cant get rid of unwanted search engine

[rubydoo]

hi ,new to all this ,but need some info if possible. few months ago daughter downloaded a website to download music , called bearshare. she decided that she didnt want this so she uninstalled it . Now even though the programme has been uninstalled ,every now and then it comes up as a search engine, which is a right pain . Ive gone through all my programmes and searched for this to get rid , but every search comes up with nothing. but a couple of times a day this pain in the backside "bearshare search" comes up .can any of you experienced people out there give me some info please on how to get rid..., thank you Ruby

[KenB]

Hi Ruby and welcome to ExTS,

Bearshare is P2P software. In other words a gateway to malware on your computer.

 

Download MBAM from here:

http://www.malwarebytes.org/

Click on Products - you want the free version.

 

Install > Update > Run it.

It will produce a log.

Copy this and post it here please.

 

If it shows anything one of our Security Experts will advise further.

 

They will also advise on ridding your system of bearshare too.

[Starbuck]

Hi Ruby,

 

There may be a few leftovers in your registry, Please run the following program ( after running MBAM as suggested by Ken ) and post the reports for me.

 

• Download OTL to your desktop.
  right click on the link and select 'Save Link/Target As'.
   
  if you have problems, try this download link:
  OTL
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check

.

 

.

http://img.photobucket.com/albums/v708/starbuck50/new/Otllatest.png

 

Now copy the lines in bold below.

 

netsvcs

msconfig

%SYSTEMDRIVE%\*.*

%systemroot%\system32\Spool\prtprocs\w32x86\*.dll

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\system32\*.exe /lockedfiles

%systemroot%\System32\config\*.sav

%PROGRAMFILES%\*

%USERPROFILE%\..|smtmp;true;true;true /FP

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

hklm\software\clients\startmenuinternet|command /rs

hklm\software\clients\startmenuinternet|command /64 /rs

CREATERESTOREPOINT

 

• right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.
   
  http://img.photobucket.com/albums/v708/starbuck50/new%20forum/scan-fix.png
  .
  
• Click the Run Scan button.
   
  http://img.photobucket.com/albums/v708/starbuck50/runscan.png
   
  
• Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.

 

 

Thanks