Pop-up iyfsearch

[VEGETABLEexe]

Hello, my grandparents brought me their computer to fix it.

When I start ir, the internet Explorer instantly shuts me up this page named iyfsearch, I've looked into extensions, program data, tried blocking the page from the browser but keeps poping up, wondered if someone had this issue too or any idea, I'm full opened to suggestions, quite hasted, I would appreciate your help, so, that's it and thanks for reading me.

[Maurice Naggar]

Hi @VEGETABLEexe         

My name is Maurice. I will be helping and guiding you, going forward on this case.
Let me know what first name you prefer to go by.

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me. 
If you will be away for more than 3 consecutive days,  do try to let me know ahead of time, as much as possible. 
  
Please only just attach   all report files, etc  that I ask for as we go along.

 

If your O.S.  is Windows 10,  for the duration of this case, please only just use the EDGE browser.

 

I would like to have you run a report tool known as FRST. This has no personal information. It is a well-known & widely used &safe.
FRST will help provide me with a list of installed programs and other information about your computer that will help me see if there are any other problems that are not being detected. Please follow the steps below to run FRST.

1: Please download FRST from the link below and save it to your desktop:

"Download link for 32-Bit version Windows"

"Download link for 64-Bit Version Windows"

Please wait and look toward the top or bottom of your browser for the option to Run or Save.
Click Save to save the file version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Run report with FRST

Right-click on FRST icon and select Run as Administrator to start the tool , and reply YES to allow it to proceed and run.

_Windows 8 or 10 users will be prompted about Windows *SmartScreen protection* - click line More info information on that screen and click button Run anyway on next screen._
Click YES when prompted by Windows U A C prompt to allow it to run.
Note: If you are prompted by Windows SmartScreen, click More info & followup & choose Run anyway.

Approve the Windows UAC prompt on Windows Vista and newer operating systems by clicking on Continue or Yes. 

Click Yes when the* disclaimer* appears in FRST.
The tool may want to update itself - in that case you'll be prompted when the update is completed and ready to use.

Make sure that Addition options is *checked* - the configuration should look exactly like on the screen below (do not mark additional things unless asked).
Press Scan button and wait.

 

The tool will produce 2  logfiles on your desktop: FRST.txt , Addition.txt 
Click OK button when it shows up. Close the Notepad windows when they show on screen. The tool saves the files.

Please attach these 2 files to your next reply.
Thank you.
 

[VEGETABLEexe]

My grandparents CPU's OS is actually w7

[Maurice Naggar]

OK.   Just please do get & run the F R S T  reports so that we can get started.   I need to review those reports.

[VEGETABLEexe]

Here they are, but does it matter these are on spanish?

Addition.txt FRST.txt

[VEGETABLEexe]

A friend already helped me, Ty.

[Maurice Naggar]

Thank you for the FRST reports.   I can make do on Spanish elements in the report.

I see where the Internet Explorer's   setting for search option is hijacked by malvertising links.   This is fixable.

 

Please Close and Save any open work you may have open.
Please close as many un-needed app-windows that you yourself may have open at this point.   So you can have a clear field of view.

This custom script is for  Vegetableexe    only / for this machine only.
Close and save any open work files before starting this procedure. 

Please Close and save any open work files before you start this next step.  It will involve a Windows Restart at the end of it.
I am sending a   custom Fix script which is going to be used by the FRST tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE  link AS and save it directly ( as is) to the  Desktop  folder

The tool named FRST.exe   tool    is already on the Desktop folder
Start the Windows Explorer and then, to the Desktop

RIGHT click on  FRST    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

IF you get a block message from Windows about this tool......
click line More info information on that screen
and click button Run anyway on next screen.

on the FRST window:
Click the Fix button just once, and wait.

 
PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. This run here should be fairly quick.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.
Please attach the FIXLOG.txt with your next reply later, at your next opportunity   
 

Fixlist.txt

[Maurice Naggar]

Hello.  How is it going ?

[Maurice Naggar]

It seems that your post of last Thursday was your advising that you did get help on your own.

I do wish you all the best.

To remove the FRST tool & its work files, do this.  Go to your DESKTOP.  Do a RIGHT-click on FRST.exe & select RENAME & then change it to UNINSTALL.exe 

Then run that ( double click on it)  to begin the cleanup process.

.

Backup is your best friend.  Keep backups of your system on a regular basis to offline storage & keep those safe. https://forums.malwarebytes.com/topic/136226-backup-software/

It is not enough to just have a security program installed. Each pc user needs to practice daily safe computer and internet use.

Best  practices & malware prevention:
Follow best practices when browsing the Internet, especially on opening links coming from untrusted sources.
First rule of internet safety: slow down & think before you "click".
Never click links without first hovering your mouse over the link and seeing if it is going to an odd address ( one that does not fit or is odd looking or has typos).

Free games & free programs are like "candy". We do not accept them from "strangers".

Never open attachments that come with unexpected ( out of the blue ) email no matter how enticing.
Never open attachments from the email itself. Do not double click in the email. Always Save first and then scan with antivirus program.

Pay close attention when installing 3rd-party programs. It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed.
Take great care in every stage of the process and every offer screen, and make sure you know what it is you're agreeing to before you click "Next".

Use a Standard user account rather than an administrator-rights account when "surfing" the web.
See more info on Corrine's SecurityGarden Blog http://securitygarden.blogspot.com/p/blog-page_7.html

Dont remove your current login. Just use the new Standard-user-level one for everyday use while on the internet.

 
Do a Windows Update.

Make certain that Automatic Updates is enabled.
https://support.microsoft.com/en-us/help/12373/windows-update-faq

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

For other added tips, read "10 easy ways to prevent malware infection"

.
All the best to you.   Stay safe.

If your grandparents system does not have Malwarebytes for Windows Premium, then I'd encourage you to consider getting a Premium license.

Malwarebytes for Windows has multiple protections.  Plus you can get a multiple seat license to cover all your machines & your grandparents.

There is currently a special sale at Malwarebytes thru April 30

https://www.bleepingcomputer.com/offer/deals/get-25-percent-off-malwarebytes-premium-and-malwarebytes-for-teams-until-april-30th/

The Premium license can be purchased for as many seats ( devices) that you and your folks have that are Windows, Android, Chromebook, Mac OS X