Author Topic: Chrome possibly infected?  (Read 2625 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
Chrome possibly infected?
« on: February 08, 2016, 02:02:42 AM »
Hello

So my search engine has been acting funny, and is missing quite a bit of options that were once there. It's almost as if it gets redirected to a custom search engine. I have tried resetting my options, running avast, running malwarebytes (Which found some stuff, but didn't fix it), Chrome fixer, everything I have ran is saying nothing is wrong. I have tried uninstalling chrome and deleting the cache, running chrome as a guest, clearing my entire history/cookies/everything. I have tried using a different search engine, yet it comes back with an error, a tunneling error, whatever that means? I've checked my extenstions/plug-ins everything looks fine, can you help?

The evidence:

a google search URL looks like this https://cse.google.com/cse?cx=017628126614017098810:c2rlwcsnsbe&q=help&oq=help&aqs=chrome.0.69i59l2j69i65l3j0.1151j1j7&sourceid=chrome&ie=UTF-8#gsc.tab=0&gsc.q=help&gsc.page=1

The attached photo show what it looks like on my end. ( https://15104268797498972201.googlegroups.com/attach/33690d163e89e/chromeactingfunny.png?part=0.1&view=1&vt=ANaJVrEgo3HqocdAu4Tb4Kjt6F1wWD8XoqGTVEPlTAQrDUn02XgJGmWPOtKEWjwoEDVXaCzXvOngBCXqjsp-hebDRnMcuAriuAdxZn4nP4pnPPttrnthuUA )

In my settings the defailt search engine is set to Google.com and it has this string of text behind it  {google:baseURL}search?q=%s&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:contextualSearchVersion}ie={inputEncoding}
 
It won't let me edit it, so I figured it's a default string, still unsure which is why I posted it.

Is it possible to edit a file that would be causing this? Or is it a virus of some sort?

Any help would be much appreciated!!

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Chrome possibly infected?
« Reply #1 on: February 08, 2016, 06:00:45 AM »
Attach your basic diagnostic logs. (MBAM, FRST and aswMBR)
Instructions: https://forum.avast.com/index.php?topic=53253
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

REDACTED

  • Guest
Re: Chrome possibly infected?
« Reply #2 on: February 08, 2016, 07:21:30 AM »
Alright so my friends and I were able to figure it out. A simple reg edit fixed it, for how long I don't know. https://www.youtube.com/watch?v=b8JZ3ZQ1gAg These were the steps I took and it worked. I'll post my logs, maybe it'll help?

REDACTED

  • Guest
Re: Chrome possibly infected?
« Reply #3 on: February 08, 2016, 07:27:15 AM »
Here are the rest of my logs, I hope that's everything

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Chrome possibly infected?
« Reply #4 on: February 08, 2016, 07:29:32 AM »
OK, now you've to wait a bit...
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

REDACTED

  • Guest
Re: Chrome possibly infected?
« Reply #5 on: February 08, 2016, 07:31:55 AM »
I'm patient :) Thanks for the help BTW

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Chrome possibly infected?
« Reply #6 on: February 08, 2016, 07:33:02 AM »
OK. :) You're welcome.
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

REDACTED

  • Guest
Re: Chrome possibly infected?
« Reply #7 on: February 08, 2016, 12:55:16 PM »
  • Step #1 Fix with AdwCleaner
    • Download AdwCleaner by Xplode to your Desktop from the following link.
    • Right-click on AdwCleaner.exe and choose Run as administrator;
    • Click on Option and put a tick mark on everything;
    • Click on Scan and let the program run unhindered;
    • When done, click on Clean and allow the system to reboot after it is done;
    • A log will be opened automatically after the restart. If not, it is located in C:\AdwCleaner\AdwCleaner[CX].txt, where X is replaced with a number;
    • Attach the log file to your reply.


Reset your browser. Attach a fresh FRST scan log.



  • Required Log(s):
    • AdwCleaner Log
    • FRST.txt
Regards,
Valinorum