Jump to content

Chrome Web Data PUP wont go away

TomSummers

By TomSummers
in Resolved Malware Removal Logs

 Share

Recommended Posts

TomSummers

TomSummers

Posted
Posted

So i'm sure i'm in the same boat as a lot of other people, after seeing high activity on the forums about this, but i've followed some 'solutions' and yet i'm still getting the same the same 4 files appear on the scans i'm running, i don't know whether i should be worried about this as so many other people are having the same issue i just wanted to post here so someone could  help me once a solution has been found as multiple attempts of deleting these web data files just isn't working nor is resetting my sync

 

could someone explain to me what is going on and a way to solve this so it stops happening, it'll be highly appreciated 

thanks in advance :P 

PUP.txt

Link to post
Share on other sites
TomSummers

TomSummers

Posted
  • Author
Posted

So ive managed to come up with a temporary solution, i uninstalled Chrome, went into %appdata% and made sure i removed all google folders, then scanned and nothing came up, 0 threats, nothing

im now using FireFox and im still getting nothing come up during the scans and ill probably still use firefox until some sort of solution comes about with chrome

note: i haven't reinstalled chrome to see if the issue is fixed as i don't wanna add those files back just in case, but please update me if reinstalling chrome does solve the issue, for anyone wanting to try that out

 

Ill also add the fact that when i had chrome installed, even though Malwarebytes was picking up the web data files as PUP Windows Defender was picking up anything at all, not sure if that says anything but yeah just trying to add every bit of info ive come out with this

Link to post
Share on other sites
TomSummers

TomSummers

Posted
  • Author
Posted
4 minutes ago, David-B said:

This has been happening to me too. I'm pretty sure it's a false positive.

i was thinking that but as i said im just using Fire Fox at the moment and nothing is coming up in my MB scans so until they find a solid solution im keeping chrome uninstalled and staying on Fire Fox until then

Link to post
Share on other sites
TomSummers

TomSummers

Posted
  • Author
Posted
2 minutes ago, PTG2017 said:

Finding this forum took a huge weight off my shoulders. I couldn't for the life of me figure out what was going on. So is this on Google's end or Malwarebyte's?

im not entirely sure ngl, i dont think its harmful but im currently testing a solution which is working at the moment (fingers crossed it still carrys on that way)

Link to post
Share on other sites
David-B

David-B

Posted
Posted
1 hour ago, PTG2017 said:

Finding this forum took a huge weight off my shoulders. I couldn't for the life of me figure out what was going on. So is this on Google's end or Malwarebyte's?

Well assuming that it is a false positive, and I believe it is, this is on Malwarebytes' end unless Google is distributing malware with Chrome.

Link to post
Share on other sites
Fatdcuk

Fatdcuk

Posted
Posted (edited)
1 hour ago, David-B said:

Well assuming that it is a false positive, and I believe it is, this is on Malwarebytes' end unless Google is distributing malware with Chrome.

Hi,

These are not f/p detections but we introduced new chrome fixing 2 days ago.

Chrome is not distributing malware/PUP's intentionally but its Sync service when used will save many Chrome settings/extensions/search engines that can potentially include any bad ones if you may have onboard at the time of setting up the sync service or any installed along the way with sync service active.

It is a great feature to be able to transfer your profile across multiple devices but it cant differentiate between good or bad stuff when syncing data..

The current issues with repeat detections are being caused by Chrome sync service restoring bad data that we are attempting to remove.

We are at the moment working towards a fix to the sync service issue and apologise for any alarm or inconvenience caused.

As as interim work around to stop the detection(s) then staying signed out of sync service will stop bad data being rewritten or alternatively you can temporarily set exclusions in malwarebytes for the file(s) where the detection(s) are being made.

https://support.malwarebytes.com/docs/DOC-1058

For example but your pathway for the files will be listed in a Malwarebytes scan log where the detections are made. 

C:\Users\%YOURUSERACCOUNT%\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
C:\Users\%YOURUSERACCOUNT%\AppData\Local\Google\Chrome\User Data\Default\Web Cache

 

 

 

Edited by Fatdcuk
Link to post
Share on other sites
David-B

David-B

Posted
Posted
17 minutes ago, Fatdcuk said:

Hi,

These are not f/p detections but we introduced new chrome fixing 2 days ago.

Chrome is not distributing malware/PUP's intentionally but its Sync service when used will save many Chrome settings/extensions that can potentially include any bad ones if you may have onboard at the time of setting up the sync service or any installed along the way with sync service active.

It is a great feature to be able to transfer your profile across multiple devices but it cant differentiate between good or bad stuff when syncing data..

The current issues with repeat detections are being caused by Chrome sync service restoring bad data that we are attempting to remove.

We are at the moment working towards a fix to the sync service issue and apologise for any alarm or inconvenience caused.

As as interim work around to stop the detection(s) then staying signed out of sync service will stop bad data being rewritten or alternatively you can temporarily set exclusions in malwarebytes for the file(s) where the detection(s) are being made.

https://support.malwarebytes.com/docs/DOC-1058

 

 

Thank you for the clarification. What is Malwarebytes deleting? From looking at the results of my scan, the issue is not with extensions or the remains of a malicious extension I had installed. Rather, it seems that the data that is being delete relates to cookies stored for websites or something of that nature.

Link to post
Share on other sites
Fatdcuk

Fatdcuk

Posted
Posted
5 minutes ago, David-B said:

Thank you for the clarification. What is Malwarebytes deleting? From looking at the results of my scan, the issue is not with extensions or the remains of a malicious extension I had installed. Rather, it seems that the data that is being delete relates to cookies stored for websites or something of that nature.

Hi

We rolled out fixing for startup URL, newtab, homebutton and search engines with multi profile support for all fixing.

In all theories we should not be targeting chrome cookie data but some of the settings do get backed up to WebData file.

Link to post
Share on other sites
johnmariow34t

johnmariow34t

Posted
Posted (edited)

URGENT NEWS

ATTENTION: MALWAREBYTES STAFF

I uninstalled Google Chrome then performed a scan with MalwareBytes.  Two PUP userdata malware files were detected by MalwareBytes.  I deleted them and did a MalwareBytes scan again. Four PUP userdata malware files were detected. Additionally, the appdata folder is an invisible file. I cannot delete any folder in C:/users/john/appdata/googlew/chrome/userdata .

Just now I received a warning from malwarebytes that two more PUP userdata malware files were detected.

 

 

 

Edited by johnmariow34t
more info
Link to post
Share on other sites
Aura

Aura

Posted
Posted (edited)

Hi guys,

First of all, for more explanation about why this issue is occurring, read Fatdcuk's post below.

https://forums.malwarebytes.com/topic/214438-chrome-web-data-pup-wont-go-away/?do=findComment&comment=1180550

Now, if you aren't running the latest version of Malwarebytes already (which is 3.3.1 at this time), please download and install the latest (in-place upgrade) from the website directly.

https://downloads.malwarebytes.com/file/mb3/

Alternatively, you can open Malwarebytes, go to the Settings tab, and under the Application tab, click on the Install Application Updates button. This way, Malwarebytes will look for a newer version of the program and if found, asks you if you want to install it (do so).
EEdmPfu.png

Once done, follow the instructions in the thread below and see if that solves your issue. Please note that, as stated in the thread below, these steps will most likely have to be executed on every single computer where you are logged in Google Chrome with your Google account, and where the sync feature is enabled.

https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/

If the guide above didn't help you, you can try to manually clean your Google Chrome settings, as to remove the threat Malwarebytes is detecting (the one(s) that keeps coming back). There are three main areas that you can clean: the New Tab page, the Search engine, and the On start-up (start page):

  • On the top-right corner of Google Chrome, click on the three little dots, and then click on Settings (or simply access chrome://settings from the navigation/URL bar)
  • Under Appearance and Show Home button, make sure that either New Tab page is selected, or that you know and trust the website in the second option (ex: google.com)
    yuYmo5T.png
  • Under Search engine, make sure that the Search engine used in the address bar is set to Google or another trusted search engine (such as DuckDuckGo)
    QHcKrhr.png
  • Click on the Manage search engines button, and under Default search engines, delete every other options (by clicking on the three little dots on the right, followed by Remove from list) other than Google
    lxbWHn1.png
  • You are also free to remove the search engines under Other search engines if wanted
  • Once done, go back and under On start-up, make sure that the Open the New Tab page option is selected OR, if the Open a specific page or set of pages option is selected, make sure that only knowns and trusted websites are listed. Otherwise, delete them by clicking on the three little dots on the right and select Remove
    Ef7a38z.png

Another possible solution at the moment, is to add the detected file(s) (either Web Cache, Secure Preferences or both) to Malwarebytes' scan exclusion list, so it won't get detected anymore. For more information on how to proceed, follow the instructions in the support article below.

https://forums.malwarebytes.com/topic/214438-chrome-web-data-pup-wont-go-away/

The two possible files to add are: 

C:\Users\$YOUR_USERNAME\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
C:\Users\$YOUR_USERNAME\AppData\Local\Google\Chrome\User Data\Default\Web Cache


For instance, the full path for these two files on my system would be: 

C:\Users\Aura\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
C:\Users\Aura\AppData\Local\Google\Chrome\User Data\Default\Web Cache

Let me know if any of that worked for you. If it did, let me know which solution worked. If you need assistance with the instructions above, 

 

Edited by Aura
Link to post
Share on other sites
johnmariow34t

johnmariow34t

Posted
Posted
23 hours ago, TomSummers said:

So ive managed to come up with a temporary solution, i uninstalled Chrome, went into %appdata% and made sure i removed all google folders, then scanned and nothing came up, 0 threats, nothing

im now using FireFox and im still getting nothing come up during the scans and ill probably still use firefox until some sort of solution comes about with chrome

note: i haven't reinstalled chrome to see if the issue is fixed as i don't wanna add those files back just in case, but please update me if reinstalling chrome does solve the issue, for anyone wanting to try that out

 

Ill also add the fact that when i had chrome installed, even though Malwarebytes was picking up the web data files as PUP Windows Defender was picking up anything at all, not sure if that says anything but yeah just trying to add every bit of info ive come out with this

This did not work for me. I uninstalled Windows Chrome and afterward, the PUP kept coming back. 

 

Link to post
Share on other sites
johnmariow34t

johnmariow34t

Posted
Posted
17 hours ago, Aura said:

Hi guys,

First of all, for more explanation about why this issue is occurring, read Fatdcuk's post below.

https://forums.malwarebytes.com/topic/214438-chrome-web-data-pup-wont-go-away/?do=findComment&comment=1180550

Now, if you aren't running the latest version of Malwarebytes already (which is 3.3.1 at this time), please download and install the latest (in-place upgrade) from the website directly.

https://downloads.malwarebytes.com/file/mb3/

Alternatively, you can open Malwarebytes, go to the Settings tab, and under the Application tab, click on the Install Application Updates button. This way, Malwarebytes will look for a newer version of the program and if found, asks you if you want to install it (do so).
EEdmPfu.png

Once done, follow the instructions in the thread below and see if that solves your issue. Please note that, as stated in the thread below, these steps will most likely have to be executed on every single computer where you are logged in Google Chrome with your Google account, and where the sync feature is enabled.

https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/

If the guide above didn't help you, you can try to manually clean your Google Chrome settings, as to remove the threat Malwarebytes is detecting (the one(s) that keeps coming back). There are three main areas that you can clean: the New Tab page, the Search engine, and the On start-up (start page):

  • On the top-right corner of Google Chrome, click on the three little dots, and then click on Settings (or simply access chrome://settings from the navigation/URL bar)
  • Under Appearance and Show Home button, make sure that either New Tab page is selected, or that you know and trust the website in the second option (ex: google.com)
    yuYmo5T.png
  • Under Search engine, make sure that the Search engine used in the address bar is set to Google or another trusted search engine (such as DuckDuckGo)
    QHcKrhr.png
  • Click on the Manage search engines button, and under Default search engines, delete every other options (by clicking on the three little dots on the right, followed by Remove from list) other than Google
    lxbWHn1.png
  • You are also free to remove the search engines under Other search engines if wanted
  • Once done, go back and under On start-up, make sure that the Open the New Tab page option is selected OR, if the Open a specific page or set of pages option is selected, make sure that only knowns and trusted websites are listed. Otherwise, delete them by clicking on the three little dots on the right and select Remove
    Ef7a38z.png

Another possible solution at the moment, is to add the detected file(s) (either Web Cache, Secure Preferences or both) to Malwarebytes' scan exclusion list, so it won't get detected anymore. For more information on how to proceed, follow the instructions in the support article below.

https://forums.malwarebytes.com/topic/214438-chrome-web-data-pup-wont-go-away/

The two possible files to add are: 


C:\Users\$YOUR_USERNAME\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
C:\Users\$YOUR_USERNAME\AppData\Local\Google\Chrome\User Data\Default\Web Cache


For instance, the full path for these two files on my system would be: 


C:\Users\Aura\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
C:\Users\Aura\AppData\Local\Google\Chrome\User Data\Default\Web Cache

Let me know if any of that worked for you. If it did, let me know which solution worked. If you need assistance with the instructions above, 

 

The AppData folder is an invisible folder.  The PUP will not allow any modifications to the full path. 

After uninstalling Google Chrome, the PUP still kept on appearing on my laptop.

No updates are available for MalwareBytes  3.2.2.2018.  

Your link to MalwareBytes 3.3.1 is a link to the trial version.  I don't want to replace my licensed version of MalwareBytes with a trial version. 

I have no idea what to do. What good is changing the Google settings? The PUP keeps reappearing with Google Chrome uninstalled!!

 

 

 

Link to post
Share on other sites
johnmariow34t

johnmariow34t

Posted
Posted (edited)
29 minutes ago, johnmariow34t said:

The AppData folder is an invisible folder.  The PUP will not allow any modifications to the full path. 

After uninstalling Google Chrome, the PUP still kept on appearing on my laptop.

No updates are available for MalwareBytes  3.2.2.2018.  

Your link to MalwareBytes 3.3.1 is a link to the trial version.  I don't want to replace my licensed version of MalwareBytes with a trial version. 

I have no idea what to do. What good is changing the Google settings? The PUP keeps reappearing with Google Chrome uninstalled!!

 

 

 

I just received an update to MalwareBytes 3.2.2.2018. After installing the update, I ran a complete scan and quarantined the PUP.  Then I ran the complete scan again. The PUP reappeared.

The update did not resolve the problem.

Update Package Version 1.0.3217

Component Package Version 1.0.212

 

Edited by johnmariow34t
Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.