Access Denied Posted November 14, 2017 ID:1182784 Share Posted November 14, 2017 Yontoo is being detected in Chrome. I have followed the threads here on removal, including disabling sync. After a reboot with sync off it is still being detected. I have cleared the home page and search engine stuff as well. Yontoo is not on my PC. I am going crazy here. Link to post Share on other sites More sharing options...
Access Denied Posted November 14, 2017 Author ID:1182789 Share Posted November 14, 2017 (edited) I have disabled sync, cleared all search engines, set no home page (default new tab page). Scanned, MBAM detected and quarantined. I rebooted. New scan same detection. I let MBAM remove and rebooted again. Same thing detected after the 2nd reboot. This only started after a definition update. I think it is a false positive. Edited November 14, 2017 by Access Denied Link to post Share on other sites More sharing options...
Aura Posted November 14, 2017 ID:1182798 Share Posted November 14, 2017 Hi Access Denied Did you remove everything under "Other search engines" as well, or not? Link to post Share on other sites More sharing options...
Access Denied Posted November 14, 2017 Author ID:1182799 Share Posted November 14, 2017 (edited) Finally after 5 reboots and cleaning, I took the liberty of just deleting all the files it said were infected, myself. Now after a scan it says clean. Unbelievable. Yes I had removed everything. Completely removed my user and sync. I am running another scan to make sure. Then I will login to Chrome and set all my sync back up before yet another scan. I will report back after this. Edited November 14, 2017 by Access Denied Link to post Share on other sites More sharing options...
Aura Posted November 14, 2017 ID:1182801 Share Posted November 14, 2017 Now, if you log back in Google Chrome, do you still have all your extensions, bookmarks, etc.? Link to post Share on other sites More sharing options...
Access Denied Posted November 14, 2017 Author ID:1182805 Share Posted November 14, 2017 Another clean scan. All my bookmarks are here. My extensions were all removed by deleting those files. I only had a couple of them anyway. Adguard and Roboform. I will just reinstall these. All saved passwords and other stuff were saved. Link to post Share on other sites More sharing options...
Aura Posted November 14, 2017 ID:1182808 Share Posted November 14, 2017 Awesome then! Anything else, or that was it? Link to post Share on other sites More sharing options...
Access Denied Posted November 14, 2017 Author ID:1182810 Share Posted November 14, 2017 I ran one last scan after getting Chrome all set back up the way I keep it. Clean scan thank god. I never had Yontoo as I ran a couple other scanners that are top notch paid apps as well. There is something wonky with google sync and MBAM. But alas, all is well. Thank you for coming to help so fast. Back to loving my lifetime license and enjoying MBAM protection. Link to post Share on other sites More sharing options...
Aura Posted November 14, 2017 ID:1182814 Share Posted November 14, 2017 Hundreds (almost a thousand) of detections were added last week in Malwarebytes for Google Chrome. That explains why it is picking up your Google Chrome Secure Preference and Web Data files now. The issue is that Malwarebytes correctly clean the files and removes the offending entries (Yontoo), but with the way Google Chrome sync works, as soon as you open Google Chrome, the malicious entries are added to both files again, and Malwarebytes will flag the files once more. The issue is being worked on and a fix should be going live soon. And no problem Access Denied, you're welcome! Stay safe Link to post Share on other sites More sharing options...
Aura Posted November 14, 2017 ID:1182815 Share Posted November 14, 2017 Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts