Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

New member with "do-search" virus


  • Please log in to reply
10 replies to this topic

#1 Wings42

Wings42

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:San Diego
  • Local time:07:25 PM

Posted 23 November 2013 - 01:05 AM

Hello all. My name is Wings42. I'm retired, married with a beautiful dog and two indoor cats. We live in San Diego. My main thing is photography but I spend a lot of time on the PC.

 

I joined this forum to get help solving a problem: my PC picked up a virus called "do-search". It has taken over both of my browsers, Firefox and Internet Explorer. Before switching to Norton today, I've happily used AVG for years. I quit AVG today because 1) it allowed the "do-search" virus infect my PC, and 2) it offered little support. They wanted $90 to have one of their technicians work with me, so I said "Thanks, but...".

 

I'm fairly computer and Windows capable but don't know where to begin. I've already done a full scan in Norton. It corrected three problems, but not the "do-search" problem. The attached screen dump is my Internet Explorer home screen, not done by or approved by me.

 

Thanks for the help.

 

Attached File  do-search screen dump.png   101.8KB   0 downloads

 

David


Edited by hamluis, 26 November 2013 - 10:19 AM.
Moved from Win 7 to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


#2 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:25 AM

Posted 23 November 2013 - 01:39 AM

Hi David and :welcome: to Bleeping Computer Community :)

Download Adwcleaner by Xplode from here.
Click on Adwcleaner and hit the Scan button and will begin to search for PUP and malicious files. Once finished click the Delete/Clean button. Copy and paste the log on your next reply.

 

Download JRT by thisisu from this link
Make sure to disable your antivirus or any running protection softwares before running JRT to avoid interferences.
For Vista and Windows 7, right-click and Run as Administrator. In XP, double click JRT icon.
Please be patient and let the program finish scanning.
Once finish, a text document will open then copy-paste it on your next reply.

 

Scan for Malware using free Malwarebytes
Install then run a quick scan only after updating to the latest definition.Uncheck the trial pro version on setup and remove any found threats after running the scan.Please post also the result.


Tekken
 


#3 Wings42

Wings42
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:San Diego
  • Local time:07:25 PM

Posted 23 November 2013 - 02:16 AM

Thank you "BC Advisor"

 

I ran Adwcleaner. It's a neat little program. It found about 50 folders and files that either serve no purpose of mine, or are malicious, or both. I deleted all. My PC give a sigh of relief to get rid of that useless or evil stuff.

 

The "do-cleaner" problem is still there for both browsers. It's 11:15 P.M. here. Think I'll hang it up for the day and rejoin the battle tomorrow morning.

 

David



#4 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:25 AM

Posted 23 November 2013 - 02:22 AM

The "do-cleaner" problem is still there for both browsers

 

Not familiar with do cleaners though, can you elaborate if its a do search remover or something else?

 

Edit : Please complete the instructions as suggested and remove the shortcuts http extension as elaborated in this link.


Edited by jhayz, 23 November 2013 - 02:29 AM.

Tekken
 


#5 Wings42

Wings42
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:San Diego
  • Local time:07:25 PM

Posted 23 November 2013 - 05:57 PM

BC Advisor. I ran all steps in the Virus Removal Guide. Thanks for an excellent document. I went ahead and bought Malwarebyte Pro.

 

The "do-search" problem is mostly better. Internet Explore appears to be totally free of the virus.

 

The remaining problem is with Firefox, my prefered browser. Home page comes up fine, with my Gmail and another tab with my wife's Gmail. Then, the browser adds 2 tabs, one with recent history, and then one with "go-search". I took "go-search" out of my history and did a search of my "C:" drive for "go-search.com", removing all three files that contained it. I can't find do-search or dosearch in my all program directories, esp. the Mozilla Firefox directories. I've no idea where the mf is hiding.

 

If I close the "go-search" tab, "go-search" doesn't come back for the rest of that Firefox session.  Frustrating to say the least. I'm certainly open to any suggestions.

 

David


Edited by Wings42, 23 November 2013 - 06:00 PM.


#6 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:25 AM

Posted 23 November 2013 - 07:29 PM

:step1: Try checking your Firefox Tools menu - Options - General tab.

kJTS2oL.jpg

Check your 'When Firefox starts:' option if they contain similar settings in the image above including the desired Homepages.

:step2: Try clearing your cache files : Free Ccleaner
Ignore the Registry feature of Ccleaner as it is not recommended or needed.

You can clear History, Cookies and recently typed URL for the first cleaning session under the browsers (IE, FF, GC) categories then untick them on the next time you decide to clean cache files to preserve the 3 boxes aforementioned for better browsing experience. See if the problem persist after running :step1:  and :step2: suggestions.


Tekken
 


#7 Wings42

Wings42
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:San Diego
  • Local time:07:25 PM

Posted 23 November 2013 - 09:18 PM

BC Advisor. Great advice but it didn't work. I looked at the startup part of the screen above and it was set to "Show my windows and tabs from last time." I changed it back to "Show my home page", expecting that would solve the problem. Just to be sure, I downloaded and ran Ccleaner. Then I rebooted and brought up Firefox. The screen dump shows what I got. Note the Startup settings.

 

Arrrrrghhh

Attached Files



#8 Wings42

Wings42
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:San Diego
  • Local time:07:25 PM

Posted 24 November 2013 - 12:25 AM

When I click on the "Home" icon, "do-search" goes away, to be replace by my Gmail screen. I won't stop until this is solved. And I'm angry as hell at the arrogant SOB hackers (in the bad sense) who think they can do what they want to other people for a bit of money.

 

VICTORY!!  After entering the above, I tried to access Firefox from the desktop icon instead of the icon on the Taskbar at the bottom. The home screen came up like it was supposed to. So, I removed the Firefox icon from the Taskbar and replaced it with the icon from the desktop. Voila! The Firefox icon on the bottom worked. So I rebooted and tried it again and it still worked. I don't understand how the location of an icon could make a difference, but I'm glad it did.

 

This wouldn't have worked without doing all that BC Advisor recommended. Thanks a million! You saved me waiting till Monday to hire a local guru to clean things up.


Edited by Wings42, 24 November 2013 - 12:45 AM.


#9 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:25 AM

Posted 24 November 2013 - 02:05 AM

Great to know you handled the problem alone along the way Wings. Thumbsup :thumbup2:  for your persistence :)

The Firefox icon on the bottom worked

 

You may have overlooked at the http extension under the Properties for the particular Firefox icon (Post #4 link).


Tekken
 


#10 hamluis

hamluis

    Moderator


  • Moderator
  • 55,723 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:25 PM

Posted 26 November 2013 - 10:23 AM

A perusal of This List may help to explain the steps requested by the Advisor trying to assist you..

 

Louis


Edited by hamluis, 26 November 2013 - 10:24 AM.


#11 Wings42

Wings42
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:San Diego
  • Local time:07:25 PM

Posted 26 November 2013 - 10:17 PM

Thanks. This has been a very helpful clinic, providing insight into a few of Windows' internals. I'm so glad to have discovered this site.

 

David C


Edited by Wings42, 26 November 2013 - 10:17 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users