Help with malware deloton.com blocked

[A2B]

Facing exactly the same issue on Chrome........Endless redirects and Deloton pop ups......Scanned through Hitmanpro & Adwcleaner & Malwarebytes & Unhackme.....They all give a clean chit yet when I browse I face redirects and pop ups......tried uninstalling Chrome, deleted history and cookies but still it is there.....No extensions on chrome except for Google Docs, Sheets, Slides, Google Docs offline & Avast online security.....Don't think any of these extensions is a suspect......

 

The question is that if Malwarebytes can block a website or stop deloton redirects during browsing why doesn't it locate it during system scan and fix the problem there?

[AdvancedSetup]

Hello @A2B

Due to various configurations in different browsers and how Sync works sometimes you can't just brute force clean the browser. Let me have you try the following and let me know.

 

Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Firefox
Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• First, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the run dialog box.
  • 
• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks

 

Restart your computer now and make sure there are no longer any redirects or other browser issues. 

 

[A2B]

Thanks for your help mate.....I am mostly using Chrome but have IE installed too.....Will uninstall IE and will follow your instructions to cleanup Chrome....Hopefully the nasty popups will now disappear.....Will update soon.......

[AdvancedSetup]

IE cannot be uninstalled. Just needs to be reset is all like the other browsers.

Ron

 

[A2B]

Update:

As per above instructions I reset chrome....Booted and as soon as I started browsing, Malwarebytes slide came up saying it had stopped deloton.com ......so I guess the problem is persisting.

 

However I had forgotten to reset Internet Explorer and then promptly did it & rebooted.

Now I'd wait to see if the popups are still present....Will update again

[AdvancedSetup]

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[A2B]

Here are all the attachments.....Once again thanks for helping me.

FRST.txt

Addition.txt

Malwarebytes Deloton Scan.txt

AdwCleaner[S0].txt

[AdvancedSetup]

Please uninstall the following software from Control Panel, Programs, Add/Remove

JavaFX 2.1.1

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

 

fixlist.txt

Thanks

Ron

 

 

[AdvancedSetup]

Okay, getting late for me so I'm going to head out. Check back on you again sometime tomorrow.

If it still happens, try resetting Firefox again and let me know.

Ron

 

[A2B]

Just wanted to let you know that when I first ran the FRST.exe it was not on desktop but in some folder inside C.

 

So should I bring the FRST.exe on the desktop alongwith the fixlist.txt or should I take the fixlist.txt to the same folder where FRST.exe is sitting?

 

Sorry but being a noob I just wanted to ask.

[AdvancedSetup]

It can run from any location as long as both files are in the same folder. It's often easier, better if run from the desktop but it will run from another location.

 

[A2B]

Done and as per instructions uploaded Fixlog.txt......Too early to say if the issue has resolved but will update as soon as I can see anything amiss or not amiss......FYI I don't have Firefox installed anymore....I uninstalled it but still have Mozilla Firefox folder in Program Files.....Did you want me to delete that?

 

Thnx

Fixlog.txt

[A2B]

Sorry to say but the Malwarebytes slide just popped up with the warning that Deloton.com page has been stopped. :-(

[AdvancedSetup]

Please post the protection log showing the block. If it's still from Firefox then we'll probably need to do a manual removal process.

Ron

 

[A2B]

I am attaching the last report....I hope this is what you want me to post.

Malwarebytes.txt

[AdvancedSetup]

Okay, please follow the instructions from this post exactly and let me know if that fixes it or not

 

[A2B]

Followed the instructions exactly as per post above....Didn't enable sync yet and there was a page that got blocked by Malwarebytes.

The report is attached for your perusal. Thx.

still malwarebytes.txt

[A2B]

Just now got another slide blocking a page....Report is attached.

1347 4DEC17 Malwarebytes.txt

[A2B]

...and now again another block.....

 

1354 4DEC Malwarebytes.txt

[AdvancedSetup]

Are you getting this block from the same web page or from different pages you happen to be on?

If you get it out of the blue on different pages then save / export your bookmarks to a folder location outside of the Chrome folder structure. Then uninstall Chrome. Do not reinstall it, just reboot. If it alerts or prompts to reinstall don't let it. Use IE or Firefox for now.

Then run the FRST program again and attach both new logs for me. I'll help you fully remove Chrome sometime tomorrow.

Thanks

Ron

 

[A2B]

I mostly surf 4-5 websites from which I get these blocked notifications.

Saved Chrome bookmarks>Uninstalled Chrome>Restarted system>Using IE for now which in itself is a pain as it uses 40% CPU power in 4-5 tabs>Ran FRST>

Attaching 2 files newly created by the latest FRST scan.

In the 10 minutes or so of surfing on the IE haven't encountered any blocks yet but I cannot survive using IE. It's awfully slow.

Addition.txt

FRST.txt

[AdvancedSetup]

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

[A2B]

Done....now attaching Fixlog.txt

 

Thanks

Fixlog.txt

[AdvancedSetup]

Okay, Please run the following for me. If both come back clean then go ahead and reinstall Chrome again.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

 

Thanks

Ron

 

[A2B]

Done......Ron......Found nothing...but then nothing was ever found in these even when the infection was there......Will install Chrome again and then report back here....

 

Should I turn on sync in chrome yet or not?

1705 5Dec Malwarebytes.txt

AdwCleaner[S1].txt