How do you remove "My Fast Web Search" from your computer?

fuzzgun19

I've done a Superantispyware scan, which picked up 15 adware cookies, and 2 trojan.

When I restart and open IE, I get a box come up from superantispyware stating that the homepage has been changed, and do I want to allow this or block it.

I have chosen to block it, and then I get my chosen homepage (google).

Does this mean that I will have to do this every time?

aliEnRIK

Open notepad and copy/paste the text in RED below

File::
c:\windows\system32\browserchoice.exe



Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.




This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.

aaronm_2

Nex time you're going to download something, just be careful. Virus is everywhere.

diddilydee

Perhaps it was in the T&C that on downloading the game you also had to download "My fast web search"?
I had this problem so just had to "uninstall the programme" via the control panel.

fuzzgun19

aliEnRIK wrote: »

Open notepad and copy/paste the text in RED below

File::
c:\windows\system32\browserchoice.exe



Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.




This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.

I've done this, but still have the 'Allow or Block' thing when I re-start.

Will it be ok for me to log into say internet banking etc while this is going on.. is this some sort of spyware?

enigma52

I thought c:\windows\system32\browserchoice.exe was the new Microsoft update to comply with the EU regarding personal choice of what browser you use, as IE is not part of Windows 7 that is sold in the EU, but as per usual I could be wrong

aliEnRIK

fuzzgun19 wrote: »

I've done this, but still have the 'Allow or Block' thing when I re-start.

Will it be ok for me to log into say internet banking etc while this is going on.. is this some sort of spyware?

Id say your fine for banking, its just a little annoying :mad:

Im beginning to wonder if it has anything to do with incredimail as thats a form of malware (but not something I wish to touch as once installed it can be an absolute nightmare to remove and get outlook running again)

TICK and FIX these in hijack ~
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" -"http://www.kidscom.com/games/trainer/trainer.html"
O4 - Startup: homepg.cmd ***cant believe I missed this one***!
O16 - DPF: {38AB0814-B09B-4378-9940-14A19638C3C2} (Auctiva Image Uploader Control) - http://www.auctiva.com/Aurigma/ImageUploader57.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-29-0.cab

aliEnRIK

enigma52 wrote: »

I thought c:\windows\system32\browserchoice.exe was the new Microsoft update to comply with the EU regarding personal choice of what browser you use, as IE is not part of Windows 7 that is sold in the EU, but as per usual I could be wrong

It has been used as malware too, I was clutching at straws with that one though

fuzzgun19

Thanks for all your help on this alienRik.

I ticked and fixed those items, and straight away I got this box -

aliEnRIK

Do them all one after the other