Quads
Malware Removalists
In New Zealand
Posts: 9,387
|
Post by Quads on Jul 20, 2014 15:00:29 GMT -8
hmm how the heck is a small script make such a big output Go here, Upload the file and then post the download link wikisend.com/Quads
|
|
|
Post by glorywriter on Jul 20, 2014 15:15:13 GMT -8
|
|
Quads
Malware Removalists
In New Zealand
Posts: 9,387
|
Post by Quads on Jul 20, 2014 15:41:07 GMT -8
New Windows temp objects (that were not there last OTL script.
After the restart does Chrome still do the Yahoo Highjack
Quads
|
|
|
Post by glorywriter on Jul 20, 2014 16:30:16 GMT -8
After about a dozen searches, it reverts to the Yahoo hijack. It's also says Looksafe Yahoo in the title on the tab at top, if that matters.
|
|
Quads
Malware Removalists
In New Zealand
Posts: 9,387
|
Post by Quads on Jul 20, 2014 16:51:09 GMT -8
Unless it is the DNS I have found another thread with your problem, they even created a new Chrome profile and that did not get rid of it Download Minitoolbox www.bleepingcomputer.com/download/minitoolbox/Start MiniToolBox Select the first item listed, Flush DNS and then click GOThen Uninstall Google Chrome Close all open windows. Click Start. Click Control Panel. Click Programs and Features. In the Programs list Click Google Chrome > Uninstall. A Dialog box should appear giving you the option to tick a box to clear all dataWhen this is finished, reboot your computer. When the computer boots back up, you can re-download Google Chrome here: www.google.com/intl/en_us/chrome/browser/Worked for the other system Quads
|
|
|
Post by glorywriter on Jul 20, 2014 17:43:45 GMT -8
I followed instructions, uninstalled and reinstalled Chrome. It went back to the Yahoo hijack. I uninstalled and reinstalled again, to make sure I didn't miss a step the first time. It took about 20 searches before it went back to the Yahoo hijack. One thing to note, after I reinstalled Chrome, it asked me to sign in, which then gave me my bookmarks back. Was this the right thing to do, or do I need to not sign back in and make a whole new one?
|
|
Quads
Malware Removalists
In New Zealand
Posts: 9,387
|
Post by Quads on Jul 20, 2014 17:59:29 GMT -8
Hmmm the other thread didn't say they signed back in to google account. I Use Google Chrome but don't have an account, but my understanding is that there is backup of all your Browser data including history and bookmarks etc that your browser had. so a thought is that signing in and syncing the account set your browser back. The other thread www.bleepingcomputer.com/forums/t/533331/looksafe-malware/page-2Quads
|
|
|
Post by glorywriter on Jul 20, 2014 18:08:29 GMT -8
Ok, I will uninstall/reinstall chrome and not sign back in. I will let you know if this fixes the hijacking problem.
|
|
Quads
Malware Removalists
In New Zealand
Posts: 9,387
|
Post by Quads on Jul 20, 2014 18:18:35 GMT -8
I am looking into Google Sync and how it sync back and forth the data including history, bookmarks, preference data, extensions blah blah.
Which could make sense for why to takes time for the account to place your data back in the browser or the change appears by the next morning. with "IT's BACK.
Quads
|
|
|
Post by glorywriter on Jul 21, 2014 7:34:37 GMT -8
Ok, I reinstalled it and didn't sign in. But this morning, the Yahoo hijack is back. The only thing I have signed into is my facebook, but I can't see how it would cause Chrome to sign into Google....but then I don't see how any of this is happening. At this point, I'm pretty sure my computer is possessed and I may have to shoot it.
|
|