Need help removing PUM.Homepage infection

[BillWasserman]

Basically I think you did it...but a few issues for your review and comment:

1. I ran another AdwCleaner scan and received positive results (log is attached). Mindful of the last sentence of your last post I had AdwCleaner delete the offending keys, rebooted the PC and opened IE (based on my notion that activating a browser somehow set malware events in motion). I surfed a minute or two, closed IE and reran the scan - no malware found. Can I safely assume this is the end of this problem?

2. Is it OK to re-install Chrome? I'm making a new, clean Gmail account rather than re-use the one associated with the problem.

3. IE is, I think, a bit impaired. The browser is lethargic and, when started, gives a series of messages about IE crashing; the program needing to be closed; the page needing to be reloaded; etc. I'm attaching a screen capture of the sole message that stayed on the screen for your consideration. Is there a way to correct any IE faults through Microsoft Update?

4. At least three (3) ports on a USB 3.0 hub have ceased functioning. The ports all worked prior to the last two weeks. Are there tests I can run to determine if other components may have been damaged?

5. I had to uninstall webcam software and UPS software then reinstall same to get the two devices to work. I think the software was likely damaged by the infection (and if it is I got off very light) - is this hypothesis possible?

I hope you'll allow me to take a bit more of your time by pressing for your responses to the questions above.

Finally, and with the utmost sincerity I'm in awe of your technical prowess as well as your willingness to share those skills with others in need who will never reach your level of knowledge. Thank you from the bottom of my heart.

bill

2017.05.11 - 18.46.47 - AdwCleaner log.txt

[BillWasserman]

I may have spoken too soon - I went to the web page of a parrot rescue I support and saw a pop-up generated by Malwarebytes (screen capture attached)

[AdvancedSetup]

Hi Bill,

Before I answer your other questions, can you post the link you went to or send it to me in private message so I can check it out. It is not an infection, but it is a site we're blocking. It could just be an Ad on the site maybe. I'll need the link or the full Malwarebytes protection log to check it out.

Thanks

Ron

 

[AdvancedSetup]

I'd also like to get a fresh set of FRST logs before we reinstall Chrome. Don't think there is an issue at this time, but doing a double-check won't hurt.

 

[BillWasserman]

Will do tomorrow afternoon (volunteer gig in morning). 

[AdvancedSetup]

Sounds good. Post when ready.

 

[BillWasserman]

Got up early to produce and upload the files. All three are attached, per your request.

2017.05.11 - 19.55 - MalwareBytes Protection Event log.txt

2017.05.04 - 07.24 - FRST.txt

2017.05.04 - 07.24 - Addition.txt

[AdvancedSetup]

Chrome now if you like and let me know if the homepage redirects returns.

For the USB, please open the device manager and see if there are any yellow or red items there and let me know.

 

[BillWasserman]

PUM.Homepage & Pum.Gen0 found with RogueKiller and ask.com & aol.com found with AdwCleaner. Will run FRST & upload logs after I post this. 

2017.05.13 - 20.54.37 - AdwCleaner log.txt

2017.05.13 - 20.25.18 - RogueKiller log.txt

[BillWasserman]

FRST and Addition logs attached

2017.05.13 - 21.24.16 - Addition.txt

2017.05.13 - 21.23.08 - FRST.txt

[AdvancedSetup]

I'm running out for a bit. Will check back and reply later. If I miss you send me a PM Bill

Thanks