Malware "adult.yourblocksite.com" recurring problem

[cranberry]

i full scanned with avira pro,, malwarebytes, adwcleaner, several times, but even if improved i still get the warning each time i open a page on google chrome and gmail, and its enerving as it tells me that it is still there. Malware "adult.yourblocksite.com"
 I just changed more of chrome settings following your advices in a closed forum subject, except for starting chrom where  left as i dont want to lose all the windows i have opened 

i tried twice to run a google search repair computer from chrome settings, but both time it filed to be able to do so after about 10 minutes 
what can be the reason for that?

The infection landed in my computer yesterday morning right as opened chrome. no idea how it came from.

This malware that does make chrome jump back to previous page exist since years, how come avira dont have it listed i mean is unable to detect it and stop it and then ot detect it after while you can? it is very strange. is it particularly well engineered?

Thank you for your advice,

Edited August 24, 2018 by cranberry

[Aura]

Hi cranberry

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.

• As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens
• As long as I'm assisting you on Malwarebytes Forums, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you
• The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system
• If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!
• If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off;
• Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced
• I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against Malwarebytes Forums's rules
• In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process
• I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone
  This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread
  

This being said, it's time to clean-up some malware, so let's get started, shall we?

Follow the instructions in the thread below, and provide me both FRST logs (FRST.txt and Addition.txt) and the Malwarebytes log. You can attach them in your next post, or copy/paste their content.

https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

[cranberry]

Hel Aura and thank you for your answer.
I notice that the link you gave me is almost 10 years old. From january 2009.. isn't it a bit too old especially concerning high tech and softwares?
Malwares have evolved faster since, and computers too.
I am running the Farbar recovery scan right now.

[cranberry]

Here are the scan file results from Farbar:
 

FRST.txt

Addition.txt

[Aura]

The thread may be old, but it's being updated over time. It has been edited in Summer of 2017. FRST is still our to go tool, and running Malwarebytes as well.

Here, uninstall this extension in Google Chrome and it should do the trick.

Block Site - Website Blocker for Chrome™

 

[Aura]

Hi cranberry,

Are you still with me?

[cranberry]

Hello Aura,
yes, sorry i didn't saw the email posted on sunday and thought you had forgotten me.. ))
you mean the extension itself? Ok i just did it. I heard it presented danger before, and had removed it in the past. so it was just this extension doing it?

I also see another problem since yesterday and it is that i cannot open a new fane when i am on youtube . For example if i right click on a video and click on "open on a new fane" it will jump, like if the fane was about to open but then wont. Is it related to the malware? it began to do that yesterday. (monday). it only does that on youtube, i have no idea why. 

Thank you for your help, I keep you updated if the problem has disappeared or not .


 

[Aura]

By "fane", do you mean "tab"?

[cranberry]

yes a new tab sorry i just saw my mistake and was about to correct it when i saw your question.))
i tried to google it but there is no answer for that problem. 

 

Edited August 29, 2018 by cranberry

[Aura]

Does that happen only in Google Chrome, or in Mozilla Firefox, Internet Explorer and Edge as well?

[cranberry]

Hi Aura,

It happen only on google chrome but work fine on internet explorer, and as youtube is part of google it is a bit strange..
I can right click on other links, out of youtube, and open a new tab without problems .
This issue is only existing when i am on youtube.
I couldn't found anything on "my account" on youtube that was related to this.
Can it be some SYNCHRONISATION of the system on Chrome, that i had to change when i was trying to get rid of that malware, who are causing this?
I have look into settings for chrome but couldn't see what it could be.
I also tried to put all synchronised, but i still couldn't open a new tab on youtube.
It bloks for a new tabs from opening, a bit like malwarebyte was blocking the malware from opening a new tab, which happened a lot on youtube, it was specifically most centered on youtube. Now malwarebyte can take a break, as i have removed the malware extension causing that, but it seem to have done some damages, or it is something in the settings who had been changed. But i doubt its the malware who did that, as it only had interest in being able to open a new tab.
I have to admit that its a weird kind of problem as it only happen with youtube when using chrome, where it should work best.

I hope that my answer gave you the informations you needed Aura.

Thanks a lot for your help

Edited August 30, 2018 by cranberry

[Aura]

To be honest, it could be caused by one of the many Chrome extensions you have installed. Can you create a new Google profile, with no extensions, and see if the issue is still present?

[cranberry]

Hi Aura,
no, the other extensions were always there only the website blocker extension that removed was installed a few weeks ago. I dont think its the other extensions as this occurred while i was under the malware attacks opening lots of advertising on youtube..  I can also open a link on YT but on a new window. not on new tab on the window i am onto.it must be something else.
My internet connection also go away regularly since 1 day. its restored with the automatic diagnostic of window resetting the LAN card, but i wonder if it is connected

[Aura]

Hum... You could try to reinstall Google Chrome and see if that fixes the issue. It would be my first step.

[cranberry]

I just have tried to deactivate all extensions, and then i could open new tab on youtube.
So i tried to activate them one by one and found out that it's "Ublock origin" who does that.
So i contacted the website forum to ask, and wait for answer. But why is it blocking for new tab on youtube all the sudden? 
Also when i receive an alert on youtube about a new video and click on it, then it open it on a new tab without problem (before i had deactivated ublock origin) so that's weird

[Aura]

Maybe the extension got damaged, or it's a bug. In any case, if you reporting it, it should be adressed soon.

[Aura]

Hi cranberry,

Are you still with me?

[cranberry]

yes i am here Aura, 
i have fixed the problem with youtube got answer from them, but now i have a problem on VK where what i write in message is changed when i post it sometimes it even delete what i post as i write it and change words of place, and making a mess, i am running a avira rootkit scan and malware byte scan but malwarebyte said it couldn't access the rootkit (before i did the rootkit scan with avira) and a bing and pseudo avira search instal themselves on my google chrome extensions on start. removed too. but it seems to do it again even when removed by adware cleaner who do that everyday.. it just stays there. or come back.

[Aura]

What is VK? A website?

[cranberry]

Yes its the russian equivalent of facebook. Something similar happened last time i had that malware issues long ago, 6 months ago maybe or more. the same tpåatterns with that extension that i thought block malware and who was one,  that i had removed then, but apparently i forgot it some weeks ago. when i installed it, and then i get malwarebytes and adwcleaner and so  o but problems are still there in the background, less bad, but a bit receding and at the end i have this issue on vk where what i write it transcribed changed form a thing to another, totally weird. exactly same number of weeks and all and exactly as i am about to dont be cover by malware byte. and avira premium found nothing, nor malwarebyte scanning os its a bit spooky now.. )))

[cranberry]

I might have found out why it was changing what i wrote. maybe the automatic page translation . it seems to work fine when i dont translate the page i wanted to edit the comment above but couldn't, sorry.

 

[Aura]

That would make perfect sense actually.

Any other issues that needs to be addressed?

[cranberry]

yes the bing and avira as browser who start themselves when i start google and seems to be detected by adware each time i do a scan every day, and malwarebyte unable to access and scan rootkit since yesterday

[Aura]

What error message are you getting when you try to enable the "Anti-Rootkit" scan option?

[cranberry]

i dont remember the exact wording but it didnt show again today. But i still have the bing and avira as PUP selfinstaling each time i start chrome. even if it is removed by anti adware right before closing my computer, followed by a restart and then closing down.