Jump to content

MSN home page and bing search engine added


Recommended Posts

I have an HP 15 laptop running Windows 7.  It has had both Chrome and Internet Explorer.  I recently ran Rogue Killer and found over 25 "pup's" on it, and removed them.  But each time I would restart the computer, I would run Adw Cleaner, and found a new infection titled "pup.optional.legacy  MSN Homepage & Bing Search Engine".  I then removed Chrome, but I still get an infection each time I restart.  I've used Malwarebytes as well as Adw Cleaner.  Help from this forum would be appreciated.  Thanks.

Link to post
Share on other sites

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

This could be a Syncing issue?

Are you Syncing Chrome with other devices?
To remove it you will have to reset the Sync in Chrome.

Read this article and proceed.

Chrome Secure Preferences detection always comes back
https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/

Restart the computer when completed.
<<<>>>

If the problem is again reported by Malwarebytes or AdwCleaner please run this problem.

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.
attachlogs.png

Attach the file.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach.
Click Attach this file.
Click the Add reply button.
===

Please post the logs  for my review.


 

Link to post
Share on other sites

Hi,

If this MSN extension is listed in chrome Extensions delete it.

CHR HKU\S-1-5-21-1535870351-2829381463-2834868870-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx

How is the computer running now?

Link to post
Share on other sites

Where would I find 'chrome extensions' if I have uninstalled Chrome?  The computer is running well.   Let me know what else I should do about this issue.

I do have another question, unrelated to this problem.  This computer has had internet connectivity problems.  (It seems to be connecting ok over the last day or so, since I removed Google Chrome and ran Malwarebytes and AdwCleaner).  Last year, I took apart the computer, to replace the wifi card (I never actually replaced the wifi card).  I had to unplug a couple of harnesses under the keyboard.  Each harness had a black plastic clip that helped it attach to the computer board.  I couldn't get them plugged back in, so  I had someone try to fix it.  He was able to plug in the harness for the keyboard, but he said he lost the black plastic clip for the other harness.  So I have no trackpad capability, and have been using a mouse.  I'd like to use the trackpad again, but I have to get that harness reconnected.  Any suggestions?

Link to post
Share on other sites


Hi,

Where would I find 'chrome extensions' if I have uninstalled Chrome?  The computer is running well.   Let me know what else I should do about this issue.

For get this for now.
If you ever re-install Chrome it may surface again.
Just keep this in mind.

===

The issue with the trackpad is not malware and not my forte.
Bleepingcomputer have a Windows 7 forum where Technichans can give advice.
See what they have to say.
https://www.bleepingcomputer.com/forums/f/167/windows-7/
===

My daughter, the main user of the computer, told me that she saw a Google pop up ad in the lower left corner of the screen earlier today.  I just ran AdwCleaner and Malwarebytes, and nothing came up.

Which browser was she using?

Is that browser Sync with other divices?

Run the Farbar program and post a fresh FRST.TXt log for my review.

Link to post
Share on other sites

Nasdaq,

I'll check out the forum you suggested for my other question.  My daughter was using Internet Explorer, the only browser now on this computer.  I don't know if it is Sync with other devices.  How can I find that out?   Here are the files you requested.  I appreciate your help!

Jeff

FRST.txt

Addition.txt

Link to post
Share on other sites

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Let me know if this issue persists.

p.s.

If the problem persists. 

Remove the Sync if enable on Internet Explorer.
Instructions here.
https://answers.microsoft.com/en-us/mobiledevices/forum/mdlumia-mdtips/how-can-i-sync-internet-explorer-11-favorites/1bf4d16c-e467-4922-ad85-36c7bb44bcf7

fixlist.txt

Link to post
Share on other sites

Here is the attachment you asked for.  When I rebooted the computer as FRST directed me to do, I opened Internet Explorer and got a message like "Your main search provider is corrupted.  Would you like to use Bing as your search provider instead?"  I clicked "no".  Then I went to Manage Add Ons and under Search Providers I found Google listed first, but next to it, it said "Not available".  Under Google was listed Bing, which I had previously deleted.  I deleted it again.  Also, when I go to my gmail account, at the bottom it keeps saying "This page would like to run Google video (something or other)".  I have clicked x to close it every time; this time I clicked "Allow".  Then at the bottom was a statement "This page wants to run Active X Control" or something like that.  I clicked x to close that message.

Jeff

Fixlog.txt

Link to post
Share on other sites

I went to your answers.microsoft.com link but it doesn't appear to apply to Windows 7, because the Windows Key + C doesn't work on my computer, and I couldn't find how to get to "PC settings" on a Windows 7 computer in the brief search I did.

Jeff

Link to post
Share on other sites

Hi,

Your first FRST log shows that the Default Browser was not detected.
Internet Explorer Version 11 (Default browser not detected!)

Follow the intructions on the page to set IE and your default browser.
https://www.gcflearnfree.org/internetexplorer/customizing-internet-explorer/1/

Click the apply button to set it.
===

On the same page you will see how to Open IE in a Home Page.
Copy and paste these links in the box.
https://forums.malwarebytes.com/topic/233259-msn-home-page-and-bing-search-engine-added/
https://mail.google.com/mail/u/0/

Click the apply button to set it.

Close Internet Explorer.

Restart Internet Explorer.

Both pages will be opened.
===

Run the Farbar program, scan and post a fresh FRST.txt log for my review.

Link to post
Share on other sites

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Please let me know what problem persists.

fixlist.txt

Link to post
Share on other sites

Nasdaq,

Here is the attachment you requested.  Just a note:  when the computer rebooted after the fix, all the bars at the bottom for internet strength were there, suggesting good internet connectivity.  However, I was unable to access either Gmail or Malwarebytes.com.  I did what I've done previously in this situation:  I logged off the computer, logged back on, and now I'm able to connect to the net ok.  This problem happens every so often on this computer only.

Jeff

Fixlog.txt

Link to post
Share on other sites

  • Root Admin

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread.

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.