Chrome possibly infected?

Viruses and worms
1

Hello

So my search engine has been acting funny, and is missing quite a bit of options that were once there. It’s almost as if it gets redirected to a custom search engine. I have tried resetting my options, running avast, running malwarebytes (Which found some stuff, but didn’t fix it), Chrome fixer, everything I have ran is saying nothing is wrong. I have tried uninstalling chrome and deleting the cache, running chrome as a guest, clearing my entire history/cookies/everything. I have tried using a different search engine, yet it comes back with an error, a tunneling error, whatever that means? I’ve checked my extenstions/plug-ins everything looks fine, can you help?

The evidence:

a google search URL looks like this https://cse.google.com/cse?cx=017628126614017098810:c2rlwcsnsbe&q=help&oq=help&aqs=chrome.0.69i59l2j69i65l3j0.1151j1j7&sourceid=chrome&ie=UTF-8#gsc.tab=0&gsc.q=help&gsc.page=1

The attached photo show what it looks like on my end. ( https://15104268797498972201.googlegroups.com/attach/33690d163e89e/chromeactingfunny.png?part=0.1&view=1&vt=ANaJVrEgo3HqocdAu4Tb4Kjt6F1wWD8XoqGTVEPlTAQrDUn02XgJGmWPOtKEWjwoEDVXaCzXvOngBCXqjsp-hebDRnMcuAriuAdxZn4nP4pnPPttrnthuUA )

In my settings the defailt search engine is set to Google.com and it has this string of text behind it {google:baseURL}search?q=%s&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:contextualSearchVersion}ie={inputEncoding}

It won’t let me edit it, so I figured it’s a default string, still unsure which is why I posted it.

Is it possible to edit a file that would be causing this? Or is it a virus of some sort?

Any help would be much appreciated!!

2

Attach your basic diagnostic logs. (MBAM, FRST and aswMBR)
Instructions: https://forum.avast.com/index.php?topic=53253

3

Alright so my friends and I were able to figure it out. A simple reg edit fixed it, for how long I don’t know. https://www.youtube.com/watch?v=b8JZ3ZQ1gAg These were the steps I took and it worked. I’ll post my logs, maybe it’ll help?

4

Here are the rest of my logs, I hope that’s everything

5

OK, now you’ve to wait a bit…

6

I’m patient :slight_smile: Thanks for the help BTW

7

OK. :slight_smile: You’re welcome.

8

[*]Step #1 Fix with AdwCleaner
[*]Download AdwCleaner by Xplode to your Desktop from the following link.
[list][]Download Link #1
[]Download Link #2
[*]Right-click on AdwCleaner.exe and choose Run as administrator;
[*]Click on Option and put a tick mark on everything;
[*]Click on Scan and let the program run unhindered;
[*]When done, click on Clean and allow the system to reboot after it is done;
[*]A log will be opened automatically after the restart. If not, it is located in C:\AdwCleaner\AdwCleaner[CX].txt, where X is replaced with a number;
[*]Attach the log file to your reply.[/list]

Reset your browser. Attach a fresh FRST scan log.

[*]Required Log(s):
[]AdwCleaner Log
[]FRST.txt

Regards,
Valinorum