Hello Ron,
Just to confirm, I have seen this too, the user reports its been happening since late last week, only since installing malware bytes trial edition has the behaviour changed, rather than loading "www.msftconnecttest.com/redirect" in the default browser every few minutes, Malware Bytes v3 trial now detects this other URL as per above (vidads.themediastreet.com) and blocks the activity. However, I have just run malware bytes trial edition, full custom scan of the entire C drive with rootkits ticked, and it only found a shortcut to booking.com on the start menu.
I've run the AdwCleaner as per step 2, the logs have only found this: ***** [ Chromium (and derivatives) ] ***** SearchProvider deleted: Ask Jeeves - uk.ask.com , it has also reported this: ::Tracing keys deleted - ::Winsock settings cleared - ::Additional Actions: 0 . Other than that, nothing found. The application did ask for a reboot to complete the removal process and the user had to assist with clicking the restart/yes button as I lost connection remotely. So not sure if that has helped. But at the moment, the browser is not loading every few minutes, but I have not waited log enough to fully confirm.
I have now run "Farbar Recovery Scan Tool" and the logs do not appear to contain anything out of the ordinary, I will post the logs if the problem comes back, otherwise, due to the possible sensitive information it has gathered, I'll refrain from attaching it for now.
But, I hope this helps other users for now!
Thanks - Tim.
