [fd80655f445688aede05437d907209f7]
PUP.Optional.SpyHunter, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ESGIGUARD|ImagePath, \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys, Quarantined, [502deed682183afc2585b7f01de637c9]

Registry Data: 0
(No malicious items detected)

Folders: 3
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Data, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],

Files: 21
PUP.Optional.APNToolBar, C:\Users\Dick\AppData\Local\Downloaded Installations\{0710724E-1A91-4F52-ACCA-1B2BB24A0590}\The Weather Channel App.msi, Quarantined, [66170bb98515a096d4c08048ac54f30d],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\INSTALL.LOG, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\cos.dat, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\gil.dat, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\safeol.dat, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\scanlog.log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\supportlog.txt, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\unkcache.dat, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Data\dns.dat, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Log\SpyHunter4_20120321_174627.log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Log\SpyHunter4_20120322_082738.log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Log\SpyHunter4_20120330_141117.log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Log\SpyHunter4_20120406_094628.log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Log\SpyHunter4_20120411_033926.log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Log\SpyHunter4_20120415_183034.log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Log\SpyHunter4_20120430_090126.log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Log\SpyHunter4_20120512_033942.log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Log\SpyHunter4_20120607_140656.log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Log\SpyHunter4_20120611_094658.log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.SpyHunter, C:\Program Files\Enigma Software Group\SpyHunter\Log\SpyHunter4_20140226_191150.log, Quarantined, [5e1f289c97030a2cb0f6594e9b6816ea],
PUP.Optional.BrowserHijack.ShrtCln, C:\Program Files\Mozilla Firefox\firefox.bat, Good: (), Bad: (http://1.loadblanks.ru/c/0d3963b9394e4bc5?"), Replaced,[ee8f774d4b4fb3833ffc85bb05fe21df]
Physical Sectors: 0
(No malicious items detected)
(end)