yourtv.link ... doesnt go away

[BenFro1981]

Hi Guys,

 

I am looking all over the place and seeing a lot of people having the same trouble as me with the yourtv.link stuff. 

 

I ran malwarebytes but it didnt help.

 

It seems to me that some of the fixes you guys offered helped, so it would be great if you could help me with a fixlist for FRST?

 

Thank so much in advance.

 

Cheers,

 

Benjamin

Addition.txt

FRST.txt

[Psychotic]

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

• First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
• Perform everything in the correct order. Sometimes one step requires the previous one.
• If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
• Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
• Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
• Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
• My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

 
 
Is there any program you didn´t try on your own?
 
 
Going over your logs I noticed that you have uTorrent installed.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
• They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.
  

It is pretty much certain that if you continue to use P2P programs, you will get infected again.
I would recommend that you uninstall uTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.
If you wish to keep it, please do not use it until your computer is cleaned.

 

 

 

Fix with FRST (normal mode)

WARNING: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• Download the attached fixlist.txt and save it to the location where FRST is saved to.
• Run FRST.exe (on 64bit, run FRST64.exe) and press the Fix button just once and wait.
• The tool will make a log (Fixlog.txt) which you find where you saved FRST. Please post it to your reply.
  

 
 
 
Full System Scan with Malwarebytes Antimalware

• 
  If not existing, please download

Malwarebytes Anti-Malware to your desktop. Double-click the downloaded setup file and follow the prompts to install the program. At the end, be sure a checkmark is placed next to the following:

• Launch Malwarebytes Anti-Malware
• A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.

[*]Click Finish.

If the program is already installed:

• Run Malwarebytes Antimalware
• On the Dashboard, click the 'Update Now >>' link
• After the update completes, click the 'Scan Now >>' button.
• Or, on the Dashboard, click the Scan Now >> button.
• If an update is available, click the Update Now button.
• A Threat Scan will begin.
• When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
• In most cases, a restart will be required.
• Wait for the prompt to restart the computer to appear, then click on Yes.
  

• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the scan log which shows the Date and time of the scan just performed.
• Click 'Copy to Clipboard'
• Paste the contents of the clipboard into your reply.
  

 

 

 

Scan with ESET Online Scan

Please go to here to run the online scannner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked
• Click on Advanced Settings and ensure these options are ticked:
  • Scan for potentially unwanted applications
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology

[*]Click Scan[*]Wait for the scan to finish[*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.

 

fixlist.txt

[BenFro1981]

Dear Marius (also from Germany? )

 

thank you for your fast answer. I applied the fixlist and did the mbam scan. The eset scan also. See the files applied.

 

 

Fixlog.txt

mabm.txt

eset_file.txt

[BenFro1981]

I re started the pc but unfortunately the problem still seems to exist. It is not the default starting page anymore but still the search immidiatly goes to the "google custom search"...

[Psychotic]

C:\Users\Benjamin\AppData\Roaming\uTorrent\updates\3.4.2_33394.exeC:\Users\Benjamin\Downloads\uTorrent.exe   

These files aren´t malware but contain security risks. I´d delete them immediately - your choice.

 

Then we can do the cleanup - if you are facing any issues, report that immediately.

Delete junk with adwCleaner

Please download AdwCleaner to your desktop.

• Run adwcleaner.exe
  
• Hit Scan and wait for the scan to finish.
  
• Confirm the message but don´t uncheck anything.
  
• Hit Clean
  
• When the run is finished, it will open up a text file
  
• Please post its contents within your next reply
  
• You´ll find the log file at C:\AdwCleaner[s1].txt also
  

Delete junk with JRT

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
  
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  
• The tool will open and start scanning your system.
  
• Please be patient as this can take a while to complete depending on your system's specifications.
  
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  
• Post the contents of JRT.txt into your next message.
  

SecurityCheck

Reboot your system before starting!

Please download SecurityCheck: LINK1 LINK2

• Save it to your desktop, start it and follow the instructions in the window.
  
• After the scan finished the (checkup.txt) will open. Copy its content to your thread.
  

[BenFro1981]

 Ok I followed the steps above but the problem remains.

 

As soon as I use Chrome and enter a search, it switches to the custom search. Somehow its forces Chrome to that.

 

 

JRT.txt

checkup.txt

checkup.txt

JRT.txt

AdwCleanerS6.txt

[BenFro1981]

It only seems to affect chrome, not IE.

[Psychotic]

Please reinstall chrome following these instrcutions: http://www.wintips.org/how-to-completely-uninstall-re-install-google-chrome/

Tell me the result.

[BenFro1981]

Hi Marius,

 

thank you for the answer. Unfortunately, even after that, the problem remains. I m using firefox at the moment at firefox is not affected. I also ran mabm and frst again and the pc seems to be allright otherwise. So probably I just switch to firefox?

 

What do you suggest?

[Psychotic]

Please download Malwarebytes Anti-Rootkit from here

• Unzip the contents to a folder in a convenient location.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• If any threats are found, don´t click the Cleanup button - rather save the log and post it up in your topic.
  

[BenFro1981]

Hi, it says no malware found, no clean up needed.

[Psychotic]

Scan with OTL

1. Download OTL by OldTimer and save it to your desktop.
2. Double click on the OTL.exe icon on your desktop. If you are using Vista, please right-click and select run as administrator
3. Click the "Scan All Users" checkbox.
   
   
   Note: If you are using a Windows 64bit machine, please make sure the checkbox next to Include 64Bit Scans is checked. It will be checked by default.
   
   
4. Push the button.
5. It will now begin to scan, please be paitent while it scans.
6. Two reports will open once it's done.
7. Please copy and paste them in your next reply:
   
   • OTL.txt <-- Will be opened
   • Extras.txt <-- Will be minimized
     

[BenFro1981]

please find attached

Extras.Txt

OTL.Txt

[Psychotic]

Good.

What exactly happens when you run  a search with chrome?

Try to explain it as detailed as possible and attach screenshots.

[BenFro1981]

Basically what first happend was

 

IE, Firefox and Chrome - Starting Page was changed to yourtv.link

 

This was resolved following the steps you gave me in this thread up until now.

 

I de - and then -reinstalled Chrome like you said above.

 

Now When I open Chrome (not logging in on my account) and tipe in a search, it automatically changes to a custom search as show in the two screenshots.

 

You can see that the custom search is still linked to yourtv.link.

 

[Psychotic]

Search with FRST


Run FRST.

Type the following in the edit box after "Search:"
 

yourtv.link

Click Search registry button and post the log (Search.txt) it makes to your reply.

[BenFro1981]

nothing found...

Search.txt

[Psychotic]

Run FRST, check the boxes for addition.txt and shortcut.txt and hit scan.

Provide the logs, when ready.

 

We have removed the threat itself but it is a bit different to get rid of the altered browser settings in chrome.

[BenFro1981]

ok here they are.

FRST.txt

Addition.txt

Shortcut.txt

[Psychotic]

Please delete your existing copy of JRT.

 

Delete junk with JRT

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

[BenFro1981]

please find attached

JRT.txt

[Psychotic]

OK, what about the custom search now? ^^

[BenFro1981]

Still there sorry :-D I m really not sure how this is happening...

[Psychotic]

Chrome is hard to modify...:-(

 

Please follow these instructions to reset chrome: https://support.google.com/chrome/answer/3296214?hl=en

 

Tell me if that worked

[BenFro1981]

I reset everything but the problem was still there, so I deactiveted all of the Settings in "Advanced Settings". Now its seems to work fine, the custom search disappeared! Thanks a lot!