Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Chrome re-direct


  • This topic is locked This topic is locked
10 replies to this topic

#1 ladnor

ladnor

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Local time:04:26 PM

Posted 09 October 2017 - 08:32 AM

My home page is google.com/

This evening it is being redirected to www.google.co.uk/?gfe_rd=cr&dcr=0&ei=0pvaWbyKJ4fHXqbHraAG  Ok earlier on, unwanted ads coming up.

I have used Avast, Malwarebytes and adwcleaner but nothing shows. One suggestion made was that I open Chrome in incognito, but I still get the same result. Popup blocker has no affect

<script> </script>

Attached Files



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 40,486 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:26 AM

Posted 09 October 2017 - 12:20 PM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to a new file.


Start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
CHR NewTab: Default ->  Not-active:"chrome-extension://icpgjfneehieebagbmdbhnlpiopdcmna/main.html"
CHR Extension: (Avast Online Security) - C:\Users\Ron\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-08-22]
R2 ibtsiva; %SystemRoot%\system32\ibtsiva [X]
U3 aspnet_state; no ImagePath
U3 aswbdisk; no ImagePath
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
Task: {2BC68706-8F45-4416-9810-E940AF772245} - \Hewlett-Packard\HP Support Assistant\Opt-in For HP Support Assistant Quick Start -> No File <==== ATTENTION
Task: {2EC11ED7-6CC6-4ED3-B49C-2F97386BA9AC} - \Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start -> No File <==== ATTENTION
Task: {859FC155-DD1E-4421-A1E2-62631DCDE54E} - \ASC10_SkipUac_Ron -> No File <==== ATTENTION

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Reset Chrome...
Open Google Chrome, click on menu icon google-chrome-setting-icon.png or the 3 vertical dots located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset browser settings" button.
 
Restart Chrome.
===

Please let me know what problem persists with this computer.

#3 ladnor

ladnor
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Local time:04:26 PM

Posted 09 October 2017 - 04:17 PM

Hi Nasdaq, thanks for help

 

Ran frst-fix+

 

Attached File  Fixlog.txt   4.44KB   1 downloads

 

Problem still exists



#4 nasdaq

nasdaq

  • Malware Response Team
  • 40,486 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:26 AM

Posted 10 October 2017 - 07:55 AM

Hi,

:step1: Remove Chrome from your Computer and reinstall a fresh copy later.

:step2: Before you remove Chrome Export your Bookmarks
Chrome will export your bookmarks as a HTML file, which you can then import into another browser.

How To: http://ccm.net/faq/31791-how-to-backup-your-google-chrome-bookmarks

:step3: If you sync you account you must remove it before you save your bookmarks etc...
Delete Your Google Chrome Browser Sync Data
https://www.howtogeek.com/103655/how-to-delete-your-google-chrome-browser-sync-data/


:step4: Clear your Chrome cache and cookies
https://support.google.com/chromebook/answer/183083?hl=en


:step5: Remove Chrome using the the instructions on this page.
https://support.google.com/chrome/answer/95319?hl=en

:step6: Re-install Chrome and the Bookmarks.
====

#5 ladnor

ladnor
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Local time:04:26 PM

Posted 10 October 2017 - 10:45 AM

Thanks for info looks like the only thing I can do. To do a clean install do I need to remove all google/chrome from registry



#6 nasdaq

nasdaq

  • Malware Response Team
  • 40,486 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:26 AM

Posted 10 October 2017 - 12:55 PM

No. Just follow my removal instructions.

#7 ladnor

ladnor
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Local time:04:26 PM

Posted 10 October 2017 - 04:36 PM

It seems that for some inexplicable reason, google.com are redirecting users to their own country!! Since changing my search to google.co.uk in settings, it comes up without redirect notice

 

Many thanks for your time and assistance, appreciated

Ladnor


Edited by ladnor, 10 October 2017 - 04:51 PM.


#8 nasdaq

nasdaq

  • Malware Response Team
  • 40,486 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:26 AM

Posted 11 October 2017 - 07:45 AM



Hi,

Yes this is normal

If you type https://www.google.com/ It will redirect to your country.

Leave the page as is.


If you want to go to https://www.google.com/ click the link to Use google.com on the right bottom of the page.
===

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/


https://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
Simple and easy ways to keep your computer safe and secure on the Internet.
===

#9 ladnor

ladnor
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Local time:04:26 PM

Posted 11 October 2017 - 08:06 AM

Thanks for that, perhaps co,uk is better for our market, but I did read some time ago that if there are probs ,com is better, don't know why, but I can honestly say I've not seen the redirect before, could be par for the course for an octogenarian  :oopsign:


Edited by ladnor, 11 October 2017 - 08:10 AM.


#10 nasdaq

nasdaq

  • Malware Response Team
  • 40,486 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:26 AM

Posted 11 October 2017 - 08:28 AM

Hi.
 

could be par for the course for an octogenarian

Nothing to worry about. I have 4 years to go.

Regards

#11 ladnor

ladnor
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Local time:04:26 PM

Posted 11 October 2017 - 08:31 AM

:hello: and you will soon wonder where they've gone


Edited by ladnor, 11 October 2017 - 08:32 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users