Avast WEBforum
Other => Viruses and worms => Topic started by: dwilmot on March 01, 2014, 07:09:57 PM
-
Hi,
New to this forum so forgive me if this has been posted before but I keep getting the above page turn up when I do a search in the Chrome omnibox . It also turns up in IE occasionally.
I have had it for a couple of months off and on and the techs at Malwarebytes were trying to get rid of it without any success so I have given up with them...................
I have all the methods they tried and can post them if needed BUT is there any way to get rid of this annoying Yahoo search crap.
I have emailed Chrome and Yahoo weeks ago but they couldn't care less as they haven't replied so either they don't care or they don't know how to fix this.
I am using Win7 32bit.
Any ideas?
Thanks.
-
Please attach your logs. (MBAM, OTL and aswMBR..!!)
Instructions: http://forum.avast.com/index.php?topic=53253.0
-
Monitoring...
-
Herewith files as requested but no Extras file generated. BTW this and other scans were done by the Malware people with no results but hope springs eternal............
-
Forgot to do the aswMBR thingy....... I started the scan at 15.57 and at 16.10 it was scanning a file in programData called arh.exe and has been stuck there ever since.......... So what to do???
-
Here is the aswmbr log file which was generated after almost 1hour and 30 mins. Hope it makes sense to you.
-
Please download Farbar Recovery Scan Tool (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/) by Farbar and save it to your desktop.
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.
- Double-click to run it. When the tool opens click Yes to disclaimer.
- Under Optional Scan ensure "List BCD" and "Driver MD5" are ticked.
- Press Scan button.
- It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
- The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
-
Hi,
Thanks for the new info.
Have done as requested but once again only one file generated the FRST one and that is attached. I have done a search for the Addition.txt file but it does not appear to be on my system.
We have done all these scans but seem no closer to solving it and this was what happened with the Malwarebytes techs. Am I chasing ghosts?
Thanks
DW
-
I need Addition.txt, so run FRST again, check Addition.txt and attach both reports.
-
Hello,
Have done as requested and attached are both files.
As a matter of interest what do these scans tell us?
Also I have over 19,000 entries in my registry even though I clean it. Is this excessive?
Thanks
DW
-
Your PC seems clean, and Chrome setting are good.
Try these solutions:
https://support.google.com/chrome/answer/95314?hl=en
https://support.google.com/chrome/answer/95426?hl=en
Run Adwcleaner as well as:
Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) by Xplode and save to your Desktop.
Double click on AdwCleaner.exe to run the tool.
- Click on the Scan button.
- After the scan has finished click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
- After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
- Post logfile will also be saved in the C:\AdwCleaner folder.
-
Hello, T.H.E,
Scan done as requested.
The attached file is R5 as I used this software in January to try to solve this problem.
I wonder if it is gone now? Only time will tell.
Thanks for your help and if it reappears I will let you know.
DW
-
Hello THE
It's back !!!!!
Today in Chrome I clicked on a link in a web page and this is where I ended up:
http://us.yhs4.search.yahoo.com/yhs/search?hspart=newnet&hsimp=yhs-looksafe&type=266639_1655_can_0_0_0_1_&p=www.motorscan.us
What I clicked on was the www.motorscan.us link in a web page and it took me to the Yahoo search. I wasn't even in the omnibox. I wasn't doing a search. So is going on here???
ANy further thoughts???
Thanks
DW
-
Did you followed my instructions in order to set Chrome setting properly?
-
Hi T.H.E.
I did all that several times before. After I got your advice I did it again.
I have in the past re-installed Chrome, set to default settings and then set up the omnibox etc all to no avail.
The ONLY search engine I have in the search menu box is Google so I don't know where else to look and the Chrome forum isn't of any help. Same with Internet Explore, the only add on is Google.
I started having this problem at the beginning of January 2014 and I notice that the searches we were running earlier on were 30 day ones. Might it be better to do older scans?
Here is the link to Chrome that I had been using which didn't go anywhere...........
https://productforums.google.com/forum/#!msg/chrome/CeUowq4YiiQ/ttZcB2prPAwJ
As mentioned I have run ADWcleaner before and I have some scan results starting in Jan. Would these be of any help? Also a quarantine file.
Thanks for your advice.........
DW
-
And you still have Yahoo search?
-
Hello T.H.E.
yes still have it as mentioned in post 12 above.
When it just turns up I close down the browser, clear caches, history etc and fire it back up. Sometimes it's gone and other times as soon as I do a search it's back.
Right at the beginning of this problem I went here for an answer but didn't follow it up as I was not able to find the files they were talking about:
http://blog.mitechmate.com/remove-us-yhs4-search-yahoo-com-redirect-fake-yahoo-search-removal-guide/
Have you come across this solution and would it work?
Thanks
DW
-
Please download zoek.zip or zoek.rar by smeenk ((http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png)) from here (http://www.hijackthis.nl/smeenk/201213/zoek.zip) or here (http://www.hijackthis.nl/smeenk/201213/zoek.rar) and save it to your Desktop.
Unpack the archive...
- Close any open browsers
- Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this (http://'http://www.techsupportforum.com/forums/f50/how-to-disable-your-security-applications-490111.html') or this (http://'http://www.bleepingcomputer.com/forums/topic114351.html') Instruction.
- Double click on zoek.exe to run the tool .
Please wait for the tool to start...
- Copy the text present inside the code box below and paste it into the large window in the zoek tool:
StandardSearch;
Yahoo;z
Yahoo;a
- Click on (http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png) button.
Please wait until a logreport will open (this can be after reboot)
- Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named "zoek-results.log"
-
Hi D.H.E.
Thanks for the update.
Here is the result of the scan
DW
-
Try to uninstall Mozilla Thunderbird, restart your PC and tell me how is the situation now.
-
Hi T.H.E.
Thanks for your reply.
If I remove Thunderbird won't I loose all my emails etc??? That would be a problem.
Is the reason to remove Thunderbird this entry in the zoek scan?
C:\Program Files\Mozilla Thunderbird\searchplugins\yahoo.xml
BTW The yahoo search results page has not turned up again since my last mention of it a few posts ago.
DW
-
Ok, then we're done :)
I can recommend you this software to avoid Adware in the future:
http://unchecky.com/
Read here how it works --> http://www.howtogeek.com/179758/how-to-avoid-junkware-offers-with-unchecky/
• The following will implement some post-cleanup procedures:
=> Please download DelFix (http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/9-delfix) by Xplode to your Desktop.
Run the tool and check the following boxes below;
(http://www.mcshield.net/personal/magna86/Images/checkmark.png) Remove disinfection tools
(http://www.mcshield.net/personal/magna86/Images/checkmark.png) Create registry backup
(http://www.mcshield.net/personal/magna86/Images/checkmark.png) Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)
The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.
-
Hi D.H.E.
I will do as you say.
Is there any way I can converse with you in private?
Thanks
DW
-
Get 20 posts and send me the private message :)
-
OK I think I understand
DW
-
need to post 20 messages
-
this is #20
-
Hi THE
Just meant to add my thanks for all the efforts you have made to eradicate this annoying Yahoo bug.
Thank you.
DW
-
Today the Yahoo turned up AGAIN. It is still in my system, though how is beyond me. Also when I did a search using Chrome I got a message from Google telling me I had done too many searches from my computer and I had to complete a Capcha before it would let me search. WTF is this all about?
Anyone with any more ideas on how to get rid of the Yahoo search?
Thanks
DW