Browser Hijacked with popped up searches to 'legitimate' help sites

I have been wrestling with a particularly nasty problem that I cannot get rid of.  I'm running Windows 10 Professional 64-bit on an AMD FX-8350 based system.  This problem occurs randomly.  Sometimes it will not appear for hours and sometimes, it will appear right after I boot.  Long story short, the following three "help" searches show up both in Chrome and Microsoft Edge.  
 
https://www.dropbox.com/s/5pxf15k4ywgtafl/File%20Dec%2021%2C%206%2048%2031%20PM.jpeg?dl=0
 
https://www.dropbox.com/s/87iyd6lrdw0sufi/File%20Dec%2021%2C%206%2048%2011%20PM.jpeg?dl=0
 
 
https://www.dropbox.com/s/jqqi6ixl2gghddu/File%20Dec%2021%2C%206%2047%2045%20PM.jpeg?dl=0
 
 
They will sometimes open randomly when I am not using either browser or will open in a new tab, if I have a browser open.  Sometimes, they will open multiple instances in  new tabs if I'm using Chrome or tabs/cascade if I'm using Edge.  They will sometimes appear when I click on any icon or on the desktop.  An instance will appear sometimes for each letter I attempt to type into the address bar of a browser.  When it rears it's head, I cannot use any program that requires me to type something.  Oddly, this behavior doesn't happen when I'm in a game.  Only solution is to restart my machine.  Sometimes, it lies dormant after restart and others it comes right back. 
 
I have used just about everything to get rid of it.  Rogue Killer, Malwarebytes, Hijack This, Hitman Pro, Microsoft Safety Scanner, Malicious Software Removal Tool, TDSSKiller, Zemana, NPE, Spybot, Adaware, Super Anti-Spyware.  Still no joy.
 
Has anyone seen this beast and have a solution?
 
Thanks in advance.
 
Derek
 
Mod Edit:  Merged posts - Hamluis.
 
Attached FRST log files


 

Edited by hamluis, 22 December 2016 - 11:15 AM.

bump

 

Another hint on the behavior of this thing is that when it is going to appear after startup, I do not hear the windows startup tone and the hard disk activity light is very busy for much longer after startup.

Edited by DerekJ, 22 December 2016 - 10:13 AM.

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Press the windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to a new file.
 

Start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

HKLM-x32\...\Run: [] => [X]
ShortcutTarget: Universal Media Server.lnk -> C:\Program Files (x86)\Universal Media Server\UMS.exe (No File)
URLSearchHook: [S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415_classes] ATTENTION => Default URLSearchHook is missing
CHR Extension: (Chrome Web Store Payments) - C:\Users\Derek Jackson\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-11-06]
CHR Extension: (Chrome Media Router) - C:\Users\Derek Jackson\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-06]
S3 dbx; system32\DRIVERS\dbx.sys [X]
U3 idsvc; no ImagePath
S1 ZAM; \??\C:\WINDOWS\System32\drivers\zam64.sys [X]
AlternateDataStreams: C:\ProgramData\TEMP:69E87FA2 [290]
AlternateDataStreams: C:\ProgramData\TEMP:A9967A61 [132]
AlternateDataStreams: C:\ProgramData\TEMP:F4C624DE [124]

Reboot:

End

Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Reset Chrome...
Open Google Chrome, click on menu icon which is located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset browser settings" button.
 
Restart Chrome.
===

For your added security.
ADOBE AIR

Navigate to this page and follow the instructions to get the latest version.
https://get.adobe.com/air/
==============

ADOBE READER
http://get.adobe.com/reader/
Before your download I suggest you unckeck the box on the top right "Yes, install McAfee Security Scan Plus - optional" this is not required if you are not a McAfee subscriber. While the installation is in progress you can also deny the installation of any other programs that may be suggested.
<<<>>>

Remove this old versions via the Control Panel > Programs > Programs and Features if still present.
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe Reader 9.1 (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-A91000000001}) (Version: 9.1.0 - Adobe Systems Incorporated)

Please let me know what problem persists with this computer.

===

If the problem persists please run this cleaning tool.

Temporarily disable your AV program so it does not interfere.
Info on how to disable your security applications How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides.

Download Zoek tool from here

When the download appears, save to the Desktop.
On the Desktop, right-click the Zoek.exe file and select: Run as Administrator
(Give it a few seconds to appear.)

Next, copy/paste the entire script inside the code box below to the input field of Zoek:

createsrpoint;
autoclean;
emptyclsid;
emptyffcache;
FFdefaults;
emptyiecache;
iedefaults;
emptychrcache;
CHRdefaults;
emptyalltemp;
emptyfolderscheck;delete
ipconfig /flushdns;b

Now...
Close any open Browsers.
Click the Run script button, and wait. It takes a few minutes to run all the script.

When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed, the log is opened after the reboot.

Please attach the zoek-results.log in your reply.
===

Also, please provide an update on how the computer is behaving after running the above script.

Thank you, nasdaq.  Not having a problem so far.  I will post a periodic update on how I'm doing.  Attached is the Fixlog.txt file.

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/

Well, it came back after I booted up this morning.  I restarted and then ran the Zoek tool.  My log file is attached.

It's back again.  This time, it happened when I was in-game.  I was playing Battlefield 1 when I noticed strange behavior with my shift key when trying to sprint.  Exited out of the game to find Chrome open with about 30 tabs of the ea\Origin help page.  Any ideas?

We will check your BIOS and Master boot record.

Read carefully and follow these steps.
TDSS

• Download TDSSKiller and save it to your Desktop.
• Doubleclick on TDSSKiller.exe to run the application.
• Then click on Start Scan.
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
• Important: Do NOT change the default action on your own unless instructed by a malware Helper! Doing so may render your computer unbootable.
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
• If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

===

Download http://public.avast.com/~gmerek/aswMBR.exe (aswMBR.exe) to your desktop. Double click the aswMBR.exe to run it.

• Click the "Scan" button to start scan.
• Upon completion of the scan, click Save log, and save it to your desktop. (Note - do not select any Fix at this time) <- IMPORTANT
• Please paste the contents of that log in your next reply.
• There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.
  ===
  
  Wait for further instructions.

Here are my log files:

 

 

I was playing Battlefield 1 when I noticed strange behavior with my shift key when trying to sprint. Exited out of the game to find Chrome open with about 30 tabs of the ea\Origin help page. Any ideas?

The issue is not caused by Malware but by the programs you use.

My search revealed this page.

http://www.ghacks.net/2011/11/04/want-to-play-battlefield-3-without-origin-do-this/

Hope it helps.

If not check the appropriate game Forums.

===

p.s.
If not using Origin you can remove it via the Control Panel > Programs > Programs and features.

Interesting.  Strange though that I have had Battlefield 3 on my machine and played without issues until recently.  I'll give it a whirl and let you know.  Thanks.