MSN home page and bing search engine added

[jsac]

I have an HP 15 laptop running Windows 7.  It has had both Chrome and Internet Explorer.  I recently ran Rogue Killer and found over 25 "pup's" on it, and removed them.  But each time I would restart the computer, I would run Adw Cleaner, and found a new infection titled "pup.optional.legacy  MSN Homepage & Bing Search Engine".  I then removed Chrome, but I still get an infection each time I restart.  I've used Malwarebytes as well as Adw Cleaner.  Help from this forum would be appreciated.  Thanks.

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

This could be a Syncing issue?

Are you Syncing Chrome with other devices?
To remove it you will have to reset the Sync in Chrome.

Read this article and proceed.

Chrome Secure Preferences detection always comes back
https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/

Restart the computer when completed.
<<<>>>

If the problem is again reported by Malwarebytes or AdwCleaner please run this problem.

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.

Attach the file.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach.
Click Attach this file.
Click the Add reply button.
===

Please post the logs  for my review.

 

[jsac]

I have uninstalled Chrome from this computer, so the article you mentioned doesn't appear to apply to me.  I did run Malwarebytes (current version) this morning, and found no infection.  What to do next?

[nasdaq]

Hi,

Post the logs I requested in post No. 2.

I will review them and advise.

[jsac]

Hi Nasdaq,

I have attached the logs you requested.

Jeff

FRST.txt

Addition.txt

[nasdaq]

Hi,

If this MSN extension is listed in chrome Extensions delete it.

CHR HKU\S-1-5-21-1535870351-2829381463-2834868870-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx

How is the computer running now?

[jsac]

Where would I find 'chrome extensions' if I have uninstalled Chrome?  The computer is running well.   Let me know what else I should do about this issue.

I do have another question, unrelated to this problem.  This computer has had internet connectivity problems.  (It seems to be connecting ok over the last day or so, since I removed Google Chrome and ran Malwarebytes and AdwCleaner).  Last year, I took apart the computer, to replace the wifi card (I never actually replaced the wifi card).  I had to unplug a couple of harnesses under the keyboard.  Each harness had a black plastic clip that helped it attach to the computer board.  I couldn't get them plugged back in, so  I had someone try to fix it.  He was able to plug in the harness for the keyboard, but he said he lost the black plastic clip for the other harness.  So I have no trackpad capability, and have been using a mouse.  I'd like to use the trackpad again, but I have to get that harness reconnected.  Any suggestions?

[jsac]

My daughter, the main user of the computer, told me that she saw a Google pop up ad in the lower left corner of the screen earlier today.  I just ran AdwCleaner and Malwarebytes, and nothing came up.

[nasdaq]

Hi,

Where would I find 'chrome extensions' if I have uninstalled Chrome?  The computer is running well.   Let me know what else I should do about this issue.

For get this for now.
If you ever re-install Chrome it may surface again.
Just keep this in mind.

===

The issue with the trackpad is not malware and not my forte.
Bleepingcomputer have a Windows 7 forum where Technichans can give advice.
See what they have to say.
https://www.bleepingcomputer.com/forums/f/167/windows-7/
===

My daughter, the main user of the computer, told me that she saw a Google pop up ad in the lower left corner of the screen earlier today.  I just ran AdwCleaner and Malwarebytes, and nothing came up.

Which browser was she using?

Is that browser Sync with other divices?

Run the Farbar program and post a fresh FRST.TXt log for my review.

[jsac]

Nasdaq,

I'll check out the forum you suggested for my other question.  My daughter was using Internet Explorer, the only browser now on this computer.  I don't know if it is Sync with other devices.  How can I find that out?   Here are the files you requested.  I appreciate your help!

Jeff

FRST.txt

Addition.txt

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Let me know if this issue persists.

p.s.

If the problem persists. 

Remove the Sync if enable on Internet Explorer.
Instructions here.
https://answers.microsoft.com/en-us/mobiledevices/forum/mdlumia-mdtips/how-can-i-sync-internet-explorer-11-favorites/1bf4d16c-e467-4922-ad85-36c7bb44bcf7

fixlist.txt

[jsac]

Here is the attachment you asked for.  When I rebooted the computer as FRST directed me to do, I opened Internet Explorer and got a message like "Your main search provider is corrupted.  Would you like to use Bing as your search provider instead?"  I clicked "no".  Then I went to Manage Add Ons and under Search Providers I found Google listed first, but next to it, it said "Not available".  Under Google was listed Bing, which I had previously deleted.  I deleted it again.  Also, when I go to my gmail account, at the bottom it keeps saying "This page would like to run Google video (something or other)".  I have clicked x to close it every time; this time I clicked "Allow".  Then at the bottom was a statement "This page wants to run Active X Control" or something like that.  I clicked x to close that message.

Jeff

Fixlog.txt

[jsac]

I went to your answers.microsoft.com link but it doesn't appear to apply to Windows 7, because the Windows Key + C doesn't work on my computer, and I couldn't find how to get to "PC settings" on a Windows 7 computer in the brief search I did.

Jeff

[nasdaq]

Hi,

Your first FRST log shows that the Default Browser was not detected.
Internet Explorer Version 11 (Default browser not detected!)

Follow the intructions on the page to set IE and your default browser.
https://www.gcflearnfree.org/internetexplorer/customizing-internet-explorer/1/

Click the apply button to set it.
===

On the same page you will see how to Open IE in a Home Page.
Copy and paste these links in the box.
https://forums.malwarebytes.com/topic/233259-msn-home-page-and-bing-search-engine-added/
https://mail.google.com/mail/u/0/

Click the apply button to set it.

Close Internet Explorer.

Restart Internet Explorer.

Both pages will be opened.
===

Run the Farbar program, scan and post a fresh FRST.txt log for my review.

[jsac]

Nasdaq,

I followed your instructions.  Here is the FRST.txt log you asked for.

Jeff

FRST.txt

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Please let me know what problem persists.

fixlist.txt

[jsac]

Nasdaq,

Here is the attachment you requested.  Just a note:  when the computer rebooted after the fix, all the bars at the bottom for internet strength were there, suggesting good internet connectivity.  However, I was unable to access either Gmail or Malwarebytes.com.  I did what I've done previously in this situation:  I logged off the computer, logged back on, and now I'm able to connect to the net ok.  This problem happens every so often on this computer only.

Jeff

Fixlog.txt

[nasdaq]

I will leave this topic open for 6 days.

If the problem returns please give me the details.

[jsac]

Thank you for all of your help.  It's working well now.

Jeff

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread.

Thanks