N65Adserv.com

[Curmudgeon10]

I've reviewed the EXTENSIVE actions needed to remove this stuff, including one on one analysis by an expert at Malwarebytes of various log and diagnostic files, but before I travel down the road, I am curious as to why Malwarebytes Premium doesn't detect this malicious adware on scan.  I do get the annoying popups alerting me to its presence and that it has been blocked, but scan shows no threats.  It apparently has only latched onto Edge on my PC, with Firefox being clean.

So how come Scan doesn't find it?

 

[Maurice Naggar]

Hello and welcome.

This is a ad fraud pest.  Obviously you are seeing the block notice messages.

This pest can be cleaned up.

Restart Windows into Safe mode, or Safe mode with Networking.   Starting in Safe mode how-to see https://www.computerhope.com/issues/chsafe.htm

Then run a Threat scan with rootkit scanning.

Making sure to Review the results, insuring all detected lines are ticked, and click Quarantine.

• Open Malwarebytes.
• Click the Settings menu followed by the Protection tab.
• Scroll down to Scan Options and turn the Scan for rootkits setting on.
• Next, click the icon button at left marked SCAN
  Then be sure Threat Scan is selected.
• Click Scan Now.
• If threats are detected, ensure all items are  checked at the end of the scan and click Quarantine Selected.
• If you are prompted to restart, click Yes.
• Upon completion of the scan or after the reboot, click the Export Summary button.
• Click Text File (.txt).
• Click Desktop in the sidebar on the left.
• Give the report a file name and click Save.
• Click OK followed by Close.
• Attach the report (found on your Desktop) in your next reply.

 

Thank you.

[Curmudgeon10]

OK, did as you instructed.  Please note: in  my version of MalwareBytes Premium, there are three choices for Scan: Threat, Custom, and a third (forget the name, perhaps it is "Express Scan").  In Custom only can one select rootkits as a scan feature.  If you run "Threat Scan" per your instruction, rootkits are not scanned according to the progress icons I observed during that scan.

I ran both a Custom scan with rootkits selected, and a Threat Scan.  I've attached both reports that were generated as a result.  Neither scan detected a threat on my PC.

I still get pop up warnings (and associated ads) with n65adserv.com.Custom Scan.txt

 

Threat Scan.txt

[Maurice Naggar]

@JRF99

Hi.  This thread is only just for the original thread author, Curmudgeon10.   I must ask you to stick only to your own thread, I am going split off your 2 posts, so you will have your own separate thread.

This is the malware removal section of our forum.  This thread are one-to-one.   Not a group thing.

Thanks.

[Maurice Naggar]

This thread is only for Curmudgeon10.   All others, if you have a malware issue or a program issue, please start your own Thread topic.  Thanks.

 

@Curmudgeon10

This is a good scan.   Did you do it in Safe mode?   Just want to be filled in.

 

You should now be in normal mode.  Then I would ask for a new scan.    { Yes, you can always manually make sure rootkit scan is on}.

• Open Malwarebytes.
• Click the Settings button.
• Then click the Protection tab.    < ----  !
• Scroll down to Scan Options 
• NOW  turn the Scan for rootkits setting on.     <----- !
•  
• Next, click the button at left marked SCAN
• Look at the 3 panes.   One of them is THREAT scan
• ( click the Close X if the display screen is on the previous summary).   Need to get to screen that has sub-options.
• 
  Then be sure Threat Scan is selected by clicking that.
•  
• Click Scan Now.
• If threats are detected, ensure all items are  checked at the end of the scan and click Quarantine Selected.
• If you are prompted to restart, click Yes.
• Upon completion of the scan or after the reboot, click the Export Summary button.
• Click Text File (.txt).
• Click Desktop in the sidebar on the left.
• Give the report a file name and click Save.
• Click OK followed by Close.
• Attach the report (found on your Desktop) in your next reply.

 

NOTES:  If nothing is found, that is great.  The block notice messages are courtesy ones advising you visually that the pc is protected.

Lets first finish this new scan and relay the results.    Thank you.

[Curmudgeon10]

The prior two .txt files I sent were the results of scans in SAFE Mode.

"NOTES:  If nothing is found, that is great.  The block notice messages are courtesy ones advising you visually that the pc is protected. Lets first finish this new scan and relay the results.    Thank you."

Completed.  A couple of questions.

1) If nothing is found, then there is no "infection."  Yet something in Microsoft Edge is trying to communicate with N65adserve.com, and this generates the blocking notification that pops up.  Is there a way for the blocking to continue, but to suppress the pop up notification?  It is more than annoying. 

2) The .txt report for the scan I ran shows "rootkits disabled."  I triple checked the settings for this, and confirmed I had "rootkits on."  When the scan executes, there is no progress icon for rootkits, as there is when one executes the Custom Scan vs. Threat Scan.  If rootkits are switched "On," why does not the Threat Scan progress bar not show that they are being looked for?

Normal Mode Threat Scan.txt

 

[Maurice Naggar]

First, we are not done yet.

And if the 2 scans, as you said, were in Safe mode, I would like for you to do a new Threat scan ( like I outlined before) in Normal mode.   ok?  Lets go back and restart into Normal mode of Windows.  Lets also get fresh logs and reports.

Then lets have a copy of that scan log.   I will also help you on the rootkit scan setting.

Further, lets make sure we get the following set of reports.  They do not take long to do.  They are reports only.  They can well shed light on what all may be going on.

Plus the history reports are very important for review.

What you are seeing here is our program is stopping the attempts  to show  tons of ads from n65adserv.  The ads are being stopped by the web protection from appearing on the browser.

1. Please get & SAVE Farbar Recovery Scan Tool (FRST)   and later run it to get logs
   1. Download FRST and save it to your desktop
      Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
   2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
   3. Press the "Scan" button
   4. This will product two files in the same location (directory) as FRST: FRST.txt and Addition.txt
      • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
2. Create and obtain an mb-check log
   1. Download MB-Check and save to your desktop
   2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
   3. This will produce one log file on your desktop: mb-check-results.zip
      • This file will include the FRST logs generated from the previous set of instructions
      • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

We will be doing other procedures after I have a chance to review these.

Thank you.

[Curmudgeon10]

I am going to execute Steps 1 and 2, and forward the results.  Please note that I have now sent you THREE scan reports --- TWO in Safe mode, and the last carried out in Normal Mode just as you asked for.  See it's hyperlink right next to the screen shot I made of the Protection tab Options in my last post.  I'll post again after obtaining the MB-Check and FRST logs.

[Curmudgeon10]

I downloaded FRST64.exe and executed.  I was presented with this:  Now what?  Observation: the site where you obtain FRST64.exe seems CHOCK FULL of software that sneaks into your computer if you accidentally hit the wrong download button.

[Maurice Naggar]

That prompt screen is from the Windows Smartscreen.    That is normal and expected.  Please notice that line that says "More info"

 

click line  More info   on that screen and click button Run anyway  on next screen._
Click YES when prompted by Windows U A C prompt to allow it to run.

Approve the Windows’ UAC prompt  by clicking on Continue or Yes.

I look forward to getting all reports.   Thank you.

[Curmudgeon10]

Here is the Mb-check-results.zip results zip file.

[Maurice Naggar]

Thanks for sending the file.

The block notices are occurring while Edge browser is open.  Do you recall or have you written down websites are being visited when the block message happens ?

It may well be that one of those websites might have a corrupted ad-network setup that is trying to push lots of ads.

 

I am going to suggest 2 things.  One to empty out the cache files in Edge.   Then to run our anti-rootkit just as a second check.

I am sending a custom Fix script which is going to be used by the FRST64 tool. They will both work together as a pair.

Please RIGHT-click the attached file  FIXLIST and select SAVE AS   and save it directly ( as is) in the same general location as where you have FRST64

save to the DESKTOP

 

NOTE: Both   FRST64.ex   and the fixlist.txt must be in the same location or the fix will not work.

Double click FRST64 to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
Click the Fix button just once, and wait.

PLEASE have lots and lots of patience when this starts.  You will see a green progress bar start. Lots of patience. Some machines take longer than others.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt ) in the same location from where it was run. Please attach the Fixlog.txt    in your next reply.

 

{ B }

Please download Malwarebytes Anti-Rootkit (MBAR)  and save it to your desktop,
from here  
 

•Be sure to print out ( if possible) and follow the instructions provided on that same page.

First,  exit Malwarebytes Anti-Malware  if it is running real-time protection. You can do so via the notification area icon near the clock. Right click on the blue-color MBAM icon , and select  QUIT Malwarebytes.
 

•Double-click on the MBAR file you downloaded and approve the UAC prompt.
•Click **OK** on the next screen, to allow the package to extract the contents of the file to its own folder, mbar.
•mbar.exe will launch automatically. On some systems, this may take a few extra seconds. Please be patient and wait for the program to open.
•After reading the Introduction, click '**Next**' if you agree.
•On the Update Database screen, click on the '**Update**' button.
•Once you see 'Success: Database was successfully updated' click on 'Next'.
•Click the '**Scan**' button.

With some infections, you may see two messages boxes.
  1.'Could not load protection driver'. Click 'OK'.
  2.'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.

•If malware is found, do **NOT** press the Cleanup button when the scan completes. Click EXIT.
Then, please send the following logs as attachments to your reply. These logs are located in the mbar folder on your desktop where the tool extracted itself to.

mbar-log-2017-12-xx  (xx-xx-xx).txt** (where xx-xx(xx-xx-xx) is the date and time of the scan)
+ also
system-log.txt

I need to have both of those files attached in your next reply.  Thanks.  Send even if nothing is reported as detected. Always send these.

 

Restart Malwarebytes program when finished.

Thank you.

FIXLIST.TXT

[Curmudgeon10]

14 hours ago, Maurice Naggar said:

The block notices are occurring while Edge browser is open.  Do you recall or have you written down websites are being visited when the block message happens ?

I only use Edge to visit ONE site: the Washington Post.com site.

I cleared the Edge cache.

I'll run the other procedures, but I have house guests soon and it may take a day or two before I get back to you.  Thanks so much for sticking with this!

 

[Curmudgeon10]

Just now, I noticed the pop up warning for N65adserve.com did NOT refer to edge, but my main browser, Firefox.  I clicked on "add a web exclusion for N65adserve.com.  About two minutes later, I got a new pop up warning from MB:

[Maurice Naggar]

Please go back and undo that lat "exclusion" that you had done.   Just let the block message box expire  ( they time out and close themselves).

You only want to have a exclusion if you know for certain  that the IP / link address is known to you to be safe.

Start the program.

Click Settings button.  Click Exclusions tab.

Find the line for cpm.mobipromote.com

and then put a tick  ( check mark) on that line by clicking the box at left and then click the button Remove exclusion

 

The block notice-box is the program visually advising you that it is protecting your pc.  If you choose to exclude, you nullify the web protection for that link.

[Curmudgeon10]

I undid the exclusion per your request.

I executed the steps in your post of Tuesday at 6:20 AM:

1) Emptied the Edge cache

2) Downloaded the custom FRST script, and ran the FRST64 tool, generating Fixlog.txt

3) Downloaded  Malwarebytes Anti-Rootkit (MBAR) package

4) Closed MalwareBytes program

5) Extracted files from Malwarebytes Anti-Rootkit (MBAR)

6) The three log files generated from FRST and MBAR are attached.

7) The only anomaly noticed was that after the FRST64 program executed, my PC did not restart on its own after five minutes of a spinning progress icon with "Restarting" showing.  I shut the power down and restarted manually.

Fixlog.txt

mbar-log-2017-12-21 (15-05-06).txt

system-log.txt

[Maurice Naggar]

Thank you for the reports.   Those are good results.

Tell me, how is the situation now ?

Have you see any block message notices over the past couple of days ?

specifically anything with n65adserv ?

[Curmudgeon10]

It's been several days, and no pop ups!  I think I am cured.

Can you briefly explain how this was accomplished?  Many thanks.

 

[Maurice Naggar]

That is good to know.   Thanks.

As to your question, if you mean how did this pest first appear, it is most usually when you grab "freebies" off the web and install them, that they are also carrying adwares.

Or else when using a web browser and viewing some site that happens to have malvertising.

 

Let me know if you are ready to wrap this up.

[Curmudgeon10]

No, my question had to do with what action that I took (at your direction) that resulted in the removal.  Was it MBAR?

[Maurice Naggar]

It was not the MBAR  ( which had fond nothing by the time it was run).  I rather think, it was more to do with emptying out the cache in the web browser.

H T H

Is there anything else you need help with ?  otherwise, we should think about calling this a wrap.

 

[Curmudgeon10]

Thanks.  As far as cache emptying goes, I had emptied it before we started this string, and it had had no effect.

I consider the case closed.  Many thanks.

 

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread.

Thanks

 

[Maurice Naggar]

You are welcome.

You may delete the tools I had you download and use.
FRST64.exe
FRST.txt
Addition.txt

Fixlist.txt
MB-CHECK.exe
mb-check-results.zip
mb-check-results.txt

mbar.exe

mbar-log-2017-12-xx

system-log.txt

 

Tip:  Pay close attention when installing 3rd-party programs.  Most especially the "freebies".    It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed.
Take great care in every stage of the process and every offer screen, and make sure you know what it is you're agreeing to before you click "Next".

 

Best wishes for the new year.