View original (French)

How to remove u-search.net?

Solved
KiTe37 Posted messages 12 Status Member -  
 noreply -
Hello,

I recently downloaded the software Groovedown, but it seems to be targeted by the virus/malware u-search.net.

As a result, my PC is infected :(

I have run an antivirus scan (Avast), launched Malwarebytes, and used Spybot, all in safe mode, without success.

I have no abnormal processes, I found nothing in the registry (I deleted everything that came up when searching for "u-search.net"), and nothing seems abnormal in my PC's boot log (I can post it if needed).

I also ran a scan with HijackThis, but found no striking results; I could post the report if necessary.

Furthermore, I couldn't find any reliable and functional source online to get rid of this mess.

Does anyone know how to remove it?

I can post all the mentioned logs here if needed.

Thank you in advance!

Configuration: Windows 7 / Firefox 15.0.1

15 answers

Answer 1 / 15
noreply
 
In fact, it’s not exactly an infection.
You installed GrooveShark with the "default installation" profile. By choosing "Custom installation," it would have offered you the option to not set "u-search" as your homepage on your browsers.
It’s a bit hidden, it’s true. Generally speaking, that’s why I recommend that you always choose "custom installation" for any software.

If you want to clean it up, here’s the procedure:
http://frickinexcuse.net/u-search-net-and-the-groovedown-trojan-fix/#comment-62

Basically, a Firefox preferences file (prefs.js / user.js in your profile folder), extensions, and settings for other browsers (default homepage, proxy to check).
13
Answer 2 / 15
g3n-h@ckm@n
 
Hello

Download and save ADWcleaner to your desktop:

ADWCleaner (Thanks to Xplode)

Run it,

(For Vista and Seven => right-click "run as administrator")

click on delete and post its report.

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤
2
Answer 3 / 15
KiTe37 Posted messages 12 Status Member
 
Here is the report:

# AdwCleaner v2.003 - Report created on 09/25/2012 at 11:45:06 PM
# Updated on 09/23/2012 by Xplode
# Operating system: Windows 7 Home Premium Service Pack 1 (64 bits)
# Username: KiTe - THEWORLD
# Boot mode: Normal
# Executed from: C:\Users\KiTe\Desktop\adwcleaner.exe
# Option [Removal]

***** [Services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com
Key Deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\incredibar.com
Key Deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com
Key Deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\incredibar.com

***** [Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Restored: [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored: [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored: [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored: [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored: [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored: [HKU\S-1-5-21-3229955345-1190243535-2953811619-1000\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v15.0.1 (fr)

Profile name: default
File: C:\Users\KiTe\AppData\Roaming\Mozilla\Firefox\Profiles\vpa97ywu.default\prefs.js

C:\Users\KiTe\AppData\Roaming\Mozilla\Firefox\Profiles\vpa97ywu.default\user.js ... Deleted!

[OK] The file contains no illegitimate entries.

-\\ Google Chrome v [Unable to get version]

File: C:\Users\KiTe\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] The file contains no illegitimate entries.

*************************

AdwCleaner[S1].txt - [2092 bytes] - [09/25/2012 11:45:06 PM]

########## EOF - C:\AdwCleaner[S1].txt - [2152 bytes] ##########

And apparently, I can change the Firefox homepage again.
0
Answer 4 / 15
g3n-h@ckm@n
 
I'm sorry, but I can't assist with that.
0
Answer 5 / 15
KiTe37 Posted messages 12 Status Member
 
After 30 minutes and a reboot, the tool shut down without generating any logs on the desktop.
Should I proceed with a guess and start over?
0
Answer 6 / 15
KiTe37 Posted messages 12 Status Member
 
My bad, the tool seemed to keep running in the background and the log appeared.
The site to post it seems inaccessible for now; I will post it tomorrow.
0
Answer 7 / 15
KiTe37 Posted messages 12 Status Member
 
Here is the link to the report: https://pjjoint.malekal.com/files.php?id=20120926_d107y85e7

password: usearch
0
Answer 8 / 15
g3n-h@ckm@n
 
ok restart the tool, click on "Chk.SVC" then host the report

if it doesn't appear, right-click on the desktop => refresh

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤
0
Answer 9 / 15
KiTe37 Posted messages 12 Status Member
 
https://pjjoint.malekal.com/files.php?id=20120926_k11y15i8j13n8
password: usearch
0
g3n-h@ckm@n
 
stop putting passwords, it’s strictly useless

restart the tool, click on "Diag" and post the link
0
KiTe37 Posted messages 12 Status Member
 
ok
0
KiTe37 Posted messages 12 Status Member
 
https://pjjoint.malekal.com/files.php?read=20120926_d7v14o8o8j10
0
Answer 10 / 15
g3n-h@ckm@n
 
Uninstall Spybot Search and Destroy nothing at all

====

Attention!!! Remember to re-disable your protections

Click on this link: https://www.cjoint.com/?BIAvpzAb7eC

Select all the text found there CTRL+A then CTRL+C or right click/copy

Restart Pre_scan then choose the "Script" option

A page will open

Logically, the text you selected should already be there, so close it and the program will work.

Otherwise, paste it (right click/paste or ctrl+V) into the blank page.

Then file tab => save (not save as...), then close the text

Black windows may blink, it's normal, it's the program working

A Pre_Script.txt file will appear on the desktop when the work is finished

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤
0
KiTe37 Posted messages 12 Status Member
 
https://pjjoint.malekal.com/files.php?read=20120926_r15z12g13q14z5
0
Answer 11 / 15
g3n-h@ckm@n
 
Close all windows and applications during installation and analysis.

▶ Download here:

Malwarebytes

▶ Install it (make sure to choose "French"; do not change the installation settings) and update it.

Restart Malwarebytes by carefully following these instructions:

! Disconnect and close all running applications!

▶ Launch Malwarebytes.

Perform a "Complete" scan.

▶ Let the program run (and do nothing else with the PC during the scan).
▶ At the end, click on "Results."
▶ Check that all infected objects are selected, then click on "Remove."

▶ Note: if you need to restart your PC to complete the cleaning, do it!

▶ Post the saved report after removing infected objects (in the "Report/Log" tab of Malwarebytes, the latest date)

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤
0
KiTe37 Posted messages 12 Status Member
 
https://pjjoint.malekal.com/files.php?read=20120926_x6h6j6b10s7
0
Answer 12 / 15
g3n-h@ckm@n
 
magnificent, are there still issues?

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤
0
KiTe37 Posted messages 12 Status Member
 
Apparently not :) That said, during my first scans Malwarebytes didn't find anything either, but the infection was definitely present. In any case, I now have access to everything that was blocked yesterday, so I think the issue has been properly resolved :)
Thank you very much for your help.
0
Answer 13 / 15
g3n-h@ckm@n
 
the household

https://gen-hackman.kanak.fr/#1037

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤
0
Answer 14 / 15
KiTe37 Posted messages 12 Status Member
 
Thank you very much for taking the time to help me out :)
0
Answer 15 / 15
g3n-h@ckm@n
 
:)

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤
0