Let's see if we can find whats going on.
See if you can check Firefox plugins for anything related to Yahoo plugins, remove/delete any you find.
~~
Start Farbar Recovery Scan Tool (Please double-click on FRST/FRST64) with Administrator privileges
or Right click on the FRST icon and select Run as administrator
Highlight the below information then hit the Ctrl + C keys at the same time
or
Right click/highlight on the text below and select Copy.
[beginning with
Start:: and finishing with
End::]
Start::
CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
Startup: C:\Users\Vista\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerPro.lnk [2015-02-23]
ShortcutTarget: OptimizerPro.lnk -> C:\ProgramData\{6cafd4a6-177e-8aa3-6caf-fd4a61775298}\OptimizerPro.exe (No File)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKU\S-1-5-21-1851952462-3852614447-996345049-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://mysearch.avg.com/?cid={2713AC1C-C750-47B4-A738-177FD98B252A}&mid=cf6dc0d9b8cc47db94a3d1532d814487-db389145738390defd1d5744d592dae72710d0f0&lang=en&ds=AVG&coid=avgtbavg&cmpid=1116tb&pr=sa&d=2016-08-06 15:57:06&v=4.3.6.255&pid=wtu&sg=&sap=hp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://taplika.com/results.php?f=4&q={searchTerms}&a=tlk_ggbg_15_09_ie&cd=2XzuyEtN2Y1L1QzutDtDtC0AyC0ByCyD0A0DyByEyD0F0EtBtN0D0Tzu0StCtCyEzytN1L2XzutAtFyBtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyCzz0C0FyDtBtD0BtG0CyDyByEtG0EyB0AtCtGyByByBtAtGtCzz0C0BtA0Bzyzy0EyBtDyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0BtC0BtCyC0EzztGyBtDtDyCtGyEzztByCtG0BtA0C0FtGzy0CyC0C0F0AtC0EyEtAtCyD2Q&cr=109379966&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://taplika.com/results.php?f=4&q={searchTerms}&a=tlk_ggbg_15_09_ie&cd=2XzuyEtN2Y1L1QzutDtDtC0AyC0ByCyD0A0DyByEyD0F0EtBtN0D0Tzu0StCtCyEzytN1L2XzutAtFyBtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyCzz0C0FyDtBtD0BtG0CyDyByEtG0EyB0AtCtGyByByBtAtGtCzz0C0BtA0Bzyzy0EyBtDyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0BtC0BtCyC0EzztGyBtDtDyCtGyEzztByCtG0BtA0C0FtGzy0CyC0C0F0AtC0EyEtAtCyD2Q&cr=109379966&ir=
SearchScopes: HKU\S-1-5-21-1851952462-3852614447-996345049-1000 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={2713AC1C-C750-47B4-A738-177FD98B252A}&mid=cf6dc0d9b8cc47db94a3d1532d814487-db389145738390defd1d5744d592dae72710d0f0&lang=en&ds=AVG&coid=avgtbavg&cmpid=1116tb&pr=sa&d=2016-08-06 15:57:06&v=4.3.6.255&pid=wtu&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1851952462-3852614447-996345049-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={2713AC1C-C750-47B4-A738-177FD98B252A}&mid=cf6dc0d9b8cc47db94a3d1532d814487-db389145738390defd1d5744d592dae72710d0f0&lang=en&ds=AVG&coid=avgtbavg&cmpid=1116tb&pr=sa&d=2016-08-06 15:57:06&v=4.3.6.255&pid=wtu&sg=&sap=dsp&q={searchTerms}
Toolbar: HKU\S-1-5-21-1851952462-3852614447-996345049-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-1851952462-3852614447-996345049-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKU\S-1-5-21-1851952462-3852614447-996345049-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
FF DefaultSearchEngine.US: Mozilla\Firefox\Profiles\ndvtp8ca.default -> Taplika
FF Homepage: Mozilla\Firefox\Profiles\ndvtp8ca.default -> hxxps://mysearch.avg.com?cid={9E33962A-6E1E-43D9-A657-B66FDDE8D8F8}&mid=cf6dc0d9b8cc47db94a3d1532d814487-db389145738390defd1d5744d592dae72710d0f0&lang=en&ds=AVG&coid=avgtbavg&cmpid=0615tb&pr=sa&d=2014-01-18 22:04:40&v=18.6.0.922&pid=safeguard&sg=0&sap=hp
FF Extension: (Yahoo! Toolbar) - C:\Users\Vista\AppData\Roaming\Mozilla\Firefox\Profiles\ndvtp8ca.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2015-03-15] [not signed]
FF SearchPlugin: C:\Users\Vista\AppData\Roaming\Mozilla\Firefox\Profiles\ndvtp8ca.default\searchplugins\avg-secure-search.xml [2016-04-17]
FF SearchPlugin: C:\Users\Vista\AppData\Roaming\Mozilla\Firefox\Profiles\ndvtp8ca.default\searchplugins\taplika.xml [2015-02-26]
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml [2016-04-17]
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\wtu-secure-search.xml [2016-11-17]
2016-06-23 19:28 - 2016-06-23 19:28 - 004741624 _____ (Google) C:\Users\Vista\AppData\Local\Temp\2833.exe
2012-03-21 10:22 - 2012-03-21 10:22 - 000357032 _____ (Ask.com) C:\Users\Vista\AppData\Local\Temp\ApnStub.exe
2012-03-21 14:56 - 2012-03-21 14:56 - 000908576 _____ (Sun Microsystems, Inc.) C:\Users\Vista\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv_90ce6a4b.exe
2006-01-16 12:39 - 2006-01-16 12:39 - 004540440 _____ (AVG Secure Search) C:\Users\Vista\AppData\Local\Temp\oi_{36A7DF4B-F675-4FCC-8080-BFD57CA4DEEE}.exe
2013-09-20 17:58 - 2013-09-20 17:58 - 004540440 _____ (AVG Secure Search) C:\Users\Vista\AppData\Local\Temp\oi_{BB865FCF-707A-4400-8617-7B8541821B95}.exe
2006-10-30 19:10 - 2006-10-30 19:10 - 000455600 ____R (Macrovision Corporation) C:\Users\Vista\AppData\Local\Temp\_isE723.exe
2007-08-31 06:12 - 2007-08-31 06:12 - 000460248 ____R (Macrovision Corporation) C:\Users\Vista\AppData\Local\Temp\_isFE5B.exe
Emptytemp:
End::
Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~`
Not sure if you already have Malwarebytes Anti-Malware on here or not so I'll post whats needed to install and run the tool.
Please download the
Malwarebytes Anti-Malware setup file to your Desktop.
OR from this location
Here- Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme.
- Windows Vista, Windows 7 , 8, 8.1 and 10 : Right click and select "Run as Administrator"
[external image: MBAM3_zpsw0f8rn9n.jpg] - After the installation IS complete let it update if it asks.
- Under SETTINGS…..APPLICATIONS leave everything at default
- Under SETTINGS…..PROTECTION make sure AUTOMATIC QUARANTINE is on.
Then go to the Dashboard and click on SCAN NOW
Make sure to select THREAT SCAN - Then click on Scan
If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
Upon completion of the scan (or after the reboot), click the Reports tab.
Double-click the Scan Log.
At the bottom click Export and choose Text file.
Save the file to your desktop and include its content in your next reply.
You can access the logs by going in the "Reports" tab, clicking on the latest "Scan" entry (the one with detections), then clicking on the "Export" button in the bottom-left corner and select "Copy to clipboard". After that, all you have to do is paste it here
~~
Download AdwCleaner from this page:
https://www.bleepingcomputer.com/download/adwcleaner/Execute it, then read the EULA and click on "I agree" if you agree it.
Click on
Scan and wait until it ends.
NEXT**
Click on
Clean, read the informative message. If you have any questions about it, please ask.
All unrequired programs will be closed during the cleaning process, so be sure to save your work before.
When the clean is over, the computer may reboot and shows the logfile
Copy/Paste it in your answer.
please post
Fixlog.txt
malwarebytes log
AdwCleaner.txt
