Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


still cant remove safesear.ch !

  • Please log in to reply
4 replies to this topic

#1 salpuma


  • Members
  • 5 posts
  • Gender:Male
  • Location:catskill
  • Local time:04:31 AM

Posted 16 April 2015 - 09:58 PM

I somehow downloaded the hyjacker, safesear.ch , paid for enigma softwares "spy hunter" , then paid for the registrys version. Now I have a nearly uncontrollable urge to throw my bleeping computer against the wall. I am not a computer expert. I am an ironworker in catskill NY who endured a challenging winter and is eager to get to work on my spring contracts at my small shop Catskill Ironwork. I have become dependant for better or worse, on my computer for my business. I find it unbelievable that I am struggling deep into the nights to no avail with this crap. Why the hell doesnt some one kill these bastards?? Anyway, I have google chrome on a 64 bit windows seven computer. Can anyone help me with this thorn in my side? signed Sal Puma, catskillironwork.com  

Edited by salpuma, 16 April 2015 - 10:03 PM.

BC AdBot (Login to Remove)


#2 noknojon


  • Banned
  • 10,871 posts
  • Gender:Not Telling
  • Local time:06:31 PM

Posted 17 April 2015 - 12:15 AM

paid for enigma softwares "spy hunter" , then paid for the registrys version

Basically, you were scammed, as this program is as useful as a King in a deck of Queens (just my phrase) -


This is a program (Safesearch) that you downloaded with another program, by clicking Yes > Next > I agree - Without reading the details


99% of help forums will assist you to remove this program for free, if you are prepared to try and follow instructions ... Read our Antivirus area and this program / company will pop up every month or so as a scam or "What do I do now that I paid them and nothing works .


Please download these programs to desktop, follow these directions (in the written order) and Copy and Paste any logs back here.


Go - Start > Programs and Features > Look for any item like SafeSearch, that you do not know and delete them.


Now -

Download Screen317 Security Check from Here or Here and save it to your Desktop.

  • Double-click SecurityCheck.exe (Padlock Icon)
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt
  • Please Copy/Paste the contents of that document.

Note 1:: If any security program requests permission to access the Internet, allow it to
Note 2. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message, (or similar) restart computer and Security Check should run




Next -

Please download MiniToolBox  to desktop to run it.
 Checkmark the following boxes:

  • List content of Hosts
  • Flush DNS
  • Report IE Proxy Settings
  • Reset IE Proxy Settings
  • Report FF Proxy Settings
  • Reset FF Proxy Settings
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Users, Partitions and Memory size

 Click Go and Copy / Paste the result. (Result.txt)




Next -

Please download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

RKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/
The program usually runs no longer than 2 minutes and only 1 version needs to run.
If it will not run, delete the download and try the other link
 Please Copy / Paste the small log back here.



Next -


  • Please download AdwCleaner by Xplode from HERE and save to your Desktop.
  • Double click on AdwCleaner.exe to run the tool. Vista/Windows 7/8 users right-click and select Run As Administrator
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it.
  • If you see an entry you want to keep, let me know about it.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
    If an error is made, the items can be restored from Quarantine





Next -

Please download  JRT - Junkware Removal Tool to your desktop.
* Temporarily Disable your Antivirus now to avoid potential conflicts.
* Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
* The tool will open and start scanning your system.
* Please be patient as this can take a while to complete depending on your system's specifications.
* On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
* Post the contents of JRT.txt into your next message

Next -

Note - If you already have a current version installed, Please update it
Please download Malwarebytes Anti-Malware

  • Follow the simple directions to install the program to desktop
  • Right click and choose "Run as administrator" to open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link
  • Open up Malwarebytes > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.
  • Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.
  • If you find malware and tick it to remove it, you may be asked to re-boot the computer to finish cleaning.
  • Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.




Finally -

Run ESET Online Scanner.

  • For Internet Explorer users only, hold down Control  (Ctrl) and click on This Link to open ESET OnlineScan in a new window.
  • Click the ESET Online button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu. to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetsmartinstaller_enu icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives and Remove Threats"
  • Click Advanced settings and select the following:
    Scan potentially unwanted applications
     Scan for potentially unsafe applications
     Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer.
  • Please be patient as this will take some time (note - 2 hours is not unusual for a first scan).
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.
  • You do not need to hit the Uninstall button, as you can use this later and it will run quicker.

NOTE:Sometimes if ESET finds no infections it will not create a log.


There may be more scans to run later, so please be patient.


Please ask if you have any questions, and yes all programs and work is 100% free -


Thank You -

#3 noknojon


  • Banned
  • 10,871 posts
  • Gender:Not Telling
  • Local time:06:31 PM

Posted 19 April 2015 - 06:30 PM

Hello -

You have visited back a few times (without answering), and if it is the -paid for enigma softwares "spy hunter"- issue, we will show you how to get something done about it also.


We all (me included) have made wrong choices with programs, but experience helps us to define what is good and not so good.


Please at least try to reply to the first few items I have left, or tell us that you have solved it by yourself ...


Thank You -


Note : This is all free, I am retired like many here, others just like to help people, and you can tell us you are done at any time you feel we may be intruding.

Feel free to ask any questions, and we Never use Remote Access to your computer.

#4 salpuma

  • Topic Starter

  • Members
  • 5 posts
  • Gender:Male
  • Location:catskill
  • Local time:04:31 AM

Posted 20 April 2015 - 09:07 AM

After exhaustive measures (I followed the directions given me here, and repeated them for a couple days) the safesear.ch mess is under control, but I get a message from my chrome the something has been blacked from manipulating my browser- still! For now I have my computer sort of back to normal although I feel that its just waiting for a chance to break out. My ironwork business is in full swing this season so I have little time to deal with this at my desk, but I do greatly appreciate the help I have received here.

#5 noknojon


  • Banned
  • 10,871 posts
  • Gender:Not Telling
  • Local time:06:31 PM

Posted 20 April 2015 - 08:33 PM

Hello again,

I have just added a few items that you may wish to scan through when you have time (I will be here for a week or so still) -


Please note these SpyHunter - Fake security blogs now read >> http://www.bleepingcomputer.com/forums/t/559752/spyhunter-4/#entry3567312 our position on the product -

Note 1: To remove > Some users have reported that you may need to open Windows Explorer, navigate to the following location, look for and delete a SpyHunter related file named SHSetup.exe before uninstalling from Programs and Features (Add/Remove Programs) in Control Panel.

Note 2: Part of their scam > Read this information in "fine print" at the bottom of the SpyHunter Purchase Agreement.....SpyHunter is a 6 month subscription spyware detection/removal service. By making this purchase, customers agree, for their convenience, to be auto renewed every 6 months in order to receive ongoing spyware protection, definition & program updates, custom fixes to their specific spyware problems, and advanced technical support from our Spyware-Helpdesk. You will receive an e-mail notification to opt-out, if you do not wish to be auto renewed.



If you still want help ::: Note that at times there can be a delay of a couple of days since the Experts can get very busy with a backlog.

Please follow the instructions in the Malware Removal and Log Section Preparation Guide .

  • If you cannot complete a step, then skip it and continue with the next.
  • In Step 6 there are instructions for downloading and running "FRST" which will create two logs.

When you have done that, Post your logs (as directed) in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here, for assistance by the Malware Response Team.

Start a new topic, give it a relevant title and post your log(s) along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. If you cannot produce any of the required logs , then still start the new topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happened when you tried to create them.
A member of the Malware Removal Team will walk you through, step by step, on how to clean your computer.

After doing this, please reply back in this thread with a link to the new topic so we can close this one, to prevent others answering incorrectly.

Again, there is no charges at all (just a bit of your time) and all programs used are free


Good Luck -

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users