have I picked up a virus?

clearingout

OK...followed instructions and uninstalled. Adverts still there - still getting a page popping up when I click as well...not everytime...still got green. underlined writing... thanks again

clearingout

just re-started computer to see if that made a difference - it didn't.

waddler_8

There'll be a corresponding extension to delete in Google Chrome if the uninstall hasn't removed it.

Do this and then email me the logs it creates - they'll be a lot bigger than DDS. I'll PM you my email address.

Download OTL by Old Timer from the link below and save it to your Desktop.

LINK

• Double click on OTL.exe to run it.
• Click the Quick Scan button.
• When it's finished , two Notepad files will open.
  
  
  • OTL.txt <-- Will be opened
  • Extras.txt <-- Will be minimized
  
  email me those logs

waddler_8

Read this carefully then run the OTL script.

The script below will stop explorer & your desktop will temporarily disappear (it will return on reboot), & your recycle bin will be emptied. Save all work and close any open windows.

• Double-click OTL.exe to start the program.
• Copy and Paste all the following code into the textbox. Do not include the word Code:

  :commands
  [CREATERESTOREPOINT]
  
  
  :files
  C:\Users\Liz\AppData\Local\Google\Chrome\User Data\Default\Extensions\apooibooegmgfhjhppcbjeponliknpha
  C:\Users\Liz\AppData\Local\Google\Chrome\User Data\Default\Extensions\bakijjialdiiboeaknfpmflphhmljfkd
  C:\Users\Liz\AppData\Local\Google\Chrome\User Data\Default\Extensions\ealhkkkhcnlkldnhnoleaeloncaemmbb
  C:\Users\Liz\AppData\Local\Google\Chrome\User Data\Default\Extensions\efbkdhmfnmnmfimllbjamfodcoanhmdd
  C:\Users\Liz\AppData\Local\Google\Chrome\User Data\Default\Extensions\gebcpofjimbbchggpnfcaiieolloeodp
  C:\Users\Liz\AppData\Local\Google\Chrome\User Data\Default\Extensions\oboaehhgobepkelonokncajjlhijebgg
  C:\Users\Liz\AppData\Local\WebToSave.crx
  C:\Users\Liz\AppData\Local\BargainWorkbench.crx
  C:\Users\Liz\AppData\Local\newhb2.crx
  C:\ProgramData\WinterSoft
  C:\Users\Liz\AppData\Roaming\SkypEmoticons
  C:\Program Files (x86)\Sk_Enhancer
  C:\ProgramData\YoutubeAdblocker
  C:\Program Files (x86)\YoutubeAdblocker
  C:\ProgramData\suRf uaNd keep
  C:\Program Files (x86)\suRf uaNd keep
  C:\ProgramData\ca052060fd38ecc2
  C:\ProgramData\InstallMate
  C:\Program Files (x86)\SearchNewTab
  dir C:\Users\Liz\AppData\Local\Packages /s /c
  dir C:\Users\Liz\AppData\Local\Programs /s /c
  
  
  :otl
  IE - HKCU\..\SearchScopes\{15A1C8E9-CA00-4BF8-BB8F-9F240BF470E0}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3282134&CUI=UN42824956262718132
  IE - HKCU\..\SearchScopes\{2F5A87F8-4289-44E0-8766-326C928613D5}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYGB&apn_uid=BA427AFB-E49B-4E7F-9A8B-6DECE7B0DD24&apn_sauid=1A3C8809-6FFB-44E2-BBEC-55D80C111120
  
  O2 - BHO: (SearchNewTab) - {83BD120D-84D0-99B4-C293-0193170939DA} - C:\Program Files (x86)\SearchNewTab\kuYNNwB.dll File not found
  O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
  
  
  :commands
  [CREATERESTOREPOINT]
  [EMPTYTEMP]
  

• Then click the Run Fix button at the top.
• Click .
• OTL may ask to reboot the machine. Click OK & allow it to do so if asked.
• The report should appear in Notepad after the reboot.
• Copy and Paste that report in your next reply.

clearingout

gosh, so sorry, lost the will a bit with the computer - it's so slow now! am running fix now - will post when done. thanks again.

clearingout

changed...changed...changed

waddler_8

clearingout wrote: »

no computer not used at work in the last 10 months - but was formerly used at work. Report is as follows: problem now seems to be resolved. Thanks!

Looks (and sounds) good. Set your default search engine in chrome to something other than ask - unless you would like to keep it.

https://support.google.com/chrome/answer/95426?hl=en

If you want to reset the proxy, run this: http://go.microsoft.com/?linkid=9754899

clearingout

can I ask how that happened so I can avoid it in the future?! was it a virus of some kind or did I click on something?

waddler_8

Sorry, missed this somehow.

This kind of stuff generally gets bundled with software you download. Always pay attention to the installer and uncheck any prechecked, unnecessary, extra software offered or changes to settings. Read the EULA also before agreeing to it.