Search the Community

Im not a malware expert but it seems it have infected the windows installer msiexec.exe and sending or receiving data through internet to a domain "4nbizac8.ru" , malwarebytes categorizes it as an adware and blocks it. But the malware keeps repeating itself every 4-5 seconds it cannot be stopped. Malwarebytes keep notifying that it successfully blocked it every 4-5 seconds. I ran the scanner multiple times but it cannot fix it, its up to date. Here is the log : (end)

Computer infected with Trojan Virus and Malware My computer has a problem as it has been infected with Trojan virus and malware and adware the name of the virus is(TROJAN.PHISHING.ARK!eml) this name was there when windows defender did offline scan .as well and the keys are not working the desktop icons are not appearing and I can't use the desktop itself and even the local C drive is also affected in user data now how to repair the computer computer desktop icons are not appearing since many days as well as the keys are not responding itself even after pressing F8 the task manager shutdown itself nothing. Actually actually I had installed two apps that is reimage repair and internet download manager for downloading my online lectures then because of this virus entered and the bottom task bar in desktop is always loading and only the wallpaper is shown with no desktop icons and I even tried several times restarting via CPU button . I can't use the desktop. I have a doubt that my computer has been formatted by this virus. When i knew about the virus i installed malwarebytes (Anti virus programmee) and I used to quarantine the virus files and delete them and Windows defender has said it partially removed the Trojan. No icons on the desktop. THE ARROW IS LOADING ALWAYS THE BLUE CIRCLE IN THE BOTTOM ICON BAR. Please resolve this issue as fast as possible

(Sprint S10 Android) Hello sorry for bothering you all again but it seems I have a different problem now too, Recently I've noticed googleads . g . doublclick . net showing up recently on my Blokada logs, I know this is a legitimate Google ad server but it just showing up from time to time isn't the problem. I've noticed it in multiple apps that either have their own ad domains or app that are opensource and I can guarantee do not have ads of any kind, yet when open spam that adress. When I dont have those apps open it tries to reach googleads about every hour despite not doing anything, and when those apps are open it spams it every few seconds. The apps I've noticed start this spam are as follows: Samsung Notes Tachiyomi ( An open source app that I can guarantee has no ads) Ebay Amazon shopping Pixiv Reddit Apps I've noticed that don't set it off: Google Play (ironically enough) Gmail Malwarebytes Blokada Newpipe Firefox VLC Media Player Medisafe FFXIV Companion I originally thought it was the apps themselves but after whitelisting them to not block ads in those apps Blokada still blocks googleads so its not the apps causing this, I dont belive. I also went to my settings and restricted background data and forced stopped all my apps except system apps and the safe apps that don't set it off. It stopped for a little bit after turning Blokada's Adguard DNS on and off (then it only tried to reach the server every hour or so) but then it came back, I tried turning it on and off again and it didn't work, it was still being spammed in those apps. I tried again right as I was righting this and it seems to have stopped again for some weird reason. Malwarebytes doesn't detect anything at all. I haven't turned off Blokada or whitelisted that adress, I'm afraid of anything happening. I'm sorry if this is too long winded or hard to understand, this is making me incredibly stressed and with the pandemic and social distancing this is the only thing I have to think about. Any help would be very appreciated, Thank You.

In Google Chrome on win 10 I cannot remove an extension for "SearchSpace" It says that my "browser is managed by your organization" which is not true at all. I own and am the sole administrator of my pc. The only 'organization' that it could remotely be referring to said he has no idea what it is and offered that it is some sort of adware... info that appears readily in a google search. Of course I went to Google who response is below but that did not work either as it said that I was not connected to a necessary domain that Group policy could not be changed. Google's response is below (see the black box response screen snip below (I had tried obvious things like uninstall download fresh chrome, use Malwarebytes, etc) I need assistance in removing this unwanted unauthorized possibly malicious bug.... Please help me... thank you in advance Hi Robert, Thank you for reaching out to Google Support. My name is Cece, and I will be further assisting you with your inquiry. If we can’t find a solution, I will collect feedback for our developers and give you any external resources that you might be able to use. From my understanding you are seeing " Managed by organization : even though your PC is your personal. I do understand your concerns you may have for this issue, and I will do everything in my power to help isolate this problem as I know how alarming it can appeal as. To resolve this issue on Windows: Download the Chrome policy remover. If you see a message saying that the type of file can harm your computer, click Keep. Right click it and select Run as administrator. Click Yes at the confirmation prompt and allow the process to complete. If you see a message saying that Windows protected your PC, click More info > Run anyway. I would also recommend that you carry out the following steps: (Windows only) Install and run the Chrome Cleanup Tool (Tell me how). Scan your computer for the unwanted software using recommended removal software: Windows: Malwarebytes, AdwCleaner, HitmanPro. Mac: Malwarebytes. Uninstall unfamiliar or suspicious extensions (Tell me how). Uninstall suspicious programs from your computer: Windows: Tell me how. Mac: Tell me how. Reset your browser settings. You can reply to this email to get back in touch with me, if you have any further questions, or concerns I can address for you. We are always here to help. Google appreciates our member's feedback. You may receive an email survey after a day or two about your recent support experience. We would love to hear from you!

I purchased a DOOGEE X5 Pro phone a while back, and while I thought the phone would be good, that wasn't the case at all. But there's a problem that I've been putting off seriously tackling until now: This phone (or the one I got at least) has a major adware problem. After a while of some use, the phone would: Randomly be redirected to malicious ad content within the default browser. Randomly display popup ads that are difficult to take off because they have a timer delay on the close/X button to close the ad, or would even temporarily disable the touch functionality of the phone. Persistent notifications labelled "[GameCenter] ...." These highly annoying ads appear within minutes of using the phone. And what about resetting the phone? It works for a while, and then goes back to doing the same thing. At first I thought it was malicious apps causing trouble, so I avoided certain apps and factory resetted it if an app turned out to be malicious. But it would seem that isn't the case as even after installing more major apps like Reddit resulted in the adware suddenly showing up. As you can see the first screenshot below, the app that brings up the adware has a chinese name that I can't recognise. In the notification bar, I circled the icon of the '[GameCenter]..." notification. As for the other screenshot, I suspect that it's the adware/malware in question, but it's installed as a system application so I can't uninstall it. For now I have Malwarebytes (Premium Trial) and Norton Mobile Security to see if it can be stopped. So far nothing has occurred, but it's only been two days (I'll probably try reinstalling other apps to see if it's triggered). After reading about the 'xhelper' malware that sounded very similar to what was happening on my phone, I thought it would be worth asking about this in forums to see if I can get some help.

Hello guys & Ladies, I don't know what happening, but in my Android device, there was virus, which spreading very fast. I did Factory reset [hard reset], still, when I turn on my WIFI, he automatically downloading and doesn't notice me, 'til Google play protector notice. Net auto-installing those apps: enginee xprotect Yeelight Citrix Secure Mail etc, etc, can't remember How do I remove them?

After bringing up www.msn.ca and viewing for a short period of time, tab is completely grabbed by another url and display having a popup; I've seen two different urls so far; they follow: https://visitormedicalinsurance.xyz/f28b2078b2c876bc56d518909c6777ed/index.html?ip=192.243.79.131&trackid=20200321231120551 https://mconsumerdefinition.xyz/f28b2078b2c876bc56d518909c6777ed/index.html (this one had an ip and track id parameters as well) After answering some user survey questions and clicking through some windows, the user selects a prize they have one (e.g., Samsung Galaxy phone) and then the user is asked to supply credit card information for shipping. Scam displays the user's service provider name and branding in the header to fool the user. Close inspection of text reveals odd, but not necessarily incorrect grammar. Scam appears very professional and could fool lots of folks. Please have a look so others are not inconvenienced or worse yet taken advantage of. I have the latest version of Malwarebytes premium installed and it did not detect this malware. Neither did my most recent version of Norton Internet Security.

So I am locked in a several day long battle with the adware Vosteran. Hasn't done what all the other articles about it say it does, like changing browser settings or showing intrusive ads. It isnt really doing anything to the pc or chrome, but I'm scared it might be collecting information in the background or might have just not been set off yet. I have reset chrome settings, used HitmanPro, Malwarebytes, RKill, and even wiped the whole PC. I am not really sure what I haven't done yet, and would really appreciate some suggestions.

untsorce.cool is on Google chrome. Ran Malwarebytes, which showed and cleared other tracking cookies. Did not show untsorce. Also ran AdwCleaner 8.0.2 and showed there were no infections. Reset Google Chrome, cleared history and cookies. Ran both programs again with same result. MB is blocking the adware but it's not removed.

O was asked to recreate the post so here it goes: Hello, everytime i run MalwareBytes it detects 9 Adwares, they are supossed to be at quarantine but everytime there are exactly those 9 again, my quarantine folder is growing exponentially because they show up again and i dont know what to do, i even reinstalled Chrome and they keep showing up. Addition.txt FRST.txt Malware scaned by MalwareBytes.txt

Ok, so I feel like I'm going insane. Like every third click on Chrome either gives me a Pop-up ( Usually something pornographic) or an add. When googling something, I receive a dozen of ads and sites which appear above what Im searching for. This is what I've tried to do thus far: *Run Adwcleaner *Run Malwarebytes ( And malwarebytes pro) *Run Spybot, and two others I dont remember the name of atm. *Boot in safe mode and repeat all of the above. *Went into Programs and Features to see if there were any programs I don't remember installing. *Checking google chrome extensions and afterwards reinstalling it. *I've tried disabling Pop-ups in Google Chrome settings, and got myself an extension called uBlock which is supposed to block pop ups. Feel like I've tried everything at this point. Please help!

Hello, everytime i run MalwareBytes it detects 9 Adwares, they are supossed to be at quarantine but everytime there are exactly those 9 again, my quarantine folder is growing exponentially because they show up again and i dont know what to do, i even reinstalled Chrome and they stay

Hi there, I have an issue that my laptop is infected with some kind of riskware.bitcoinminer and a adware, I already scanned with malwarebytes and quarantined the riskware, but after I reboot my laptop it keeps coming again. How possibly I can get rid of this thing? please help me. You can see my log. logs.txt

I've installed the recent MalwareBytes free version 4 without any realtime protection. I have turned off system tray notifications (see attached). Now I'm getting random Malwarebytes ads popping up on my desktop to buy the full program (see attached). These also do not go away without being explicitly closed. This is intrusive, unsolicited and not related to why I installed the program (I will buy when I decide to buy), and I can't disable the behaviour in settings... That covers about 80% of the characteristics of AdWare, which I find ironic at least.. Short of uninstalling the program, are there any thoughts, explanations or suggestions for this?

A few days ago I restarted my computer before a long time without re-starting it (like 1 week with the pc on) and I noticed that "Explorer.exe" was requesting to initialize, but the real explorer.exe task was already running... I said no but then I checked the directory of the file and the system said that the file was on %windir%/resources/themes, well going into folder to check if the file exists I noticed that theres nothing more than aero themes in this folder. So did a scan in the folder using malwarebytes and it recognized svchost.exe malware and explorer.exe, before adding they do quarentine I wanted to check why the files didnt apeared, so I enabled "show hidden folders" in explorer (the real one, from microsoft) and it changed nothing, well, so I tried to open the archive by going with %windir%/resources/themes/explorer.exe in the explorer path, it worked, but I still uncapable of seeing this file... So I started CMD as admin and did " cd " to %windir%/resources/themes and did " dir " inside the folder, as I expected the dir shows the same as explorer, but appeared 2 new items that the was named as " . " and " .. " I deleted both sucessfully. Searching for this in internet I found that there's an other way to hide files in windows, that was adding them to" important system files or protected system files" list, and following the instructions to disable this privilege, I finally could see the archives, well, I added them to the quarentine list and continued using my computer since yesterday that I realized that everytime malwarebytes send two addwares to quarentine (I left the results of scan in the post as "Annoying addware.txt") they come back right after I finish the task... When trying to solve these issues I realized many things... 1- I cant use commands as DISM, sfc /scannow, windows update, windows defender( I will let write happens when i try to use them bellow this part) , net start/stop wuauserv (the wuauserv service doesnt even exists in registry, I didnt checked windows defender one...) 2- there was a folder called QEMU hidden with the "important system files" method, I deleted all content Inside and then deleted the folder after taking out the folder privilegies 3- Theres two "program" files in "Inicialize" section of task manager wich I cant go to proprieties ( I dropped the print down on anexed files named as "Program" unknow files) When I try to use with /checkhealth everything go fine, but when I try to use dism with /restorehealth it stops at 87,5% and gives an error 1060 messages saying " the specified service does not exist as an installed service " ( I left the DISM log file right bellow named as DISM.txt ) When I try to use sfc /scannow it says that cannot fix all issues When i try to use windows update it says that my organizations disable windows updates ( ? ) When I try windows defender it just goes black screen on the window Well, it would be great if someone could help me, I dont really want to re-install windows... I would take a month to setup my pc again Also, I run Windows 10 Pro 64bits, version 1809... dism.log Annoying Adware.txt Rkill.txt FRST.txt Addition.txt

Hey there, on my Android phone, I've been having weird redirects to unsafe looking ("Congratulations!") sites in it's browser recently (since at the very least August 2nd). They seem to happen very infrequently, which caused me to be kind of lazy in trying to fix it. I usually browsed what I'm assuming are safe websites (can provide examples of them and the unsafe sites, not sure if I can just post those links) as the redirects occur. I tried running some anti virus scanners (including Malwarebytes, see "Screenshot_20190827-155852-edited.png" e.g.). Only Trend Micro's "Mobile Security & Antivirus" actually found something, a .crdownload file, which I removed from the phone, but am keeping on my main PC. A virustotal scan of that file. Since removing it though, the redirects still happened. I cleared my Chrome's history and cache a few minutes ago, and can report back if that changed anything (as I said, the redirects are rather infrequent). Aside from this, I have also had strange calendar entries in my Google account, similar to this. Examples of what this looks like on my end are in the attachments. The Google support post recommends setting "Automatically add invitations" to No. Doing this stops them from showing up, however I have been unable to find any emails in my inboxes that could have caused them. I searched my mails by those event titles, email address "gserviceaccount" and "(filename:ics OR filename:vcs)" for example. I'm unsure whether these two issues are related or not. Some version numbers on my phone, in case they're helpful: Android: 7.0 (I have a Huawei Honor 6X, so afaik this is the most recent Android version for it) EMUI: 5.0.3 Chrome: 76.0.3809.111 Calendar: 6.0.44-261313226-release If I could get any help with this, I'd appreciate it.

I have unwanted pups and pums, and I want to remove them without damaging anything. How? I came here first before doing anything a.txt

Long story, bear with me. I had 4 pieces of adware on this machine when I had finished the first scan with 7.0.1.0 . I kept getting 'hung' during the cleaning process. After 45 minutes of waiting I decided to kill the program and try again. And again, and again, and again no no avail. Before each scan before detection I would receive this message, (which I am still receiving). I downloaded the new build only to run into the exact same error as before. I thought the issue was fixed when i was prompted to restart my machine, (with version 7.0.1.0) when the scan had finished. However, there were no detections upon the reboot. It did find some of the adware and destroy it, as there are only two entries now, it just feels a bit weird. Again, I am still hanging on 'cleaning' right before the unhandled popup and I am running the latest build of adwcleaner. Attaching the txt file below. (Current.) AdwCleaner[S58].txt

Hi all - I keep getting the following notification that Chrome is accessing "onlinekey.biz". Happens rather frequently, each time a new page is loaded. Any thoughts? I've had no luck so far uninstalling Chrome extensions & recent programs. How do I get rid of this thing? Thank you for any help! Michael

Hello, recently I noticed I started getting popups whenever chrome was open so I ran MWB and Adwcleaner and neither found anything. But I researched it and it's the www1.ecleneue.com pop up virus. Could someone help me get this off my computer? Thank you!

Hi Chris and Maurice! As you may have noticed I am in fact not the original post-er (Chris), but I have a similar if not exact same problem I've got Malwarebytes blocking saltjs.01bd.ru and it seems to have attached itself to Chrome and a gaming program I use called "Parsec" It also appears that I've got something called Mail.ru, I'm not sure if this thing is related but I have tried multiple times to remove it with Malwarebytes As you may have sees, and as I have mentioned before, I believe this is a very similar problem to Chris's, therefor I followed the steps you (Maurice) have posted, so here is the attached log file. -Dezza mbst-grab-results.zip

I used MalwareBytes to remove the viruses that windows defender couldn't for some reason but the website blocked is still popping up.

I'm having the same issue. I've attached my log files.mbst-grab-results.zip

Hi, I have identical problems as darkgoogol and MBAR anti-rootkit tool didn't helped at all. When I'm going to any browser I get same notification about saltjs.01bd.ru and I can't log in to google account, go to malware forums and then I go to facebook my account starts to like random korean pages and posts.

I've run MalwareByte countless times but my problem hasn't solved. AdwCleaner keeps detecting 2 threats but can't remove them. I've also tried reinstalling chrome many times. Please Help.