Yahoo browser redirects [Solved]

Hello ChadA and welcome to Bleeping Computer.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please complete these tasks in the order given in the instructions.

===================================================

Uninstall programmes

Uninstall the following programmes:

Browser Assistant

IEBrowser Assistant
 

To do this:

• right-click the Start button and click Control Panel
• go to Programs and Features - (if your Control Panel is in ‘Category’ view, go to Uninstall a Program)
• locate Browser Assistant, click it to select it, and then click Uninstall.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner by clicking on Scan Now
• when it has finished, leave everything that was found checked, (ticked), then click on Clean and Repair
• if it asks to reboot, allow the reboot
• on reboot, click on View Log File; please attach the content of the log to your next reply.

===================================================

Run Malwarebytes Anti-Malware

Download it from here:

• run the program
• click on the ‘Dashboard’ to make sure everything is up to date, (it is not necessary to upgrade to the premium version of MBAM)
• click on the ‘Scan’ tab, (directly below the Dashboard tab)
• select the Threat Scan option
• slick the Scan Now button
• Threat Scan will begin
• when the scan has completed and if malware was found, click the Quarantine Selected button to allow MBAM to quarantine what was found
• if prompted to restart the computer, close all other programs and click Yes to restart your computer
• once you are back at your desktop, open MBAM once more
• click on the ‘Reports’ tab
• double-click on the most recent Scan Report
• click on Export, then Copy to Clipboard

===================================================

Please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.

Logs to include with next post:

AdwCleaner log
Mbam.txt
New Frst.txt
New Addition.txt

Thanks

Satchfan

Some of the programs have newer versions and the screens/options are different.

AdwCleaner and FRST always update themselves so those links were fine.

Did I send a link to the old, (version 3), of Malwarebytes? Also, which instructions were wrong? As I don't run these myself all the time I'm maybe a bit out of touch.

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
Task: C:\WINDOWS\Tasks\EPSON WF-3620 Series Invitation {406C84BF-E4F0-4835-83EF-9BEEC53EE65B}.job => C:\windows\system32\spool\DRIVERS\x64\3\E_YTSKEE.EXE
Task: C:\WINDOWS\Tasks\EPSON WF-3620 Series Update {406C84BF-E4F0-4835-83EF-9BEEC53EE65B}.job => C:\windows\system32\spool\DRIVERS\x64\3\E_YTSKEE.EXE:/EXE:{406C84BF-E4F0-4835-83EF-9BEEC53EE65B} /F:UpdateWORKGROUP\RE5BBOV0NVGFP$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\WINDOWS\Tasks\HPCeeScheduleForChad.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
2019-05-04 18:55 - 2019-05-04 18:55 - 000024359 _____ () C:\Users\Chad\AppData\Local\recently-used.xbel
S2 HP Comm Recover; "C:\Program Files\HPCommRecovery\HPCommRecovery.exe" [X]
S2 HPJumpStartBridge; "c:\Program Files (x86)\HP\HP JumpStart Bridge\HPJumpStartBridge.exe" [X]
S2 WildTangentHelper; "C:\Program Files (x86)\WildTangent Games\Integration\WildTangentHelperService.exe" [X]
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.35.451 - Google LLC) Hidden
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
FirewallRules: [{3EE1FDF2-12E1-47B6-A319-4940FB0F3F15}] => (Allow) C:\Program Files (x86)\Common Files\Mcafee\MMSSHost\MMSSHost.exe No File
FirewallRules: [{C74A739F-68DA-408D-B3F7-57165959BA47}] => (Allow) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHost.exe No File
C:\Users\Chad\AppData\Roaming\Browser Assistant
CreateRestorePoint:
cmd: sc config WinDefend start= auto
cmd: sc start WinDefend
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

===================================================

Run Farbar Service Scanner

Please download Farbar Service Scanner and run it on the computer with the issue.

Make sure the following options are checked:

System Restore
Security Center/Action Center
Windows Update
Windows Defender

• press Scan.
• it will create a log (FSS.txt) in the same directory the tool is run
• please copy and paste the log to your reply

Logs to include with next post:

Fixlog.txt
FSS.txt

Thanks

Satchfan

Open Malwarebytes Anti-Malware

• open Malwarebytes
• when the programme opens, on the right, disable ‘Malware protection’
• reboot

===================================================

System Restore

• in the search box on the taskbar, type Create a restore point and select it from the list of results
• on the ‘System Protection’ tab in ‘System Properties’, select Create
• type a description for the restore point, and then select Create > OK.

===================================================

Please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.

Logs to include with next post:

New Frst.txt
New Addition.txt

Thanks

Am I running the Fix or a Scan?

A scan but don't run it until you've finished the first two instructions and the system rebooted.

The above instructions said "reboot" after the change to Malwarebytes but please leave rebooting until after you have created a restore point.

That looks fine. Windows Defender is working again and you have a Restore point.

==============================

Please uninstall Google Update Helper.

==============================

Are there any outstanding problems?

I think we're good to go now.  Thanks!

Your computer appears to be clean. Now that it seems to be running well, please follow these steps to tidy up and decrease the likelihood of getting infected again:

Uninstall FRST

• right-click on FRST64.exe and select Rename
• rename the file to Uninstall.exe
• double-click on Uninstall.exe – this will uninstall FRST

===================================================

Uninstall AdwCleaner

• open adwcleaner.exe
• click on Settings
• click on the Application tab and scroll down to the bottom
• click on Remove.

===================================================

Uninstall remaining programmes

To check for any leftover installed tools press the Windows Key + R at the same time, then type appwiz.cpl then Enter.

You can uninstall any programmes we used that still remain:

You can also delete all other logs and programmes we’ve used that are on your desktop. Just click on them and press Delete.

===================================================

Recommended

Update and run Malwarebytes. This really is an excellent program that you should update and run on a regular basis, probably weekly.

===================================================

I also recommend that you read the following:

Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams

Answers to Common Security Questions - Best Practices by quietman7

How Malware Spreads - How Did I Get Infected by quietman7

I will keep this open for 24 hours in case you have any problems, after which I’ll close the topic.

Safe computing

Satchfan

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.