Help Please - Odd Recurring Infection (Second Try)

Hi, Lets try this again

I have a strange infection that I have been unable to remove successfully using AdwCleaner. It's identified by a registry entry:

HKLM\SOFTWARE\14919ea49a8f3b4aa3cf1058d9a64cec

And attaches itself to Chrome

[C:\Users\Michel\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : ask.com


Symptoms
-------------

Affects only some programs - notably MS Publisher 2007, Spider Solitaire which become almost unusable due to the screen intermittently flashing and being unable select buttons / items with the mouse. Seems as it the item that I am trying to select keeps moving.

I've tried Malwarebytes anti-Malware - nothing detected
AdwCleaner - removes registry key above and ask.com but I get re-infected very quickly
Junkware Removal Tool - no effect

I've included my FRST and ADDITION logs below.

Thanks! I hope you can help me.

Mike

Warning!
The steps presented in these posts are for this person and machine ONLY. Do not apply these steps to your own system, without the guidance of a trained malware removal helper. Doing so, may possibly damage your system, preventing it from starting.

Hello Mike and welcome to the Malware Removal Forums

My name is capnkrunch and I will be helping you with your malware problems. I'm an Undergraduate trainee here, and as such my posts to you have to first be checked by a Teacher, because of this my replies to your posts may be slightly delayed. Please be patient and I'm sure we'll be able to resolve your problems.

Before we begin, please read and follow these important guidelines, so things will proceed smoothly.

• The instructions being given are for YOUR computer and system only!
  Using these instructions on a different computer can cause damage to that computer and possibly render it inoperable!
• You must have Administrator rights, permissions for this computer.
• DO NOT run any other fix or removal tools unless instructed to do so.
• DO NOT install any other software (or hardware) during the cleaning process.
• Only post your problem at (1) one help site. Applying fixes from multiple help sites can cause problems.
• Print each set of instructions, if possible. Your Internet connection will not be available during some fix processes.
• Only reply to this thread, do not start another ... Please, continue responding, until I give you the "All Clean".
  Remember, absence of symptoms does mean the infection is all gone.
• Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
• Failure to respond for 3 days, will result in your topic being closed.

Note: If you haven't done so already, please read this topic ALL USERS OF THIS FORUM MUST READ THIS FIRST where the conditions for receiving help here are explained.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care, not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

For your safety and protection, I would advise backing up all your important documents, personal data files and photos to a CD or DVD drive as some infections may render your computer unbootable during or before the disinfection process. The safest practice is not to backup any files with the following file extensions:
exe, .scr, .ini, .htm, .html, .php, .asp, .xml, .zip, .rar, .cab as they may be infected.

• Back up your files
• How to back up or transfer your data on a Windows-based computer
• How to use Ubuntu Live CD to Backup Files from your dead Windows Computer

Hello Mike

Step one...

Please answer this question:

Is this computer used for business purposes including small or home business? I need to know so I can provide proper instructions.

Step two...

CKScanner
Please download CKScanner and save it to your Desktop.
This program should only be run once!
Make sure that CKScanner.exe is on the your desktop before running the application!

• Right click on the CKScanner.exe icon and select Run as administrator.
• Click the Search For Files button.
• When the scan is finished (the cursor hourglass disappears) click the Save List To File button.
  A text file will be created on your desktop named "ckfiles.txt"
• Click OK at the file saved message box. Double-click on the ckfiles.txt icon on your desktop.
• Please copy/paste the contents of ckfiles.txt in your next reply.

Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections...

In your next reply please include:

• Did you have any problems with the instructions?
• An answer to my question about business use
• ckfiles.txt
• Are there any changes in computer behavior?

Hello Mike

It has been 48 hours since my last post.

• Do you still need help?
• Do you need more time?
• Are you having problems following my instructions?
• According to Malware Removal's latest policy, topics can be closed after 3 days without a response.
• If you do not reply within the next 24 hours, this topic will be closed.

Due to a lack of response, this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.