Cannot Remove Yourtv.link using MBAM (logs attached)

[zijin_cheng]

Hello, I have yourtv.link on my computer using Google Chrome meaning all my searches are being rerouted to a custom google search and I cannot change the default search engine because it says "search default set by admin".

 I have tried a couple of things to try removing yourtv.link from my computer.

• Went into the registry to change the default browser
• Uninstalled/Reinstalled Chrome
• Avast
• Spyhunter 4
• Window's Malicious Software Removal Tool (please see mrt.log below)
• Malwarebytes

Malwarebytes finally detected yourtv.link (about 6-7 threads) on Scan #1 (report below) and I had those items quarantined. I rebooted and deleted the quarantined items but my google search is still set as the default google cse search. So I ran the scanner 3 more times rebooting between each time (Scans #2-#4) and all of them came back clean.

These were the settings for the scans:

Scan for rootkits, treat PUP/PUM detections as malware.

 

I then also tried out Farbar Recovery Scan (FRST/Addition.txt attached below)

Settings used for Farbar: All items in Whitelist checked, Addition.txt checked

 

I also ran Adwcleaner and 10 threats were found and fixed/quarantined. Please see the Adwcleaner log below.

 

Anything else I should try?

Scan #1 (threats found).txt

Scan #2 (clean).txt

Scan #3 (clean).txt

Scan #4 (clean).txt

Addition.txt

FRST.txt

mrt.log

AdwCleaner[S0].txt

[cardboarddude]

I'm having the same problem and created my own post on this issue. No help so far...why did I buy Malwarebytes again??

[Ried]

Hello zijin_cheng, welcome to Malwarebytes, and please accept our apologies for the oversight of your topic. 

 Not surprisingly, I'm not seeing anything in the log.  Chrome can be very difficult to remove adware from. Often times they get into areas that no tools - public or private - are able to get in deep enough to see the source and remove it without breaking Chrome.

I do see that restrictions have been put on Chrome by this adware which is why you are seeing that message when you try to change the default Search engine. The Fixlist.txt I've attached will remove those policies which should allow you to then remove it via the Chrome Settings.

Download the attached Fixlist.txt and save it in the same location as FRST.exe.  Both the Fixlist.txt and FRST.exe must be in the same location for the script to execute.

1. Double click FRST.exe to launch the tool

2. When the tool opens, click the *FIX BUTTON*.

3. Once it has finished, a Fixlog.txt will open and also have been saved in the same location the tool was run from , please send me the Fixlog.txt in your next reply.

Try to remove that Search from Chrome Settings and if it still won't remove, try Chrome CleanUp Tool  https://www.google.com/chrome/cleanup-tool/

If all of the above fails, your only choice is to uninstall Chrome and start fresh with it.  It is imperative that you also delete specific Chrome folders as they hold the current settings. If you reinstall Chrome without deleting these folders, those same settings will be put right back into Chrome.  See this page for instructions on exporting your Bookmarks https://support.google.com/chrome/answer/96816?hl=en

To locate one of them, you'll need to be able to see  Hidden folders.  To do that, on your keyboard, press the Windows logo key and the letter E to open Windows Explorer.

In the menu across the top of that window, click View tab

(If you don't see a menu, press the Alt key on your keyboard and it will appear)

Place a check in the box next to 'Hidden Items' then please navigate to the following folders and delete them by right clicking and selecting 'Delete':

C:\Program Files (x86)\Google\Chrome

C:\Users\zijin\AppData\Local\Google\Chrome

Please let me know the outcome.

Fixlist.txt

[Ried]

@cardboarddude You are being helped in your topic, please read what TwinHeadedEagle posted to you on Monday. He provided a fix for you to run which you apparently overlooked.

[cardboarddude]

It never finished 'fixing.' After 24hrs + of uninterrupted execution, it is still running. The new Fixlog is attached.

Fixlog.txt

[cardboarddude]

And I still get the YourTV.link appearing, but my Chrome browser is now having problems such as extensions loading, but not functioning properly, Adobe Flash will no longer working, and random outbound/inbound requests are being blocked by MalwareBytes.

[zijin_cheng]

17 hours ago, cardboarddude said:

And I still get the YourTV.link appearing, but my Chrome browser is now having problems such as extensions loading, but not functioning properly, Adobe Flash will no longer working, and random outbound/inbound requests are being blocked by MalwareBytes.

Thank you staff, it has removed the default omnibox search. 

 

@cardboarddude, did you try reinstalling + messing with the reg in addition to the recommended steps shown by malwarebytes staff? That might help.

Guide here, ignore all the clickbaity stuff but scroll down until you see the registry stuff.

www.techsupportall.com/remove-yourtv-link-homepage-ads-removal-help/

[Ried]

@zijin_chengI'm glad to hear all is well now.

@cardboarddudePlease return to your own topic and continue working with TwinHeadedEagle

[Ried]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.