Malware keeps opening Chrome tabs

[Javier3D]

Hello, thanks for the help you offer.

I have this problem that some malware or virus keeps opening Chrome tabs to random websites, Malwarebytes do not find anything, I upload the logs. I had a problem with usb which corrupted the files renaming folder with large weird names, after error check it with Windows 10 option it recover some but most file were lost converting folder into file type. So, I am guessing it is the same malware from the usb that infected my pc.

I hope you the info is complete and someone get with the issue. 

Thanks a lot for the help

Addition.txt

FRST.txt

Log_Malwarebytes_3.2.2.txt

Log2_Malwarebytes_3.2.2.txt

[AdvancedSetup]

Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Firefox
Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• First, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the run dialog box.
  • 
• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks

 

Restart your computer now and make sure there are no longer any redirects or other browser issues. 

 

[Javier3D]

3 hours ago, AdvancedSetup said:

Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Firefox
Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• First, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the run dialog box.
  • 
• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks

 

Restart your computer now and make sure there are no longer any redirects or other browser issues. 

 

 

Hello, thank you for your answer,

I followed the procedure for Google Chrome which is my main browser (I only use Edge in rare cases the website has issues with Chrome), I do not have Firefox and Iexplorer can not be uninstall.

After the 'reset sync' I have noted less tabs appears, it only happens when I try to search something, and it shows 'Secure-surf.com' search (I found in Google this is some browser hijacker), other time the tabs created shows 'putrr18.com' before showing some website ad, this putrr18 is another malware. There are some google options to eliminate this issues but I follow none as you recommend is some posts.

Hope you can help, I am kind of worry since I use my pc for some bank/financial transactions. 

[AdvancedSetup]

Generally that type of cleaning of Chrome will remove this completely. If you're still having a redirect issue please double-check and make sure Google, Chrome sync was disabled. If not, then that too will restore the old settings.

If still an issue we may have to export your bookmarks, then uninstall Chrome and do a general cleanup. Verify it's all gone and then reinstall Chrome. So, let me know for sure if you're still having an issue or not.

Thanks

Ron

 

[Javier3D]

1 hour ago, AdvancedSetup said:

Generally that type of cleaning of Chrome will remove this completely. If you're still having a redirect issue please double-check and make sure Google, Chrome sync was disabled. If not, then that too will restore the old settings.

If still an issue we may have to export your bookmarks, then uninstall Chrome and do a general cleanup. Verify it's all gone and then reinstall Chrome. So, let me know for sure if you're still having an issue or not.

Thanks

Ron

 

Hi Ron,

I repeat the process and I am sure I kept the bookmarks but now the bookmarks and extensions are missing, I guess it did not restore it correctly, since when Chrome try to sync I clicked 'learn more' (or something like that) and it opens a tab with options for choosing what to sync, I made no changes but it does not recover anything. In the sync tab it states Chrome has sync recently

The bookmarks are shown when I open a tab (but without website icon, just blank icon), but as soon as open a website the bookmars disappear .

The good new is it resolve the issue since I have not seen another redirect, but I really want to recover the bookmarks and extensions. Is there any solution?

Thanks for the help

EDIT:

Appereantly I dissabled the 'show bookmarks tab', so I got the bookmarks back (thanks Universe).

Is there a possibily to recover the extensions without installing all back? Last time Chrome added automatically 

 

Edited September 19, 2017 by Javier3D

[AdvancedSetup]

The extensions no, they were removed on purpose as they are often the cause of the redirect infection.

If you followed the directions the bookmarks should still be there. If they were deleted then they might be in your Recycle Bin. Open your Recycle Bin and see if they are in there or not. If they are then restore them. If not then we may have to try to do a System Restore point and but the computer back the way it was a day or so ago.

Let me know

Thanks

Ron

 

[Javier3D]

Hi Ron, I edited while you where answering. 

I got the bookmarks back, was a silly stuff.

I will add the Chrome extensions again.

Thanks for the help with this issue

[AdvancedSetup]

Great, glad you were able to resolve the bookmark issue. Yes, new, clean extensions are the best way to go.

Using some type of Ad blocker would be recommended too.

Let me know if you need anything else or not. I'll soon close your topic then as completed.

Thank you again

Ron

 

[Javier3D]

20 minutes ago, AdvancedSetup said:

Great, glad you were able to resolve the bookmark issue. Yes, new, clean extensions are the best way to go.

Using some type of Ad blocker would be recommended too.

Let me know if you need anything else or not. I'll soon close your topic then as completed.

Thank you again

Ron

 

Thank you so much for your time and great assistance with this issue, I am happy to see people offering this kind of help for free. 

Just to finish, is there some other recommendation to maintain the health of the pc? I've never use an ad blocker before and I can remember I had any virus/malware issues for a long time, but I will investigate for one

You can mark it as completed

[Javier3D]

Hi Ron, sorry to bother again.

I think I still got one issue, the malwarebytes had poped-up saying had blocked one tab about onclkds.com :/ not sure what happened but to be sure please let the forum open to see how the issue evolve.

Thank you

[AdvancedSetup]

That's is part of what an Ad Blocker will help with. Please read the following. You don't have to do all that it says, but read it to get more information on how to better protect your computer. If you have questions please let me know.  Read post #23 from @Aura

 

Thanks

Ron

 

[Javier3D]

21 hours ago, AdvancedSetup said:

That's is part of what an Ad Blocker will help with. Please read the following. You don't have to do all that it says, but read it to get more information on how to better protect your computer. If you have questions please let me know.  Read post #23 from @Aura

 

Thanks

Ron

 

Thank you so much for the link, very useful tips and information. 

Do you recommend me to follow the procedure before continue installing and configuring web extension?

I am getting a redirect when I google search, it convert the page to a yahoo search, this not happen always but often, it is very anoying and I guess the ad blocker can not do much after the malware is active

[AdvancedSetup]

If it's happening often then send me a private message with the link and I'll see if I'm getting one and what might be going on.

 

[AdvancedSetup]

Are these redirects only happening in Chrome? What about any other browsers?

 

[Javier3D]

54 minutes ago, AdvancedSetup said:

Are these redirects only happening in Chrome? What about any other browsers?

 

I also have installed Microsoft Edge which I barely use, I opened before (when starting the solution of the thread) and no pop-up issues there. However, now I open Edge, went to Google and I see 'secure search' on top of the page, so maybe is something someplace else.

When I try to search in Google box, the words start appearing in that 'secure search' box. 

[AdvancedSetup]

Secure Search is typically from AVG antivirus, but I'm not seeing AVG in your logs.

Let's go ahead and rescan your system again, just in case.

 

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[Javier3D]

Ok I have not AVG installed, I use Panda as my main antivirus. 

Before I read the reply, Malwarebytes showed me an alert that some problem were found and fixes, I saved that log and start following your procedure, I run Malwarebytes scan again after restart, that analysis shows zero problems. I attach both log reports

AdwCleaner Log after restart:

# AdwCleaner 7.0.2.1 - Logfile created on Wed Sep 20 07:55:18 2017
# Updated on 2017/29/08 by Malwarebytes 
# Running on Windows 10 Pro (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

Deleted: C:\Users\Usuario\AppData\Local\Assistant

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\solvusoft.com
Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.solvusoft.com
Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\solvusoft.com
Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.solvusoft.com
Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\softonic.com
Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\tridnet.softonic.com
Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.softonic.com
Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\softonic.com
Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tridnet.softonic.com
Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.softonic.com

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [3302 B] - [2017/9/20 7:54:32]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

 

Is the system safe now? Not sure if the software solve the issues 

Thank you once again

Log-0218.txt

Log-0242.txt

FRST.txt

Addition.txt

[AdvancedSetup]

I would highly recommend that you discontinue use of Peer2Peer software - µTorrent that is a good way to get your computer infected as well as the vast majority of content shared is illegal in almost all countries.

You have our service disabled via MSCONFIG, please remove that setting

I would highly recommend not using MSCONFIG

Please read the following article concerning the use of MSCONFIG
Msconfig Is Not A Startup Manager
 

ATTENTION: System Restore is disabled

Please enable System Restore and create a new System Restore Point

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

 

[Javier3D]

Thank you for your answer, I have not remember messing up with MSconfig in months or years, I do remmember I disabled some things for quick starts, good to understand more about MSConfig.

I do not remmember  disabled System restore, it does not seems like a smart move to disabled it. Is activated now

About uTorrent I barely used, last time I remmemebr was when I needed a software, my internet connection was vey slow and the author had the option to use torrent, so I chose that in order to obtain the file.

FixLog:

Fix result of Farbar Recovery Scan Tool (x64) Version: 19-09-2017
Ran by Usuario (20-09-2017 11:04:25) Run:1
Running from C:\Users\Usuario\Desktop
Loaded Profiles: Usuario (Available Profiles: Usuario)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
RemoveProxy:
Task: {3B44665B-21DF-498C-8F66-EC8A074DEA6C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-29] (Google Inc.)
Task: {56BEFCED-92C1-4C5A-BF0F-0027B1EE600D} - \AMD Updater -> No File <==== ATTENTION
Task: {5D1EDEAF-895A-4646-B309-DAB4657A85A5} - \AutoPico Daily Restart -> No File <==== ATTENTION
Task: {9537E251-48D7-4E32-855F-4C4151C75F6D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-29] (Google Inc.)
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxlctlfudivq`qsp`28hfm [0]
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`27hfm [0]
GroupPolicyScripts: Restriction <==== ATTENTION
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: netsh int ip reset
CMD: ipconfig /flushDNS
EmptyTemp:
Reboot:

*****************

Processes closed successfully.
Restore point was successfully created.

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-2496004940-1952003200-3465144155-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-2496004940-1952003200-3465144155-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

========= End of RemoveProxy: =========

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3B44665B-21DF-498C-8F66-EC8A074DEA6C} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3B44665B-21DF-498C-8F66-EC8A074DEA6C} => key removed successfully
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{56BEFCED-92C1-4C5A-BF0F-0027B1EE600D} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{56BEFCED-92C1-4C5A-BF0F-0027B1EE600D} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AMD Updater => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5D1EDEAF-895A-4646-B309-DAB4657A85A5} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5D1EDEAF-895A-4646-B309-DAB4657A85A5} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoPico Daily Restart => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9537E251-48D7-4E32-855F-4C4151C75F6D} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9537E251-48D7-4E32-855F-4C4151C75F6D} => key removed successfully
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA => key removed successfully
C:\ProgramData\Reprise => ":wupeogjxlctlfudivq`qsp`28hfm" ADS removed successfully.
C:\ProgramData\Reprise => ":wupeogjxldtlfudivq`qsp`27hfm" ADS removed successfully.
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully

========= "%WINDIR%\SYSTEM32\lodctr.exe" /R =========

Error: Unable to rebuild performance counter setting from system backup store, error code is 2
========= End of CMD: =========

========= "%WINDIR%\SysWOW64\lodctr.exe" /R =========

Info: Successfully rebuilt performance counter setting from system backup store
========= End of CMD: =========

========= netsh int ip reset =========

Resetting Global, OK!
Resetting Interface, OK!
Resetting Unicast Address, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting , failed.
Access is denied.

Resetting , OK!
Restart the computer to complete this action.

========= End of CMD: =========

========= ipconfig /flushDNS =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

=========== EmptyTemp: ==========

BITS transfer queue => 32768 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 121391012 B
Java, Flash, Steam htmlcache => 1135 B
Windows/system/drivers => 7418024 B
Edge => 181553735 B
Chrome => 280363834 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 6656 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 700 B
LocalService => 107494 B
NetworkService => 13663408 B
Usuario => 6091556614 B

RecycleBin => 7105035 B
EmptyTemp: => 6.2 GB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 11:09:58 ====

Thank you Ron 

Fixlog.txt

 

EDIT: As you advice in the other thread, I change MSConfig backup to Normal but I can not use Autoruns for Windows, since it starts but then close after few seconds. Do you recommend another software to stop some services autorun when Windows initiate?

 

Edited September 20, 2017 by Javier3D
Add one question

[AdvancedSetup]

Wow, have never seen AutoRuns crash like that. We'll review your logs and see if something odd still going on.

Let's go ahead and reset your browsers again now that we've removed some other things.

 

Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Firefox
Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• First, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the run dialog box.
  • 
• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks

 

Restart your computer now and make sure there are no longer any redirects or other browser issues. 

 

[Javier3D]

Ok, I did everything and I have being using the web browser for a while without noting anything issue, I haven't install any extension yet, so I will install them to check if maybe one generate the problem (I have used same extensions for years without issues before and I will add the one recommended as Ublock and WOT).

About Autoruns is working fine now but I haven't been able to get MSConfig back to Normal; I change it to 'Normal startup' but after restart is back to 'Selective startup', even after closing and opening right away it does not stay in Normal

Once again thank you for you help

[AdvancedSetup]

Look in your Task Manager since you're on Windows 10. They split out some functions to Task Manager. See if you can fix, reset those from there.

 

 

[Javier3D]

6 minutes ago, AdvancedSetup said:

Look in your Task Manager since you're on Windows 10. They split out some functions to Task Manager. See if you can fix, reset those from there.

 

 

Ok, and what you I do? Enable all the services?

[AdvancedSetup]

No, just verify what you want disabled. But, make sure you know what it is and why you're disabling something. Don't just disable for no reason

 

[Javier3D]

Ok, got it. Thanks