yourtv.link browser hijack keeps coming back

[tjalexander]

Hello,

I have been having trouble using malwarebytes and a few other tools I have found through searching these forums to remove a browser hijack that reroutes searches through a site called 'yourtv.link'

I noticed the change the other day after signing on to the PC after it had rebooted due to a "windows update" (could have been a legit update and not related, not sure).

I also noticed my CPU usage railed at 100% due to a "windows 7.exe", but was able to successfully remove that malware (a bitcoin miner bot).

 

Anyways, I run malwarebytes and it finds the 'yourtv.link' registry files and modified chrome.exe, firefox.exe, etc. and says that it has successfully removed them, but they return each time after a system restart.

I would like help in *permanently* removing this infection from my system.

 

I have attached the latest mbam log and FRST log, and Addition.txt

Addition_2.txt

FRST_2.txt

mbamlog_2.txt

[TwinHeadedEagle]

Hello and

 

 Scan with Malwarebytes' Anti-Malware

Please re-run  Malwarebytes' Anti-Malware.
 

• First of all, select update.
• Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.
• In the same tab, under PUP and PUM detections make sure it is set to Treat detections as malware.
• Click the Scan tab, choose Threat Scan is checked and click Start Scan.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the newest Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.



Please download Zemana AntiMalware and save it to your Desktop.

• Install the program and once the installation is complete it will start automatically.
• Without changing any options, press Scan to begin.
• After the short scan is finished, if threats are detected press Next to remove them.

Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.

• Open Zemana AntiMalware again.
• Click on  icon and double click the latest report.
• Now click File > Save As and choose your Desktop before pressing Save.
• The only left thing is to attach saved report in your next message.

[tjalexander]

Hi, thanks for helping me with this issue.

Here are the latest log files for Malwarebytes and Zemana as you have requested.

 

2016.04.17-11.19.25-i0-t92-d1.txt

mbam.txt

[tjalexander]

After running MBAM again and running Zemana these threats continue to return after a system reboot:

[tjalexander]

I should also note that I do not currently have Google Chrome or Firefox installed on this computer. Previously had Chrome and uninstalled it, never had Firefox.

Currently using IE to access this forum (and only this, not giving it any other passwords until I know it's clean)

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
  

Please upload them into your next reply.

[tjalexander]

Addition.txt

FRST.txt

[tjalexander]

Update:

 

I got a new Windows 7 security update, ran Malwarebytes once again and it removed the offending yourtv files and they appear (so far) to stay gone now.

 

Will report back after 24hrs and see if they are still gone

[B14KER]

I'm having the same problem, tried everything to my knowledge but i have windows 10 and haven't had an update.

[TwinHeadedEagle]

Please start your own topic.

[tjalexander]

My issue has been resolved, thanks for the help

[snippy]

Hello tjalexander.  I have the exact issue that you had from what I can see on your screenshot.  How did you resolve this?  Driving me nuts!

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!