Virus that keeps redirecting my searches

I am not new to computers or virus, malware, and spyware removal but there is one persistent piece of...something that i cannot remove.  I have malwarebytes, iobit malware, Hitman Pro,, Junkware Removal, Avast and like one or two other removal tools.  I have run them all cleared about 400 spyware/malware that i was stupid and ended up getting.  Now when i run them, they MIGHT find one PuP or nothing. I have run malwarebytes 2-3 times today alone and it hasn't found anything, i have run hitman and now malware adware cleaner and they have found nothing, but about 50-75% of the time, when i do a search via my address bar, or go to google.com and do a search on the main screen it does a quick redirect "extensions.citypage.today" and redirects to a bing search page.  To the best of my knowledge, i have removed all extensions from all browsers on my computer, removed anything past the file extension for the shortcuts and run MANY virus, adware, malware and spyware things. I am at a total loss now.

Hello Bornforexile,

My name is Ray and I'll be assisting you with your issue. Please give me a day or two to review your logs and prepare a reply. Since I'm still a trainee, all my posts have to be reviewed by my instructor prior to being posted to make sure that you receive the best assistance possible.

Thank you for your understanding, I'll be with you shortly!

Ray
 

Are you still there ray? It's been longer than 2 days

Hello again Bornforexile, and welcome to Bleeping Computer.

Please call me "Ray". Do you have a short nickname I can use?

I will be helping you with your computer problem.

• Please do not attach any log files to your replies unless specifically requested. Instead, please copy and paste the entire text of the logs into the body of your reply. Use separate consecutive posts if that's easier for you.
• Please do not make any further changes to your computer (such as Install/Uninstall programs, use special fix tools, delete files, edit the registry, etc...) and don't perform any actions without being advised to do so. If you are unsure, please stop and describe the current state of your PC and ask your question.
• Always read my entire message before you begin to follow my instructions.
• It may be helpful for you to print my instructions for easy reference.
• Perform my instructions in the order as given.
• Click More Reply Options and then Preview Post before you post a reply. Be sure your message addresses all the issues I raise.
• Any fixes I provide are for this specific problem on this machine only.
• Removing malware is hazardous. I will not knowingly advise actions that will damage your computer, but it is impossible to guarantee the safety of your system. It may even become necessary to re-format and re-install your operating system. Before we proceed, you should back up all your data -- preferably to a different computer or to off-line storage.

Overview
It will be necessary to perform the following procedures in the Recovery Environment (RE). 

• Run the Farbar Recovery Scan Tool (FRST) tool with the script fix provided.
• Scan with FRST again and send me the FRST.txt log.

 
 
 
Prepare the Farbar Recovery Scan Tool (FRST) and a script file on a USB thumb drive
Copy your existing FRST64.exe file onto a USB thumb drive. Then create fixlist.txt in the same directory on the USB thumb drive as follows:

• Launch Notepad.
• Copy and paste the text you see from inside the following code box into a new Notepad document.

CloseProcesses:
HKLM\SYSTEM\CurrentControlSet\Services\kgbsa <==== ATTENTION (Rootkit!)
HKLM-x32\...\Run: [] => [X]
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
GroupPolicy: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Hosts:
BHO-x32: No Name -> {451C804F-C205-4F03-B48E-537EC94937BF} -> No File
Handler: WSWSVCUchrome - {1CA93FF0-A218-44F1 - No File
FF HKLM-x32\...\Firefox\Extensions: .WSVCU@Wondershare.com. - C:\ProgramData\Wondershare\Video Converter Ultimate\WSVCU@Wondershare.com_xpi => not found
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
R3 hlorvy; system32\drivers\oruybe.sys [X]
S4 vugmtxr; System32\drivers\wmbexrpd.sys [X]
File: C:\Users\James\AppData\Local\fdb94zxvtr
File: C:\Users\James\AppData\Local\NHBvvvvvvv
C:\Windows\Tasks\{61023390-5853-82FD-6C7A-1FC4E14E4AF9}.job

• Click File, then Save As...
• On the left pane, navigate to the same location on your USB thumb drive where FRST64.exe is.
• Under the Save as type dropdown, select All Files.
• In the File Name box, type fixlist.txt
• Click Save.
• If fixlist.txt already exists on the thumb drive, click Yes to replace it.

NOTICE: This script was written specifically for this user to be used on this particular machine. Running this script on another machine may cause damage to your operating system.



Enter Command Prompt in Recovery Environment (RE) and run script

• Tap the Windows key. Then press and HOLD the "Shift" key and simultaneously click Power icon (in the lower left of the screen) and click Restart.
• At the next screen choose Troubleshoot.
• Next screen choose Advanced Options.
• Next screen choose Command Prompt.
• If it prompts you for a password type it now and press Enter. (If you do not have a password simply press Enter).
• After the Command Prompt window loads, type notepad and press Enter.
• From the notepad menu, press File > Open then navigate to your USB drive and choose all files.
• Right-click FRST64 and click Run as administrator.
• Click Fix.
• The result of running the script will appear in a file called Fixlog.txt which will be created on your thumb drive in the same location as FRST64.exe.
• Copy and paste Fixlog.txt into your reply.

Re-scan with Farbar Recovery Scan Tool

• Navigate again to FRST64 and right-click it. Then click Run as administrator.
• Click Scan.
• When finished, it will produce a log called FRST.txt in the same directory where the tool was run from.
• Please copy and paste FRST.txt into your next reply.

In your next reply...

• Tell me your nickname.
• Confirm that you have backed up your important data.
• Copy and paste the entire contents of Fixlog.txt into the body of your message.
• Copy and paste the entire contents of FRST.txt into the body of your message.
• Tell me whether you encountered any problems in following these instructions (give full details).

Thank you for your patience,

Ray

I have no nicknames, but you can call me James.

I have backed up all my stuff

Fixlog:

Getting into the Windows RE is a bleep on my computer. NOTHING works aside from putting in a windows 10 installation disk and forcing a CD boot from the Bios

Hi James,

Thank you for supplying your first name.

For some reason, the FixList.txt file you created did not contain the script I provided. I'm providing a slightly modified script in an attached FixList.txt file. Please delete the existing FixList.txt file from your USB thumb drive and download the attached FixList.txt file to the same directory on your thumb drive where FRST64.exe is located.


Run Farbar Recovery Scan Tool (FRST) in FIX mode

• Enter Command Prompt in Recovery Environment as you did before and use Notepad to navigate to your thumb drive.
• Right-click FRST64 and click Run as administrator.
• Click the Fix button in the Farbar Recovery Scan Tool window.
• Wait until the program completes execution.
• The tool will create a log called Fixlog.txt in the same directory on your thumb drive. Please post its contents into your reply.

NOTICE: This script was written specifically for this user to be used on this particular machine. Running this script on another machine may cause damage to your operating system.
 
 

Note: Restart your PC and perform the following steps in normal boot.


Re-scan with Farbar Recovery Scan Tool

• Navigate again to FRST64.exe on your thumb drive and right-click it. Then click Run as administrator.
• Under Optional Scan, be sure a checkmark is placed next to Addition.txt.
• Click Scan.
• When finished, it will produce two logs called FRST.txt and Addition.txt in the same directory where the tool was run from.
• Please copy and paste FRST.txt and Addition.txt into your next reply.

In your next reply...

• Copy and paste the entire contents of Fixlog.txt into the body of your message.
• Copy and paste the entire contents of FRST.txt and Addition.txt into the body of your message.
• Please tell me how your PC is running now.

Thank you,

Ray

[attachment=203367:FixList.txt]

Hi James,

3 Day Bump

It has been 3 days since my last post.

• Do you still need help with this? If not, please let me know as soon as possible. Other people are requesting my help.
• If you will be away for an extended period, please let me know in advance.
• If you have not replied within 48 hours I will assume you have abandoned the Topic and it will be closed.

Thank you,

Ray