PC Infected - Vacation sites always appearing and malware notification

Just back out of the payment screen.

Everything should be setup to use as we did last time.

on the Dashboard click on Scan
Make sure to select THREAT SCAN
Then click on Scan
Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards

When the scan is complete Apply Actions to any found entries.
Wait for the prompt to restart the computer to appear (if applicable), then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.
To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options: > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply

Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply

~~

Let me know how it is at the moment.

I ran the scan and rebooted and as soon as I open the browswer I get that strange international search browser displaying swedish vacation destinations.  

also do you recommend a good anti virus or malware blocker?  

[external image: RQKuhw1.png]Zemana AntiMalware - Fix

• Download and install Zemana AntiMalware
• Open Zemana AntiMalware, and click on the Scan button
  🖼Click to load external image (9bxAQfh.png)
• Wait for the scan to complete
  🖼Click to load external image (19whQAs.png)
• Once done, click on any threats it detected, then select Apply to all and Quarantine to quarantine all threats, and click on the Next button
  🖼Click to load external image (U4b97Kj.png)
  🖼Click to load external image (yiHmd7o.png)
• If it asks you to reboot your computer to finish the clean-up, do so
  🖼Click to load external image (fO7GVK0.png)
• After that, click on the most upper right button to go to the Reports tab, select the latest System Scan entry and click on the Open Report button
  🖼Click to load external image (2AHrjhI.png)
• A log will open in Notepad
• Copy/paste the content of that log in your next reply

~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Note: The programs listed below are all free to use or they have some sort of trial. Some of them have a paid version that provides more features, while a lot of other good programs only have a paid version but aren't listed there (such as Kaspersky and ESET Antivirus products).

Anti-Virus

• 🖼Click to load external image (sZQBUGE.png)Sophos Home
• 🖼Click to load external image (GCZb0TR.png)Bitdefender Free Antivirus
• 🖼Click to load external image (1lXc99W.png)Emsisoft Anti-Malware - Free 30 day trial. Once it expires, EAM enters into a freeware mode where it is still considered an Antivirus program, but without real-time protection
• 🖼Click to load external image (szLrBjg.png)Avira Free Antivirus
• 🖼Click to load external image (90ChiEw.png)avast! Free Antivirus

Anti-Malware

• 🖼Click to load external image (j1Bynr2.png)Malwarebytes - Has both a free and paid version. The Premium version of Malwarebytes also offers Exploit and Ransomware protection, for a complete package of: Malware, Web, Exploit and Ransomware protection
• 🖼Click to load external image (S2NFpNw.png)HitmanPro 3 - Free 30 day trial
• 🖼Click to load external image (ncqvIpu.png)Zemana AntiMalware - Free 30 day trial

created by Aura

I kinda doubt that tool took out the problem.

Are you thinking of switching to a different antivirus?

If you would I'd like to see a new Farbar Recovery Scan log

• Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg]Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.
  
  

bump

as I open the browswer I get that strange international search browser

Which browser are you using when this opens?

~~~~

ATTENTION: System Restore is disabled
Enabling System Restore in Windows 10 and Creating System Restore Point

——————–
Press the Windows Key + R at the same time
Type sysdm.cpl and hit Enter
Click System Protection
Under Protection Settings left click on Local Disk C: (System) to highlight the entry
Click Configure
Select Turn on system protection
Click Apply, then OK
On the System Properties window Click Create…
Type WTT Restore Point then click Create.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKU\S-1-5-21-93585695-1239137162-3987457199-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE15
SearchScopes: HKU\S-1-5-21-93585695-1239137162-3987457199-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE15
2018-05-27 20:50 - 2018-04-11 19:34 - 001946304 _____ (Microsoft Corporation) C:\Users\user\AppData\Local\Temp\dllnt_dump.dll
CustomCLSID: HKU\S-1-5-21-93585695-1239137162-3987457199-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-A53DA100DCA5}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
CMD: netsh advfirewall reset
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
Hosts:
Emptytemp:
End::

Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Follow the instructions in the thread below to run a scan with MBAR. Don't forget to update the database before launching the scan, and once launched, leave MBAR running and do not touch your computer until it is done scanning.

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes/

Once MBAR is done scanning, removing threats and rebooting your computer, go in its MBAR folder, and copy/paste the content of the mbar-log-TODAYS-DATE.txt log in your next reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~``

Security Analysis by Rocket Grannie

——————–

• Please download Security Analysis by Rocket Grannie and save it to your Desktop
• Right click on the icon and select Run as admnistrator
• Click OK on the disclaimer and ignore any security warnings that may appear
• In your reply, please copy and paste the contents of the Notepad document that will appear on your desktop

===============


Please post these logs when finished

bump

Glad we could help. [external image: SakDYGv.gif]
Since this issue appears resolved … this Topic is closed.