Google search: three more result than normal

"megatonante" wrote:
Sure about screenshot, I will do a coverage:

Thank you for the very detailed explanation. I have to go to work now, however as soon as I get back I will provide you with more instructions.

mAL

Hello megatonante,


Please follow the instructions in the following link to disable Windows Defender before following the steps below : How to Turn On or Off Windows Defender in Windows 10.


Next..

• Please download Zoek from Here and save it to your Desktop.
• Right-Click on Zoek.exe and select Run as Administrator.
• It may take a while before the program opens, this is normal.
• Once Zoek is opened, copy/paste the following code inside the Input Field:
  

  
  
  createsrpoint;
  
  autoclean;
  
  chromelook;
  
  emptyalltemp;
  
  ipconfig /flushdns;b
  
  

• Close any open browser and click on Run script.
• Zoek will now start to run the script.
• Once the tool finishes, a windows will open named zoek-results.log.
• Please post the contents of zoek-results.log in your next post.
  Do not forget to re-enable Windows Defender at this point.

-----------------------------------------
In your next reply, I would like to see..

• zoek-results.log

Zoek:





Zoek.exe v5.0.0.1 Updated 31-December-2015
Tool run by cloud on 07/06/2016 at 13:04:01,66.
Microsoft Windows 10 Home 10.0.10586 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\cloud\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

07/06/2016 13:05:40 Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\PROGRA~3\Comms deleted successfully
C:\PROGRA~3\DAEMON Tools Lite deleted successfully
C:\PROGRA~3\SoftwareDistribution deleted successfully
C:\Users\Administrator\AppData\Local\ActiveSync deleted successfully
C:\Users\cloud\AppData\Local\ActiveSync deleted successfully
C:\Users\cloud\AppData\Local\NetworkTiles deleted successfully
C:\Users\cloud\AppData\Local\Opera Software deleted successfully
C:\Users\cloud\AppData\Local\Skype deleted successfully
C:\Users\cloud\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Batch Command(s) Run By Tool======================


==== Deleting Files \ Folders ======================

C:\PROGRA~3\Package Cache deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
"C:\Users\cloud\AppData\Roaming\mpv" deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\cloud\AppData\Roaming\Greyfirst\Celtx\Profiles\3mdoxxdw.default
- Timezone Definitions for Mozilla Calendar - C:\Program Files (x86)\Celtx\extensions\[removed]
- Default Shot Palette - C:\Program Files (x86)\Celtx\extensions\[removed]
- DOM Inspector - C:\Program Files (x86)\Celtx\extensions\[removed]

==== Firefox Plugins ======================


==== Chromium Look ======================


Google Slides - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek
Google Docs - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Google Sheets - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap
Google Docs Offline - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi
Chrome Web Store Payments - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Gmail - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia
Google Drive - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
selector is not a valid CSS selector - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb
NoCountryRedirect (NCR) - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciboebddidackjicoeoiigdnbmchkdll
Google Search - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Search by Image by Google - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\dajedkncpodkggklbegccjpmnglmnflm
imgur Extension by Metronomik - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehoopddfhgaehhmphfcooacjdpmbjlao
Google Sheets - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap
Falcon Proxy - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\gchhimlnjdafdlkojbffdkogjhhkdepf
Google Docs Offline - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi
MagicScroll eBook Reader - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgnmgfdoiplfmhgghbmlphanpfmjble
Mibbit webchat - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbadbkkklnhamjjeagmknajgmbgcmnpi
Imgur Uploader - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgmpmjpekinnebjgnakcahjikbomnmlb
Image Search Options - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\kljmejbpilkadikecejccebmccagifhl
Keepa - Amazon Price Tracker - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\neebplgakaahbhdphmkckjjcegoiijjo
Chrome Web Store Payments - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Simple EPUB Reader - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojhbgcchcbdjdenibfmjofobklkkhofc
Gmail - cloud\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\cloud\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\cloud\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\cloud\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\cloud\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\cloud\AppData\Local\Google\Chrome\User Data\Default\Cache will be emptied at reboot

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=29 folders=36 35076320 bytes)

==== Empty Temp Folders ======================

C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\Users\cloud\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\cloud\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0" deleted
"C:\Users\cloud\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1" deleted
"C:\Users\cloud\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2" deleted
"C:\Users\cloud\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3" deleted
"C:\Users\cloud\AppData\Local\Google\Chrome\User Data\Default\Cache\index" deleted

==== EOF on 07/06/2016 at 13:26:56,85 ======================

Hello megatonante,

Is there any change in Chrome's behavior after the Zoek fix?

"mAL_rEm018" wrote:Hello megatonante,

Is there any change in Chrome's behavior after the Zoek fix?

No mAL, no change.

Hello megatonante,

We will remove Google Chrome again, however this time we will take a different approach. Before proceeding it is necessary that you save all your bookmarks. The instructions for doing so can be found here.


Once your bookmarks have been saved, please do the following..

Please do the following..

• Please open the Start menu.
• Click on Settings and then System.
• Select Apps & Features.
• Locate and click on the following programs:
  

  
  

  Google Chrome

  
  

• Select uninstall.
• Ensure that Also delete your browsing data? is checked => Very important!
• Answer any questions attentively.
• When the process is finished, please restart your computer.
  Note: you can only remove one program at a time.

Next..

• Click Start
• Type notepad.exe in the search programs and files box and click Enter.
• A blank Notepad page should open.
  
  • Copy/Paste the contents of the code box below into Notepad.

C:\Program Files\Google

C:\Program Files (x86)\Google

C:\Users\cloud\AppData\Local\Google



[-HKEY_CURRENT_USER\Software\Google]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Google]

• Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt
  

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
  
  • Press the Fix button once and wait.
  • FRST will process fixlist.txt
  • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
  • Please post me the log

To re-install Google Chrome, please do the following..

• Click on the following link: Google Chrome.
• Read the Terms of Service and select Accept and Install.
• Save ChromeSetup.exe to your desktop.
• Go to your desktop and right-click on ChromeSetup.exe and select Run as administrator.
• Google Chrome will then install itself.
• When the process is over, Chrome will open.

Do not re-install your bookmarks and extensions right away!! Try using Chrome on it's own first and only if there is no issues then you can start re-installing your personal stuff.

Are you still having issues with Chrome?

This is the fixlog:

HKEY_LOCAL_MACHINE\SOFTWARE\Google => key not found.

==== End of Fixlog 21:09:19 ====


After uninstalling and reinsstalling without importing my bookmarks, nor logging with my profile and synchronizing all my stuff from Google servers, Chrome is not showing the problem anymore!

I can do Google searches without the alien results coming up.

What should I do about bookmarks or my Google account with all the stuff?

Hello megatonante,

"megatonante" wrote:
After uninstalling and reinsstalling without importing my bookmarks, nor logging with my profile and synchronizing all my stuff from Google servers, Chrome is not showing the problem anymore!

That's good news!!

"megatonante" wrote:
What should I do about bookmarks or my Google account with all the stuff?

What I would like you to do at this point is to gradually start re-installing your personal stuff. You can import your bookmarks and try browsing and doing a few searches in Chrome. If after using Chrome for a while there is no issue, then you can synchronize your google account. By using this method, we will be able to troubleshoot what was causing the issue (if the problem comes back).

"mAL_rEm018" wrote:Hello megatonante,

"megatonante" wrote:
After uninstalling and reinsstalling without importing my bookmarks, nor logging with my profile and synchronizing all my stuff from Google servers, Chrome is not showing the problem anymore!

That's good news!!

"megatonante" wrote:
What should I do about bookmarks or my Google account with all the stuff?

What I would like you to do at this point is to gradually start re-installing your personal stuff. You can import your bookmarks and try browsing and doing a few searches in Chrome. If after using Chrome for a while there is no issue, then you can synchronize your google account. By using this method, we will be able to troubleshoot what was causing the issue (if the problem comes back).

Hello mAL. I installed first the bookmarks, and after checking that the problem did not come back, I synchronized my Google account.

And the problem seems to be resolved even after synchronization. : )

Thank you very much

Hello megatonante,

"megatonante" wrote:
Hello mAL. I installed first the bookmarks, and after checking that the problem did not come back, I synchronized my Google account.

And the problem seems to be resolved even after synchronization. : )

Good! We still have a little more work to do before I can provide you with my all clean speech, so please stick with this topic until I give you the all clear.


Let's do an online scan to make sure we didn't miss anything..


Please disable Windows Defender as shown in the following topic: How to Turn On or Off Windows Defender in Windows 10

Next..

• Close all opened programs, open your browser and go to the following link: ESET Online Scanner.
• Click on the SCAN NOW button under ESET Online Scanner.
  
  • Depending on which browser you are using, you might be prompted to download an executable file.
  • Please save it to your desktop.
  • Right-click on esetonlinescanner_enu.exe and select Run as administrator.
  • If you agree to the Terms of use, select Accept to continue.
• Please check the following option:
  

  
  

  • Enable detection of potentially unwanted applications

  
  

• Select Advanced settings and ensure that the following options are checked:
  

  
  

  • Enable detection of potentially unsafe applications
  • Enable detection of suspicious applications
  • Scan archives
  • Enable Anti-Stealth technology

  
  

• Make sure that the following option is NOT checked: => Very important!
  

  
  

  • Clean threats automatically

  
  

• Click Scan and the process will now begin. Please do not use your computer while the scan is running.
• Once the scan is completed, click Copy to clipboard.
• Open the Start menu and type notepad.exe in the search programs and files box.
• Press Enter. A blank Notepad page should open, paste the contents inside the window.
• Save the file as ESETScan.txt.
• Please copy/paste the contents of ESETScan.txt in your next reply.
• You can now safely close the program.
  Do not forget to re-activate Windows Defender at this point.

-----------------------------------------
In your next reply, I would like to see..

• ESETScan.txt

"mAL_rEm018" wrote:Hello megatonante,

"megatonante" wrote:
Hello mAL. I installed first the bookmarks, and after checking that the problem did not come back, I synchronized my Google account.

And the problem seems to be resolved even after synchronization. : )

Good! We still have a little more work to do before I can provide you with my all clean speech, so please stick with this topic until I give you the all clear.


Let's do an online scan to make sure we didn't miss anything..


Please disable Windows Defender as shown in the following topic: How to Turn On or Off Windows Defender in Windows 10

Next..

• Close all opened programs, open your browser and go to the following link: ESET Online Scanner.
• Click on the SCAN NOW button under ESET Online Scanner.
  
  • Depending on which browser you are using, you might be prompted to download an executable file.
  • Please save it to your desktop.
  • Right-click on esetonlinescanner_enu.exe and select Run as administrator.
  • If you agree to the Terms of use, select Accept to continue.
• Please check the following option:
  

  
  

  • Enable detection of potentially unwanted applications

  
  

• Select Advanced settings and ensure that the following options are checked:
  

  
  

  • Enable detection of potentially unsafe applications
  • Enable detection of suspicious applications
  • Scan archives
  • Enable Anti-Stealth technology

  
  

• Make sure that the following option is NOT checked: => Very important!
  

  
  

  • Clean threats automatically

  
  

• Click Scan and the process will now begin. Please do not use your computer while the scan is running.
• Once the scan is completed, click Copy to clipboard.
• Open the Start menu and type notepad.exe in the search programs and files box.
• Press Enter. A blank Notepad page should open, paste the contents inside the window.
• Save the file as ESETScan.txt.
• Please copy/paste the contents of ESETScan.txt in your next reply.
• You can now safely close the program.
  Do not forget to re-activate Windows Defender at this point.

-----------------------------------------
In your next reply, I would like to see..

• ESETScan.txt

Sadly, after many minutes of scanning, the program "stops working". Before it stops, I can see that at least 5 threats have been found. I tried this two times and ESET stops working every time.

Hello megatonante,

"megatonante" wrote:
Before it stops, I can see that at least 5 threats have been found.

ESET frequently flags the entries that were already removed via AdwCleaner, FRST, etc.. Therefore, I wouldn't worry about this just yet. However, just to be on the safe side, let's use another tool to perform the scan.



Malwarebytes Anti-Malware

• Please download Malwarebytes Anti-Malware from Here
• Save it to your Desktop.
• Right-Click on mbam-setup-2.2.1.1043.exe and select Run as Administrator.
• Follow the instructions on the screen to install the program.
• At the end, please ensure that the following option is checked:
  

  
  

  • Launch Malwarebytes Anti-Malware

  
  

• The option for the 14 day trial of the Premium version is pre-selected. Feel free to uncheck it if you wish to do so.
• Select Finish. The program should now open.
• Locate and click on Update Now >>.
• Once the updates have been installed, select the Scan tab.
• Ensure that Threat Scan is selected and click on Start Scan.
• Once the scan is completed, if there has been any detections, select Apply Actions.
• You will most likely be prompted to restart your computer, if so please allow the reboot.

Once your computer is restarted, please do the following..

• Open Malwarebytes Anti-Malware.
• Click History and then select Application Logs.
• Double-click on the scan log by looking at the timestamp (it should be in the following order: Day/Month/Year Time)
• Click Export and select Text file (*.txt).
• In the File name: box, please write MBAM Log and save it to your desktop.
• Once the process is over, a message will appear stating that the file has been successfully exported. Click OK.
• Please post the contents of MBAM Log.txt in your next reply.

-----------------------------------------
In your next reply, I would like to see..

• MBAM Log.txt

I didn't see the "threat scan" check.
I run the scan, and get no danger results.

Scan:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 10/06/2016
Scan Time: 09:12
Logfile: MBAM log.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.06.10.01
Rootkit Database: v2016.05.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: cloud

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 344926
Time Elapsed: 11 min, 14 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Hello megatonante,

The MBAM log you provided is incomplete. Please re-post it.

mAL

"mAL_rEm018" wrote:Hello megatonante,

The MBAM log you provided is incomplete. Please re-post it.

mAL

Oh, my bad:



Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 10/06/2016
Scan Time: 09:12
Logfile: MBAM log.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.06.10.01
Rootkit Database: v2016.05.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: cloud

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 344926
Time Elapsed: 11 min, 14 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)