PC Infected - Vacation sites always appearing and malware notification

Hello,

Please assist in helping me remove some spyware or malware off my pc.  When I open Edge sometimes a different search browser will display search results for vacation destinations, and (this is odd) it seems to bring up another top with the same type of search results when I get up from the computer, unless I'm going crazy.    Please help.  I've read on that needs to be posted.  so I will copy and paste results below.  thanks

There is one log I really needed to see Addition.txt but I think for now we can continue.

Use Download Revo Uninstaller Freeware to uninstall (Chromium ) if it is your list of installed programs.

• Please download and install Revo Uninstaller.
• Double-click Revo Uninstaller to run the programme.
• From the list of programmes, locate the following Chromium , or anything similar and carry out the steps below one at a time.
• When prompted if you want to uninstall click Yes.
• Ensure the Moderate option is selected and click Next.
• The programme uninstaller will run. If prompted again click Yes.
• Work your way through the uninstaller, ensuring you read each page thoroughly.
• Note: If you are offered the choice to install additional software, ensure you decline.
• Once the built-in uninstaller is finished click Next.
• Once the programme has searched for leftovers click Next.
• Check items in bold only in the list and click Delete. You may have to expand folders by clicking the "+" mark.
• When prompted click Yes, followed by Next.
• Click Select all, followed by Delete.
• When prompted click Yes, followed by Next.
• Upon completion, click Finish.
• In your next reply, confirm you were successful in uninstalling all programmes listed above.
  
  
• 
  

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe
C:\Program Files\ByteFence\ByteFenceService.exe
C:\Program Files\ByteFence
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_adsafld_18_04_ssge¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FyEyE0DtAtD0ByBtBtA0CtAzzyDyD0DtN0D0Tzu0StBtBtCyDtN1L2XzuyEtFtBtCtFtDtFyByDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StCyE0A0DyCzz0CtCtGtC0B0BtBtGyC0DzyyCtGyDyD0AyCtGtAyC0BtCtByCtDtB0DzyyB0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCyD1Q1OtD1S1OtBtGyBtAyDyDtGyE1OtBzytGzzyEyCzytGyD1OzyzzyDtBtCzztA1PtBtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzztByCtN1Q2Z1B1P1RzutCyDtCyCzzyEyByEtCyB%26cr%3D2059818188%26a%3Dwbf_adsafld_18_04_ssge%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKU\S-1-5-21-93585695-1239137162-3987457199-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_adsafld_18_04_ssge¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FyEyE0DtAtD0ByBtBtA0CtAzzyDyD0DtN0D0Tzu0StBtBtCyDtN1L2XzuyEtFtBtCtFtDtFyByDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StCyE0A0DyCzz0CtCtGtC0B0BtBtGyC0DzyyCtGyDyD0AyCtGtAyC0BtCtByCtDtB0DzyyB0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCyD1Q1OtD1S1OtBtGyBtAyDyDtGyE1OtBzytGzzyEyCzytGyD1OzyzzyDtBtCzztA1PtBtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzztByCtN1Q2Z1B1P1RzutCyDtCyCzzyEyByEtCyB%26cr%3D2059818188%26a%3Dwbf_adsafld_18_04_ssge%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
SearchScopes: HKLM -> DefaultScope {DF4BF3D8-3E9C-44F8-9D4E-2A8539597333} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_adsafld_18_04_ssge¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FyEyE0DtAtD0ByBtBtA0CtAzzyDyD0DtN0D0Tzu0StBtBtCyDtN1L2XzuyEtFtBtCtFtDtFyByDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StCyE0A0DyCzz0CtCtGtC0B0BtBtGyC0DzyyCtGyDyD0AyCtGtAyC0BtCtByCtDtB0DzyyB0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCyD1Q1OtD1S1OtBtGyBtAyDyDtGyE1OtBzytGzzyEyCzytGyD1OzyzzyDtBtCzztA1PtBtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzztByCtN1Q2Z1B1P1RzutCyDtCyCzzyEyByEtCyB%26cr%3D2059818188%26a%3Dwbf_adsafld_18_04_ssge%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM -> {DF4BF3D8-3E9C-44F8-9D4E-2A8539597333} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_adsafld_18_04_ssge¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FyEyE0DtAtD0ByBtBtA0CtAzzyDyD0DtN0D0Tzu0StBtBtCyDtN1L2XzuyEtFtBtCtFtDtFyByDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StCyE0A0DyCzz0CtCtGtC0B0BtBtGyC0DzyyCtGyDyD0AyCtGtAyC0BtCtByCtDtB0DzyyB0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCyD1Q1OtD1S1OtBtGyBtAyDyDtGyE1OtBzytGzzyEyCzytGyD1OzyzzyDtBtCzztA1PtBtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzztByCtN1Q2Z1B1P1RzutCyDtCyCzzyEyByEtCyB%26cr%3D2059818188%26a%3Dwbf_adsafld_18_04_ssge%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {DF4BF3D8-3E9C-44F8-9D4E-2A8539597333} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_adsafld_18_04_ssge¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FyEyE0DtAtD0ByBtBtA0CtAzzyDyD0DtN0D0Tzu0StBtBtCyDtN1L2XzuyEtFtBtCtFtDtFyByDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StCyE0A0DyCzz0CtCtGtC0B0BtBtGyC0DzyyCtGyDyD0AyCtGtAyC0BtCtByCtDtB0DzyyB0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCyD1Q1OtD1S1OtBtGyBtAyDyDtGyE1OtBzytGzzyEyCzytGyD1OzyzzyDtBtCzztA1PtBtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzztByCtN1Q2Z1B1P1RzutCyDtCyCzzyEyByEtCyB%26cr%3D2059818188%26a%3Dwbf_adsafld_18_04_ssge%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM-x32 -> {DF4BF3D8-3E9C-44F8-9D4E-2A8539597333} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_adsafld_18_04_ssge¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FyEyE0DtAtD0ByBtBtA0CtAzzyDyD0DtN0D0Tzu0StBtBtCyDtN1L2XzuyEtFtBtCtFtDtFyByDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StCyE0A0DyCzz0CtCtGtC0B0BtBtGyC0DzyyCtGyDyD0AyCtGtAyC0BtCtByCtDtB0DzyyB0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCyD1Q1OtD1S1OtBtGyBtAyDyDtGyE1OtBzytGzzyEyCzytGyD1OzyzzyDtBtCzztA1PtBtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzztByCtN1Q2Z1B1P1RzutCyDtCyCzzyEyByEtCyB%26cr%3D2059818188%26a%3Dwbf_adsafld_18_04_ssge%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
CHR DefaultSearchURL: Default -> hxxp://securedsearch.xyz/{searchTerms}
CHR DefaultSearchKeyword: Default -> sse
CHR DefaultSuggestURL: Default -> hxxp://securedsearch.xyz/?s={searchTerms}
R2 ByteFenceService; C:\Program Files\ByteFence\ByteFenceService.exe [150936 2018-01-08] (Byte Technologies LLC)
R2 rtop; C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe [297288 2018-04-10] (Byte Technologies LLC.)
C:\WINDOWS\System32\Tasks\ByteFence
2018-05-27 05:54 - 2018-05-27 05:54 - 022575560 _____ (SweetLabs,Inc.) C:\Users\user\AppData\Local\Temp\oct456F.tmp.exe
Emptytemp:
End::

Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download the Malwarebytes Anti-Malware setup file to your Desktop.

OR from this location Here

• Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme.
• Windows Vista, Windows 7 , 8, 8.1 and 10 : Right click and select "Run as Administrator"
• After the installation IS complete let it update if it asks.
• Under SETTINGS…..APPLICATIONS leave everything at default
• Under SETTINGS…..PROTECTION make sure AUTOMATIC QUARANTINE is on.
• Then go to the Dashboard and click on SCAN NOW
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
  Upon completion of the scan (or after the reboot), click the Reports tab.
  Double-click the Scan Log.
  At the bottom click Export and choose Text file.
  
  Save the file to your desktop and include its content in your next reply.
  
  You can access the logs by going in the "Reports" tab, clicking on the latest "Scan" entry (the one with detections), then clicking on the "Export" button in the bottom-left corner and select "Copy to clipboard". After that, all you have to do is paste it here
• Then click on POST
• Exit Malwarebytes

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

[external image: zcMPezJ.png]AdwCleaner - Fix Mode[external image: RQKuhw1.png]

• Download AdwCleaner and move it to your Desktop
• Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Accept the EULA (I accept), then click on Scan
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all active processes
  🖼Click to load external image (V7SD4El.png)
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
• After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply
• ~~~~~~~~~~~~~~~~~~~~~``
  • RogueKiller
  • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
  • Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
  • Wait for the scan to complete
  • On completion, the results will be displayed
  • Check every single entry (threat found), and click on the Remove Selected button
  • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
  • This will open the report in Notepad. Copy/paste its content in your next reply
  created by Aura
  
  Your next reply(ies) should therefore contain:
  • Copy/pasted Fixlog.txt
  • Copy/pasted Malwarebytes
  • Copy/pasted AdwCleaner clean log
  • Copy/pasted RogueKiller clean log

 # ——————————-

here is rogue reportj

 

[external image: G0tu5D9.png]Emsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.

• Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
• Once the extraction is complete, the EEK folder will open. Right-click on [external image: G0tu5D9.png]start emergency kit scanner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
• After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
• Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
• If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
• After the restart, open EEK again (in the C:\EEK folder);
• This time, click on Logs;
• From there, go under the Quarantine Log tab, and click on the Export button;
• Save the log on your desktop, then open it, and copy/paste its content in your next reply;

Post this log then tell me how the computer is now.

I also think it would be a good idea to reset Google Chrome
Instructions on how to backup your Favourites/Bookmarks and other data can be found below.

[external image: U5NwUGc.png]Backup Chrome Bookmarks

Proceed with the reset once done.
[external image: U5NwUGc.png]Chrome: Chrome - Reset browser settings

reset Google Chrome?

How is the computer now?

I did reset chrome, but Edge keeps acting up.  Seems like every time I walk away from the computer, a new tab appears with bing (I think it's bing) search results to all these vacation destinations.  I mean it actually feels like someone is spying on me.

it just happened again.  it's not bing that comes up.  looks like it's an international browser?  I don't know, but the logo looks like a "b" that's why I thought it was bing.  ring a bell?

Follow this link to reset edge https://www.howtogeek.com/237527/how-to-reset-microsoft-edge-in-windows-10/
 
Let's scan again with Malwarebytes Anti-Malware
Open Malwarebytes

• On the Dashboard click on Update Now
• Go to the Setting Tab
• Under Setting go to Detection and Protection
• Under PUP and PUM make sure both are set to show Treat Detections as Malware
• Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
• Then on the Dashboard click on Scan
• Make sure to select THREAT SCAN
• Then click on Scan
• Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards
  
  When the scan is complete Apply Actions to any found entries.
  Wait for the prompt to restart the computer to appear (if applicable), then click on Yes.
  After the restart once you are back at your desktop, open MBAM once more.
  To get the log from Malwarebytes do the following:
  
  Click on the History tab > Application Logs.
  Double click on the scan log which shows the Date and time of the scan just performed.
  Click Export > From export you have three options: > From export you have three options:
  
  Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
  Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
  XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
  
  Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply

I reset Edge, but When I open the Malwarebytes Anti Malware the dashboard was a little different than from your instruction.  and when I clicked on update now it took me to a payment screen.  Maybe I open up the wrong one?  can you provide me the link to it again?  thank you