Play-bar.net browser hijacker

[Steviedoyle]

When ever I use my browser (chrome) they at first act as normal. I will be searching google but then all of a sudden bing comes up and before hand it will say play-bar.net. Every so often it will try redirect me to other websites, but thankfully my anti-virus and malwarebytes denies this from happening.

I have run an virus avast scan which found nothing. I next ran malwarebytes which again found nothing.

I then ran adwcleaner which did find some suspicious files. I delete them, restart my PC but the problem persists when I start browsing again. Not at first, but maybe about 4 or 5 searches in, a random redirect.

I then tried Hitman Pro which again found files, but the problem still persists.

I'm currently running a Zemana scan.

 

[TwinHeadedEagle]

Hello,

When done, please post Zemana scan report.

 

[Steviedoyle]

Scan report as follows:

Zemana AntiMalware 2.50.2.133 (Installed)

-------------------------------------------------------
Scan Result            : Completed
Scan Date              : 2016/10/21
Operating System       : Windows 10 64-bit
Processor              : 2X Intel(R) Pentium(R) CPU G3258 @ 3.20GHz
BIOS Mode              : Legacy
CUID                   : 12D17A4BE2C83C26FE4B18
Scan Type              : Smart Scan
Duration               : 112m 30s
Scanned Objects        : 173367
Detected Objects       : 2
Excluded Objects       : 0
Read Level             : SCSI
Auto Upload            : Enabled
Detect All Extensions  : Disabled
Scan Documents         : Disabled
Domain Info            : WORKGROUP,0,2

Detected Objects
-------------------------------------------------------

NlaSvc Manual Proxies
Status             : Scanned
Object             : HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies\@
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Suspicious Setting
Cleaning Action    : Delete
Related Objects    :
                Registry Entry - HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies\@ = 0http://nonestops.org/wpad.dat?3683f32511d229eb7af4d59e00f1f5bd18570989

Proxy Auto Config
Status             : Scanned
Object             : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Suspicious Setting
Cleaning Action    : Delete
Related Objects    :
                Registry Entry - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = [URL]http://nonestops.org/wpad.dat?3683f32511d229eb7af4d59e00f1f5bd18570989[/URL]

 

[TwinHeadedEagle]

Do you still have issues?


Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
  
  
  
  
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

[Steviedoyle]

Yeah, I still have issues. I have just ran farbar. Attached both files.

Thanks

 

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[Steviedoyle]

I have attached Fixlog as advised.

 

[TwinHeadedEagle]

Can you explain to me where did you find and why did you use different fixlist than the one I provided?

 

[Steviedoyle]

Apologies, before I created this thread I had a look at other threads with similarish issues. I downloaded the file from one of the threads. I have now deleted it and re-downloaded the one your provided for me.

 

[TwinHeadedEagle]

Okay, that's much better. How is your PC behaving now?