isearch.fantasigames malware infected my computer

Hi mvanloon,

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Right click on adwcleaner.exe and select " Run as administrator " to run it.
• Click on Search.
• A logfile will automatically open after the scan has finished.
• Close the adwCleaner window, click ok to the prompt.
• Please post the content of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[R1].txt as well.

# AdwCleaner v2.200 - Logfile created 04/15/2013 at 07:12:56
# Updated 02/04/2013 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : Matt VanLoon - WFBD01
# Boot Mode : Normal
# Running from : C:\Users\Matt VanLoon\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****

Key Found : HKCU\Software\InstallCore
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Found : HKLM\SOFTWARE\DataMngr
Key Found : HKLM\SOFTWARE\Tarma Installer
Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Registry is clean.

-\\ Google Chrome v26.0.1410.64

File : C:\Users\Matt VanLoon\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.1941] : homepage = "hxxp://isearch.fantastigames.com/465",
Found [l.2116] : urls_to_restore_on_startup = [ "hxxp://isearch.fantastigames.com/465" ]

*************************

AdwCleaner[R1].txt - [1184 octets] - [15/04/2013 07:12:56]

########## EOF - C:\AdwCleaner[R1].txt - [1244 octets] ##########

Hi mvanloon,

AdwCleaner

• Close all open programs and internet browsers.
• Right click on adwcleaner.exe and select " Run as administrator " to run it.
• Click on Delete.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

Please download SystemLook from the link below and save it to your Desktop.

Download Mirror #2 (64-bit)[/b]

• Double-click SystemLook.exe to run it.
• Copy and paste the content of the following codebox into the main textfield:
  

  
  
  :filefind
  
  *Fun4IM*
  
  *Bandoo*
  
  *Searchnu*
  
  *Searchqu*
  
  *iLivid*
  
  *whitesmoke*
  
  *datamngr*
  
  *trolltech*
  
  
  
  :folderfind
  
  *Fun4IM*
  
  *Bandoo*
  
  *Searchnu*
  
  *Searchqu*
  
  *iLivid*
  
  *whitesmoke*
  
  *datamngr*
  
  *trolltech*
  
  
  
  :Regfind
  
  Fun4IM
  
  Bandoo
  
  Searchnu
  
  Searchqu
  
  iLivid
  
  whitesmoke
  
  datamngr
  
  kelkoopartners
  
  trolltech
  
  

• Click the Look button to start the scan.
  Because of the Registry searches, the scan may take 15 minutes or a bit more to run on a large machine. Please be patient.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Please let me know how the computer is running.

# AdwCleaner v2.200 - Logfile created 04/15/2013 at 08:07:56
# Updated 02/04/2013 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : Matt VanLoon - WFBD01
# Boot Mode : Normal
# Running from : C:\Users\Matt VanLoon\Downloads\adwcleaner (1).exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****

Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\DataMngr
Key Deleted : HKLM\SOFTWARE\Tarma Installer
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Registry is clean.

-\\ Google Chrome v26.0.1410.64

File : C:\Users\Matt VanLoon\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.1941] : homepage = "hxxp://isearch.fantastigames.com/465",
Deleted [l.2116] : urls_to_restore_on_startup = [ "hxxp://isearch.fantastigames.com/465" ]

*************************

AdwCleaner[R1].txt - [1307 octets] - [15/04/2013 07:12:56]
AdwCleaner[S1].txt - [1264 octets] - [15/04/2013 08:07:56]

########## EOF - C:\AdwCleaner[S1].txt - [1324 octets] ##########


SystemLook 04.09.10 by jpshortstuff
Log created at 08:11 on 15/04/2013 by Matt VanLoon
Administrator - Elevation successful

========== filefind ==========

Searching for "*Fun4IM*"
No files found.

Searching for "*Bandoo*"
No files found.

Searching for "*Searchnu*"
No files found.

Searching for "*Searchqu*"
No files found.

Searching for "*iLivid*"
No files found.

Searching for "*whitesmoke*"
C:\Windows.old\Program Files (x86)\Google\Google SketchUp 8\Materials\Colors-Named\0129_WhiteSmoke.skm --a---- 1526 bytes [19:55 04/12/2012] [19:55 04/12/2012] AD41BC61879535202A0D3867FFB67716

Searching for "*datamngr*"
No files found.

Searching for "*trolltech*"
No files found.

========== folderfind ==========

Searching for "*Fun4IM*"
No folders found.

Searching for "*Bandoo*"
No folders found.

Searching for "*Searchnu*"
No folders found.

Searching for "*Searchqu*"
No folders found.

Searching for "*iLivid*"
No folders found.

Searching for "*whitesmoke*"
No folders found.

Searching for "*datamngr*"
No folders found.

Searching for "*trolltech*"
No folders found.

========== Regfind ==========

Searching for "Fun4IM"
No data found.

Searching for "Bandoo"
No data found.

Searching for "Searchnu"
No data found.

Searching for "Searchqu"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"

Searching for "iLivid"
No data found.

Searching for "whitesmoke"
No data found.

Searching for "datamngr"
No data found.

Searching for "kelkoopartners"
No data found.

Searching for "trolltech"
No data found.

-= EOF =-

And how is the computer running now?

The isearch.fantasigames no longer comes up when I open Chrome. Can I set google as my "home page once again?

Thank you for all of this help!!!

Hi mvanloon,

Can I set google as my "home page once again?

Yes, that should be fine now.

Now that you are clean, please follow these steps in order to keep your computer clean and secure.

• Right click on adwcleaner.exe and select " Run as administrator " to run it.
• Click on Uninstall.
• Confirm with yes.

Remove GMER

Delete the GMER icon from your desktop.

Delete the RKill icon from your desktop.

Clear restore points

• Double-click OTL.exe (Right click and choose "Run as administrator" in Vista/Win7).
• Copy and Paste the following code into the textbox. Do not include the word Code
  

  
  
  :commands
  
  [clearallrestorepoints] 
  
  

• Then click the Run Fix button at the top.
• Click .
• OTL may ask to reboot the machine. Please do so if asked.

Clean up with OTL

• Double-click OTL.exe to start the program. This will remove all the tools we used to clean your pc.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CleanUp! button
• Say Yes to the prompt and then allow the program to reboot your computer.

Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.

Happy surfing and stay clean!

As your problems appear to have been resolved,