Hello, I've picked up a very stealthy fake java update hijack in Google Chrome. While browsing, it randomly redirects to javaistlau.com/index.html?sid=19&aff_sub=ad17-au&uuid=[long dash separated hex string, unique with each event]. From the usual looking java screen It downloads (without prompt) a .exe from istplayer.com and then redirects to an Asian dating site via seth.avazutracking.net, for which I didn't get the URL (my Chrome history was slightly mangled by a reinstall). The problem does not appear to affect Internet Explorer 11. While everything currently installed is 'legit', I have previously installed a cracked game (see the ESET Online Scan entry). It was run inside of a sandbox and I foolishly thought that was sufficient protection. If that was the origin, it has taken several months to start showing symptoms. I would say this was karma, but I bought it after trying it out. I've added HOSTS entries for the sites listed above to help mitigate the issue until it is fixed. What I have tried, in approximate chronological order : MalwareBytes Anti-Malware (0 threats found) Adware Cleaner (Chrome extension removed) Kaspersky Security Scan (0 threats,vulns: java (updated) and FoxIt PDF (uninstalled)) ESET Online Scan (Deleted 1 dll - Win32/VMProtect.AAD) TDSS Killer (0 threats found) RKill (0 threats found) ComboFix (0 threats found) JRT (0 threats found) HitmanPro x64 (0 threats found) ESET NOD32 full scan (0 threats found) SuperAntiSpyware (52 tracking cookies) Malwarebytes Anti-Rootkit (0 threats found) I have removed all Chrome extensions. I cannot see anything suspicious in ProcessExplorer, and none of the running processors had a return from VirusTotal. I then completely uninstalled Chrome, including all history/extensions/so forth, and reinstalled from the web. I unchecked syncing extensions and apps. Whilst uTorrent is installed, it is completely disabled. Incidentally, I can't paste anything into this editor using IE11 - CTRL-V, right click Paste, and the paste shortcuts (after the IE permissions popup) all do nothing. FRST.txt Addition.txt