Jump to content

Ransomeware from buy.androidcityshop.top

Recommended Posts


Thank you in advance for any assitance you can provide.  Whenever I start my computer my Malwarebytes Premium lets me know there is an outbound connection to buy.androidcityshop.top trying to take place.  IP Address  Looks like a ransomeware or malware site from my google searches.  Looks like the file that is trying to do it is C:\Program Files(x86)...ited/vpn-unlimited.exe

I'm assuming my VPN service is affected.  I have included the log, Malwarebytes scan, FRST and Addition txt files.

scan report.txt

website blocked.txt



Link to post
Share on other sites

When reading over the Addition.txt I came across the information that Windows Defender had been disabled.  I don't remember doing this.  I enabled it and ran a full scan.  Took over an hour.  I went and took a nap while it did its thing.

It found two things: a 32-bit key generator and a Trojan Clicker. Both seemed to have created a bunch of randomly named executable files in sub-directories of programs that routinely check the internet for updates.  They have been removed and we shall see if that fixes the problem.  I am changing all my passwords as we speak.

Link to post
Share on other sites

  • Root Admin

Hello @wmatt001 and :welcome:

Let's go ahead and try resetting all your browsers and see if that corrects the issue for you or not


Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Reset Chrome back to defaults to completely clear out issues with Chrome.

  • First, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
  • Scroll down until you see the  reset_chrome_sync.png "reset sync" button to clear your data from the server and remove your passphrase.
  • Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
  • Press the Windows key + R at the same time, to bring up the run dialog box.
    • run_command.png
  • Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\
  1. Press Ctrl + A to select all the files and folders.
  2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
  3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
  4. Example of all files and folders selected, except Bookmarks



Restart your computer now and make sure there are no longer any redirects or other browser issues. 


Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.