Jump to content

Adware.Elex.ShrtCln keeps returning


Nutkins
 Share

Recommended Posts

Awesome, thank you for the update Nutkins! I'm really glad that it worked out for you as well. Even though this is your thread, I'll leave it open a bit more so the other users who posted in it can see the solution and provide feedback if necessary :) 

Link to post
Share on other sites

  • Replies 79
  • Created
  • Last Reply

Top Posters In This Topic

Top Posters In This Topic

Posted Images

Hello Aura, I also followed your guide VERY CLOSELY, and nothing worked, so in a last try before adding files to  Malwarebytes' scan exclusion list
I tried this part, because I didn't think it is important:

  • You are also free to remove the search engines under Other search engines if wanted

This COMPLETELY fixed the error!

So basically it was a search engine causing the error for me. I finally got a scan with ZERO harmful results =) THANK YOU!

Link to post
Share on other sites

I close Chrome reopen Chrome redid the scan it seems like it's permanently gone happy days.  warning deleting the "threat" will break multi account link shortcuts from your desktop or wherever. Deleting the other search engine will solve this scan problem.

Edited by JAMIEX1988
Link to post
Share on other sites

This behaviour is very strange.  I have signed out of Chrome, then shut down Chrome, then removed the errant files.  I have then rebooted and opened Windows Explorer to find the files have returned, despite Chrome not being run.

Anyhow, does anyone know how to remove the Search Engines with a script or single command?  I have many, and removing them manually one at a time is taking ages.

Link to post
Share on other sites

Quote

Anyhow, does anyone know how to remove the Search Engines with a script or single command?  I have many, and removing them manually one at a time is taking ages.

 

I don't know a way to do that sadly. It might be faster to just do it manually (even though it's long) than spend time seeing if there's a way to delete all of them at once.

Link to post
Share on other sites

15 hours ago, Aura said:

Hi guys,

First of all, for more explanation about why this issue is occurring, read Fatdcuk's post below.

https://forums.malwarebytes.com/topic/214438-chrome-web-data-pup-wont-go-away/?do=findComment&comment=1180550

Now, if you aren't running the latest version of Malwarebytes already (which is 3.3.1 at this time), please download and install the latest (in-place upgrade) from the website directly.

https://downloads.malwarebytes.com/file/mb3/

Alternatively, you can open Malwarebytes, go to the Settings tab, and under the Application tab, click on the Install Application Updates button. This way, Malwarebytes will look for a newer version of the program and if found, asks you if you want to install it (do so).
EEdmPfu.png

Once done, follow the instructions in the thread below and see if that solves your issue. Please note that, as stated in the thread below, these steps will most likely have to be executed on every single computer where you are logged in Google Chrome with your Google account, and where the sync feature is enabled.

https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/

If the guide above didn't help you, you can try to manually clean your Google Chrome settings, as to remove the threat Malwarebytes is detecting (the one(s) that keeps coming back). There are three main areas that you can clean: the New Tab page, the Search engine, and the On start-up (start page):

  • On the top-right corner of Google Chrome, click on the three little dots, and then click on Settings (or simply access chrome://settings from the navigation/URL bar)
  • Under Appearance and Show Home button, make sure that either New Tab page is selected, or that you know and trust the website in the second option (ex: google.com)
    yuYmo5T.png
  • Under Search engine, make sure that the Search engine used in the address bar is set to Google or another trusted search engine (such as DuckDuckGo)
    QHcKrhr.png
  • Click on the Manage search engines button, and under Default search engines, delete every other options (by clicking on the three little dots on the right, followed by Remove from list) other than Google
    lxbWHn1.png
  • You are also free to remove the search engines under Other search engines if wanted
  • Once done, go back and under On start-up, make sure that the Open the New Tab page option is selected OR, if the Open a specific page or set of pages option is selected, make sure that only knowns and trusted websites are listed. Otherwise, delete them by clicking on the three little dots on the right and select Remove
    Ef7a38z.png

Another possible solution at the moment, is to add the detected file(s) (either Web Cache, Secure Preferences or both) to Malwarebytes' scan exclusion list, so it won't get detected anymore. For more information on how to proceed, follow the instructions in the support article below.

https://forums.malwarebytes.com/topic/214438-chrome-web-data-pup-wont-go-away/

The two possible files to add are:


C:\Users\$YOUR_USERNAME\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
C:\Users\$YOUR_USERNAME\AppData\Local\Google\Chrome\User Data\Default\Web Cache


For instance, the full path for these two files on my system would be:


C:\Users\Aura\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
C:\Users\Aura\AppData\Local\Google\Chrome\User Data\Default\Web Cache

Let me know if any of that worked for you. If it that, let me know which solution worked. If you need assistance with the instructions above, 

 

AWESOME. THANKS. This fixed my problem

Link to post
Share on other sites

I found that I had to make sure the all the "other search engines" were deleted on each computer before I sign back into the sync. After a while I look back at the other search engines and notice a few sites have been added, but luckily malwarebytes does not have a problem with them. I did a little research on "other search engines" and found this site that explains it and suggest an addon to block them if you want.

 

 

Edited by Dashke
Link removed
Link to post
Share on other sites

Hi Nezzo :)

Malwarebytes is currently working on fixing this issue. Basically, Malwarebytes is able to clean that threat just fine (and replace the offending content in the Web Cache and Secure Preferences files), but the Google Chrome sync feature keeps overwriting them as soon as you open Google Chrome. So they're trying to see if they can circumvent that, and make Google Chrome see the changes in these files as legitimate so Google Chrome doesn't sync back the malicious settings.

Link to post
Share on other sites

I was in the same trouble.

I followed the instructions  at the bottom of this page

but I had no result.

Finally i foud the locations of files 

for my pc  it was " Fujtsu\appdata\local\Google\Chrome\user data\default ....."

and I renamed the files to:

Securea Preferences_old

Web Deata_old

So now I had no more  alarm from Malwarebytes.

My question 

I would link again my google profile and I have to Sync again, shall i return to the first point? (in Italy we call it "Goose play")

thank to all for this Thread.

 

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.