Computer may be infected

Start::
CloseProcesses:
CreateRestorePoint:
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_cekvtqg5_19_01_a¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FzztAtB0EyEtDtB0EzytA0FtBtAtDzztN0D0Tzu0StByDyDyBtN1L2XzuyEtFtAtCtFtDtFzytAtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StB0EyEtB0FzzyDzztGyD0ByD0BtGzztA0EtCtGtA0DtDzytGzy0A0CyEtBtAtByDzyzy0Dzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD1OyD1TtAtByByBtGtAyEtDyDtGyE1QzztCtG1StD1R1RtGtC1R1RyD1T1TyCyDyE1OzzyD2QtN0A0LzuyEtN1B2Z1V1T1S1NzutN1Q2Z1B1P1RzutCyDyEyCtAyEyByCyEyB%26cr%3D993254932%26a%3Dwbf_cekvtqg5_19_01_a%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_cekvtqg5_19_01_a¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FzztAtB0EyEtDtB0EzytA0FtBtAtDzztN0D0Tzu0StByDyDyBtN1L2XzuyEtFtAtCtFtDtFzytAtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StB0EyEtB0FzzyDzztGyD0ByD0BtGzztA0EtCtGtA0DtDzytGzy0A0CyEtBtAtByDzyzy0Dzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD1OyD1TtAtByByBtGtAyEtDyDtGyE1QzztCtG1StD1R1RtGtC1R1RyD1T1TyCyDyE1OzzyD2QtN0A0LzuyEtN1B2Z1V1T1S1NzutN1Q2Z1B1P1RzutCyDyEyCtAyEyByCyEyB%26cr%3D993254932%26a%3Dwbf_cekvtqg5_19_01_a%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_cekvtqg5_19_01_a¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FzztAtB0EyEtDtB0EzytA0FtBtAtDzztN0D0Tzu0StByDyDyBtN1L2XzuyEtFtAtCtFtDtFzytAtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StB0EyEtB0FzzyDzztGyD0ByD0BtGzztA0EtCtGtA0DtDzytGzy0A0CyEtBtAtByDzyzy0Dzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD1OyD1TtAtByByBtGtAyEtDyDtGyE1QzztCtG1StD1R1RtGtC1R1RyD1T1TyCyDyE1OzzyD2QtN0A0LzuyEtN1B2Z1V1T1S1NzutN1Q2Z1B1P1RzutCyDyEyCtAyEyByCyEyB%26cr%3D993254932%26a%3Dwbf_cekvtqg5_19_01_a%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_cekvtqg5_19_01_a¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FzztAtB0EyEtDtB0EzytA0FtBtAtDzztN0D0Tzu0StByDyDyBtN1L2XzuyEtFtAtCtFtDtFzytAtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StB0EyEtB0FzzyDzztGyD0ByD0BtGzztA0EtCtGtA0DtDzytGzy0A0CyEtBtAtByDzyzy0Dzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD1OyD1TtAtByByBtGtAyEtDyDtGyE1QzztCtG1StD1R1RtGtC1R1RyD1T1TyCyDyE1OzzyD2QtN0A0LzuyEtN1B2Z1V1T1S1NzutN1Q2Z1B1P1RzutCyDyEyCtAyEyByCyEyB%26cr%3D993254932%26a%3Dwbf_cekvtqg5_19_01_a%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_cekvtqg5_19_01_a¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FzztAtB0EyEtDtB0EzytA0FtBtAtDzztN0D0Tzu0StByDyDyBtN1L2XzuyEtFtAtCtFtDtFzytAtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StB0EyEtB0FzzyDzztGyD0ByD0BtGzztA0EtCtGtA0DtDzytGzy0A0CyEtBtAtByDzyzy0Dzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD1OyD1TtAtByByBtGtAyEtDyDtGyE1QzztCtG1StD1R1RtGtC1R1RyD1T1TyCyDyE1OzzyD2QtN0A0LzuyEtN1B2Z1V1T1S1NzutN1Q2Z1B1P1RzutCyDyEyCtAyEyByCyEyB%26cr%3D993254932%26a%3Dwbf_cekvtqg5_19_01_a%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_cekvtqg5_19_01_a¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FzztAtB0EyEtDtB0EzytA0FtBtAtDzztN0D0Tzu0StByDyDyBtN1L2XzuyEtFtAtCtFtDtFzytAtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StB0EyEtB0FzzyDzztGyD0ByD0BtGzztA0EtCtGtA0DtDzytGzy0A0CyEtBtAtByDzyzy0Dzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD1OyD1TtAtByByBtGtAyEtDyDtGyE1QzztCtG1StD1R1RtGtC1R1RyD1T1TyCyDyE1OzzyD2QtN0A0LzuyEtN1B2Z1V1T1S1NzutN1Q2Z1B1P1RzutCyDyEyCtAyEyByCyEyB%26cr%3D993254932%26a%3Dwbf_cekvtqg5_19_01_a%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1870932749-3697413752-2901118604-1001 -> DefaultScope {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE15
SearchScopes: HKU\S-1-5-21-1870932749-3697413752-2901118604-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE15
FF SearchPlugin: C:\Users\JEFF\AppData\Roaming\Mozilla\Firefox\Profiles\ciaca2ky.default-1545729229448\searchplugins\search powered by yahoo!.xml [2019-01-01]
CHR DefaultSearchURL: Default -> hxxp://srchbar.com/?q={searchTerms}
CHR DefaultSearchKeyword: Default -> sse
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
Task: {04C3399E-7999-487F-86E9-2A1714E76F1E} - System32\Tasks\ByteFence => C:\Program Files\ByteFence\ByteFence.exe [2018-12-18] (Byte Technologies LLC) <==== ATTENTION
C:\Windows\Temp\*.*
Emptytemp:
End::

• Download AdwCleaner and move it to your Desktop
• Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Accept the EULA (I accept), then click on Scan
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
• After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

• Download the right version of RogueKiller for your Windows version (32 or 64-bit)
• Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
• Wait for the scan to complete
• On completion, the results will be displayed
• Check every single entry (threat found), and click on the Remove Selected button
• On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
• This will open the report in Notepad. Copy/paste its content in your next reply

I really wish i knew how to use the farbar tool my self because it seems like the most appropriate software that targets the infections at its source.

• Please download and install Revo Uninstaller.
• Double-click Revo Uninstaller to run the programme.
• From the list of programmes, locate the following Chromium, or anything similar and carry out the steps below one at a time.
• ?Double-click the programme.
• When prompted if you want to uninstall click Yes.
• Ensure the Moderate option is selected and click Next.
• The programme uninstaller will run. If prompted again click Yes.
• Work your way through the uninstaller, ensuring you read each page thoroughly.
• Note: If you are offered the choice to install additional software, ensure you decline.
• Once the built-in uninstaller is finished click Next.
• Once the programme has searched for leftovers click Next.
• Check items in bold only in the list and click Delete. You may have to expand folders by clicking the "+" mark.
• When prompted click Yes, followed by Next.
• Click Select all, followed by Delete.
• When prompted click Yes, followed by Next.
• Upon completion, click Finish.
• In your next reply, confirm you were successful in uninstalling all programmes listed above.
  
  

• Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
• Once the extraction is complete, the EEK folder will open. Right-click on [external image: G0tu5D9.png]start emergency kit scanner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
• After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
• Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
• If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
• After the restart, open EEK again (in the C:\EEK folder);
• This time, click on Logs;
• From there, go under the Quarantine Log tab, and click on the Export button;
• Save the log on your desktop, then open it, and copy/paste its content in your next reply;

Emergency Soft didn't find anything. Chromium is still installed and i wasn't able to remove it with revo installer. Also pop-up's still remain. 

Start::
CloseProcesses:
CreateRestorePoint:
(The Chromium Authors) C:\Users\JEFF\AppData\Local\chromium\Application\chrome.exe
(The Chromium Authors) C:\Users\JEFF\AppData\Local\chromium\Application\chrome.exe
(The Chromium Authors) C:\Users\JEFF\AppData\Local\chromium\Application\chrome.exe
(The Chromium Authors) C:\Users\JEFF\AppData\Local\chromium\Application\chrome.exe
(The Chromium Authors) C:\Users\JEFF\AppData\Local\chromium\Application\chrome.exe
HKU\S-1-5-21-1870932749-3697413752-2901118604-1001\…\Run: [Chromium] => c:\users\jeff\appdata\local\chromium\application\chrome.exe [828416 2017-01-20] (The Chromium Authors)
HKU\S-1-5-21-1870932749-3697413752-2901118604-1001\…\Run: [GoogleChromeAutoLaunch_EC758384A1439516B0EF4BD86065B073] => C:\Users\JEFF\AppData\Local\chromium\Application\chrome.exe [828416 2017-01-20] (The Chromium Authors)
2019-01-01 05:02 - 2019-01-01 05:02 - 000002335 _____ C:\Users\JEFF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium.lnk
2019-01-01 05:02 - 2019-01-01 05:02 - 000002327 _____ C:\Users\JEFF\Desktop\Chromium.lnk
2019-01-01 05:02 - 2019-01-01 05:02 - 000000000 ____D C:\Users\JEFF\AppData\Local\chromium
C:\Users\JEFF\AppData\Local\chromium\Application\58.0.2988.0\libegl.dll
C:\Users\JEFF\AppData\Local\chromium\Application\58.0.2988.0\libglesv2.dll
C:\Users\JEFF\AppData\Local\chromium
FirewallRules: [{63B802DB-3EB6-486C-8BB9-299D3D607F5E}] => (Allow) C:\Users\JEFF\AppData\Local\Chromium\Application\chrome.exe (The Chromium Authors)
Emptytemp:
End::

Chromium

Ok i removed google chrome and reinstalled it. I think this removed chromium as well as it stated that "Chromium is no longer able to auto load" 

Looks like. Also i am starting see some major improvements. The internet is now connecting upon each reboot as it should. I also don't see any more adware Pop-up's but ill let you know if i do. In any case, it looks pretty good so far. So in terms of infection, my computer did have a few malewares or spyware? I use Avast security, but honestly i don't trust firewalls anymore. They really don't help prevent infection and i know from experiences. I have even used a very tight security measure where i had script blocking, port blocking and a avast security to prevent intrusions of malicious files and urls but some how the machine still gets infected. There is always something that gets through, no matter what kind of security measures i take. 

Speed test is also running at approx 69.0 Mbps

Very nice, this is what the speed should be. Before it was running at around 8.0 Mbps

Do you think its possible that certain extensions that are added to google chrome are causing the browser to slow down to a crawl. I just thought of that and avast usually comes bundled with so many different add-ons and extensions that it wants me to install. Right now google chrome is lightening fast and allocates memory accurately. How ever when google chrome tends to get bogged down with unnecessary stuff, i notice the memory allocated to the browser some times taxes out the RAM in the system which also causes alot of system instability and slow downs. 

I could have no more then 13 links open in my browser, how ever the system resources read it as like three times that amount. I have had instances where the task manager read at one time 75 links open when i only had around 14 or so. So evidently alot of things continue to run in memory in the background and its hard to mitigate with out having to perform a full clean of the browser like we just did. Of course maleware could be associated with this abnormality. 

 

There is always something that gets through, no matter what kind of security measures i take.

You hit the nail on the head and your not alone.

Malware writers create new entries daily….so it's near impossible for an antivirus to catch all of it thats why we tell people layered security at the moment is your nest security.

 

Do you think its possible that certain extensions that are added to google chrome are causing the browser to slow down to a crawl. I just thought of that and avast usually comes bundled with so many different add-ons and extensions that it wants me to install. Right now google chrome is lightening fast and allocates memory accurately. How ever when google chrome tends to get bogged down with unnecessary stuff, i notice the memory allocated to the browser some times taxes out the RAM in the system which also causes alot of system instability and slow downs.

I think, different browsers are in a sort of competition.  They want to offer the most, the best extensions, best surfing options,,,They tend to say "I am your best choice"

Really?

What I located coming out of google chrome

ByteFence
WinYahoo SEARCHSCOPES
SearchManager ==>  CHROME\EXTENSIONS
SecuredSearch ==>  CHROME\EXTENSIONS
invalidprefs.js <= bad java script file when you visited a site.

Malware does a good job of hiding.  Not only that it does a good job of downloading things behind the scenes you will not see till you run your computer through the wringer like we did here.

I don't use Google Chrome,  just never downloaded it and have seen where it asks people to sync devices which sounds like a good idea but many times has backfired.

For extra protection,  myself I use NoScript

https://addons.mozilla.org/en-US/firefox/addon/noscript/

it can be a pain till you learn how to use it but it is a good layer of protection.

I think we're ready to remove tools now.

• Please download DelFix or from Here and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
• Activate UAC
• Remove disinfection tools
• Click the Run button.
• – This will remove the specialized tools we used to disinfect your system.
  Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

**************

Alright all done.

Well usually what i do in terms layered security is i use ublock origin. I think ublock origin for the most part helps protect from many add-ware and pop-ups on websites. I also use web of trust for safe browsing, along with maleware bytes premium as an anti-virus/shield and avast internet security for my fire wall. Additionally, i also upload a back-up of my registry so i can reload it if my registry gets corrupted. Thats usually the only measures i take. Anything more i think would bog down the system with more resources which would be counterproductive in terms of trying to improve over all performance and speed of the system. 

Sounds good.

Safe surfing.