Ditch67 Posted June 6, 2018 Author ID:1248425 Share Posted June 6, 2018 Now when I click the link it goes to the same blank page, just without the pop-up warning. Should I just assume when pages won't load (when I click on any links) that Malwarebytes blocked them? Link to post Share on other sites More sharing options...
Ditch67 Posted June 6, 2018 Author ID:1248447 Share Posted June 6, 2018 (edited) Is it possible (I know nothing of this) that it's all signals being sent at me thru my router from outside, changing the page I'm on... and so I don't have malware on my system? Edited June 6, 2018 by Ditch67 Link to post Share on other sites More sharing options...
Ditch67 Posted June 6, 2018 Author ID:1248453 Share Posted June 6, 2018 (edited) Managed to cap this, despite only having a second after clicking the mini-pop-up. (It can't be brought back up despite hitting back on the browser) Edited June 6, 2018 by Ditch67 Link to post Share on other sites More sharing options...
nasdaq Posted June 7, 2018 ID:1248568 Share Posted June 7, 2018 Hi, Was Chrome open when you got this message? Your copy of Chrome has been compromised Remove Chrome from your Computer and reinstall a fresh copy later. Before you remove Chrome Export your Bookmarks Chrome will export your bookmarks as a HTML file, which you can then import into another browser. How To: http://ccm.net/faq/31791-how-to-backup-your-google-chrome-bookmarks If you sync you account you must remove it before you save your bookmarks etc... Delete Your Google Chrome Browser Sync Data if you sync with other defices. <- Important ...https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/ Clear your Chrome cache and cookieshttps://support.google.com/chromebook/answer/183083?hl=en Remove Chrome using the the instructions on this page.https://support.google.com/chrome/answer/95319?hl=en Re-install Chrome and the Bookmarks. ==== If the problem is also with Edge or Firefox let me know. Link to post Share on other sites More sharing options...
Ditch67 Posted June 7, 2018 Author ID:1248643 Share Posted June 7, 2018 Yes. Chrome was opened to Facebook at the time. I should note that my laptop is wired directly to the router. (Other devices in the house are iPads using the WiFi and have had no problems.) Am spending today using my laptop with just WiFi to see if the direct connection is what's leaving me open to attacks. If Chrome gets a pop-up on wifi, I will immediately delete and reinstall it. Will let you know how it goes. Link to post Share on other sites More sharing options...
Ditch67 Posted June 7, 2018 Author ID:1248646 Share Posted June 7, 2018 My guess failed. westerndigitalmeasure.com got thru again. Can Malwarebytes block that domain? Will now re-try deleting Chrome. Link to post Share on other sites More sharing options...
Ditch67 Posted June 7, 2018 Author ID:1248652 Share Posted June 7, 2018 Virus pop-up came back within 1 minute. I had not signed into google or anything. It should've had no way to synch. Same kind of deal as in post #53. I did restore my favorites from the html file Chrome created. No idea if viruses can hide in that. Link to post Share on other sites More sharing options...
Ditch67 Posted June 8, 2018 Author ID:1248763 Share Posted June 8, 2018 Deleted Chrome for now. Not a fan of Edge. Edge hasn't hit an ad recently, but task manager (like with Chrome) shows the CPU run to 100%. At that point Chrome forced me to an ad page, but Edge tends to reboot the page I was already on. At least lately. Is there a loophole in java that overloads a game and forces a page change? Link to post Share on other sites More sharing options...
nasdaq Posted June 8, 2018 ID:1248809 Share Posted June 8, 2018 Hi, Please run the Farbar program, his scan and post the FRST log for my review. Need to find out what is left of Chrome. Link to post Share on other sites More sharing options...
Ditch67 Posted June 8, 2018 Author ID:1248942 Share Posted June 8, 2018 Note that Arc Chat restored itself. Which is fine. It's for voice during a legitimate game I play. The capture is of Edge starting to use vast amounts of memory and CPU. I don't think it does that for other people playing Words with Friends on Facebook. It spikes for no reason, when I haven't touched it. 3.7GB of ram and up to 100% CPU use is insane, right? No other pages are open. No other programs running. FRST6-8.txt Addition6-8.txt Link to post Share on other sites More sharing options...
nasdaq Posted June 9, 2018 ID:1249086 Share Posted June 9, 2018 Hi, I know that you have reset the Edge browser. Reset, Repair or Reinstall Edge browser in Windows 10http://www.thewindowsclub.com/reset-microsoft-edge-browser-to-default-settings-in-windows-10 Please try to repair it, if does not solve your program Reinstall it. Link to post Share on other sites More sharing options...
Ditch67 Posted June 9, 2018 Author ID:1249138 Share Posted June 9, 2018 Have reinstalled Edge. It says "Something went wrong, but we resolved it Microsoft Edge couldn't start properly, so we had to clear some data to get you back to browsing the web." It retained passwords. I have not imported the Favorites yet. Would note to people that "Get-AppXPackage -AllUsers -Name Microsoft.MicrosoftEdge | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml" -Verbose}" Can NOT be entered while in Safe Mode. "Get-AppXPackage : This service cannot be started in Safe Mode This service cannot be started in Safe Mode At line:1 char:1 + Get-AppXPackage -AllUsers -Name Microsoft.MicrosoftEdge | Foreach {Ad ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Get-AppxPackage], Exception + FullyQualifiedErrorId : System.Exception,Microsoft.Windows.Appx.PackageManager.Commands.GetAppxPackageCommand" Despite the instructions: You have to resume normal mode, then use it, then reboot. Would also note that I found a Google folder (odd since we deleted Chrome). It contains the folders "CrashReports" and "Software Reporter Tool". I found this because another user messaged me about having the same Chrome problems where she ended the Task "process_reporter_tool" and that cleared it up. I've kept the files from it, if you'd like to see them... let me know. Am keeping an eye on Edge for now. Have not reinstalled Chrome. Link to post Share on other sites More sharing options...
Ditch67 Posted June 9, 2018 Author ID:1249152 Share Posted June 9, 2018 Edge hasn't show a pop-up yet, but during Words With Friends it went up to 4.1GB of RAM and 100% CPU usage. As I type this it's using over 3GB of RAM. Reminds me of what I've read about bitcoin mining viruses. Link to post Share on other sites More sharing options...
Ditch67 Posted June 10, 2018 Author ID:1249165 Share Posted June 10, 2018 (edited) Okay, total failure. Attached things... As usual just running Edge, Words with Friends and watching Task Manager. I see "phobos.exe" now in my tasks. That's bad, right? … unless someone named a file after a virus. Edgehj.txt Edited June 10, 2018 by Ditch67 Link to post Share on other sites More sharing options...
nasdaq Posted June 10, 2018 ID:1249237 Share Posted June 10, 2018 Hi, It's either a Syncing issue with Edge or the Malwarebytes Notification is On. First Edge. Stop the Syncing.https://www.tenforums.com/tutorials/36286-turn-off-sync-favorites-reading-list-microsoft-edge.html When done restart the computer normally. It that was the issues it will stop. === Change the setting Show Malwarebytes Notifications to Off https://content.invisioncic.com/Mmalware/monthly_2018_05/2018-05-22_10-28-24.png.a3502457b1398cbb8a3d56e78531dcbd.png === If the problem persists I suggest you start a new topic in the Malwarebytes 3 Support Forumhttps://forums.malwarebytes.com/forum/41-malwarebytes-3-support-forum/ An expert will be able to help you with MBAM. Explain your problem with Edge. I will keep this topic open for 6 days. Link to post Share on other sites More sharing options...
Ditch67 Posted June 10, 2018 Author ID:1249274 Share Posted June 10, 2018 Oddly you have to turn the Computer's setting Sync to On in order to turn the Edge's Syncing Off. (Otherwise it's locked and greyed out.) … It's now off. Malware Bytes was already set with the Notifications switch Off. I will report results here for information's sake. (I'm guessing Chrome is unsalvageable, then.) Link to post Share on other sites More sharing options...
nasdaq Posted June 11, 2018 ID:1249410 Share Posted June 11, 2018 Hi, (I'm guessing Chrome is unsalvageable, then.) Try this again. Remove Chrome from your Computer and reinstall a fresh copy later. Before you remove Chrome Export your Bookmarks Chrome will export your bookmarks as a HTML file, which you can then import into another browser. How To: http://ccm.net/faq/31791-how-to-backup-your-google-chrome-bookmarks If you sync you account you must remove it before you save your bookmarks etc... Delete Your Google Chrome Browser Sync Data if you sync with other defices. <- Important ...https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/ Clear your Chrome cache and cookieshttps://support.google.com/chromebook/answer/183083?hl=en Remove Chrome using the the instructions on this page.https://support.google.com/chrome/answer/95319?hl=en DO NOT REINSTALL IT JUST YET. Restart the computer normally. === Please download, install and Run Revo Uninstaller (Freeware) from here. Run Revo Uninstaller and select CHROME Click Uninstall icon and follow the prompts When finished choose Scan Delete all the highlighted Registry items Click Next Select all the folders and files listed by Revo Click Delete Reboot the computer when Revo is finished. === Now reinstall Chrome. Re-install Chrome and the Bookmarks. ==== How is it now? Link to post Share on other sites More sharing options...
Ditch67 Posted June 14, 2018 Author ID:1250222 Share Posted June 14, 2018 (edited) I've given up on Chrome and installed Firefox. Keeping Edge (not like people have a choice there). Unfortunately, since yesterday, Words with Friends for Facebook will not load on either browser. Any chance Malwarebytes did this? I only ask because they once blocked Candy Crush on Facebook and only allowed it thru after I wrote to them. (Installed Revo. Chrome is not listed as being found.) Edited June 14, 2018 by Ditch67 Link to post Share on other sites More sharing options...
nasdaq Posted June 15, 2018 ID:1250393 Share Posted June 15, 2018 Hi, You should report the problem to Facebook. https://www.facebook.com/help/186570224871049/?ref=u2u Link to post Share on other sites More sharing options...
Ditch67 Posted June 17, 2018 Author ID:1250701 Share Posted June 17, 2018 Rats.... At http://upnorthlive.com/news/nation-world/federal-judge-jails-ex-trump-campaign-chair-paul-manafort-ahead-of-trial I got another hijack attempt on Edge. Is westerndigitalmeasure.com a legitimate address/company? If all it does is try to breach security, why can't it be shut down? Also, does my computer have a virus, or are regular websites and their legitimate ads being tampered with? Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 6/16/18 Protection Event Time: 9:21 PM Log File: ca253422-71cc-11e8-91b4-509a4cc94828.json Administrator: Yes -Software Information- Version: 3.5.1.2522 Components Version: 1.0.374 Update Package Version: 1.0.5512 License: Premium -System Information- OS: Windows 10 (Build 17134.112) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Category: Hijack Domain: westerndigitalmeasure.com IP Address: 192.241.254.144 Port: [53773] Type: Outbound File: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (end) Link to post Share on other sites More sharing options...
nasdaq Posted June 17, 2018 ID:1250777 Share Posted June 17, 2018 Hi, Domain: westerndigitalmeasure.com IP Address: 192.241.254.144 The IP address 192.x.x.x is coming from your Computer. Not fiound in your logs. ---- Reset your router. It may be infected. How to Reset a Router Back to the Factory Default Settingshttp://www.ehow.com/how_2110924_reset-back-factory-default-settings.html Then, please reconfigure it back to your preferred setting.. Below is the list of default username and password, should you don't know it http://www.routerpasswords.com/http://www.phenoelit-us.org/dpl/dpl.html === Reset for Linksys, Netgear, D-Link and Belkin Routershttp://www.techsupportforum.com/2763-reset-for-linksys-netgear-d-link-and-belkin-routers/ ==== How to tell if my Wireless is secure.http://www.ehow.com/how_6775466_tell-wireless-secure_.html Keep me posted. Link to post Share on other sites More sharing options...
Ditch67 Posted June 17, 2018 Author ID:1250796 Share Posted June 17, 2018 Thank you. I will do that next. Link to post Share on other sites More sharing options...
Ditch67 Posted June 21, 2018 Author ID:1251762 Share Posted June 21, 2018 (edited) I reset the router. But got this today while at my local news page using Edge [Malwarebytes didn't prevent it] It showed up while I was in the middle of reading the article, changing to the page shown below. (http://upnorthlive.com/news/local/3-democrats-running-for-michigan-governor-have-1st-debate) Malware address: http://mcafeesecurity.application-center.me/4/?utm_source=dhara1&utm_pubid=d4908ba5-c683-48e4-9324-4a755d8a986c&x-context=wBFHLMDILJIDFDQE1JC7API0&xm=lm.vxilehikc0dxq.stream Edited June 21, 2018 by Ditch67 Link to post Share on other sites More sharing options...
nasdaq Posted June 22, 2018 ID:1251896 Share Posted June 22, 2018 Hi, Please run the Farbar program scan the computer with only the "Shortcut.txt" option being checked. This will create a Shortcut.txt log post it in your next reply. Link to post Share on other sites More sharing options...
Ditch67 Posted June 22, 2018 Author ID:1252031 Share Posted June 22, 2018 Shortcut text attached. Shortcut.txt Link to post Share on other sites More sharing options...
Recommended Posts