How do I remove eluxer.net?

[TheArtBeacon]

I'm having a tough time finding and removing what appears to be eluxer.net.

I am running Windows 10 on my laptop it is updated as of today.  I use Chrome as my browser and it is also up to date.

I started having problems with unwanted tabs opening. Most claim to be Windows support, but clearly are not.  There are no unrecognizable programs I can see in the Control Panel when I try to look for something in the uninstall programs list. I believe it is something involving eluxer.net or perhaps that and another PUP. Windows and Malwarebytes scans come up clean (see attached MB scan report). I ran FRST and it shows some problems that I do not fully understand I have attached those reports as well.

Let me know what additional information you need to provide me with some guidance to fix this frustrating problem.

Thank you!

 

 

 

Addition.txt

FRST.txt

malware log blocked outbound.txt

report scan.txt

[TheArtBeacon]

Supplementing with screen capture of Malware warning I just received.

[kevinf80]

Hello TheArtBeacon and welcome and welcome to Malwarebytes, I do not see any obvious malware or infection in your logs. The outbound calls are from Chrome, lets go for a clean install of Chrome, see if that helps.. If your Chrome Bookmarks are important do this first: Go to this link: http://www.wikihow.com/Export-Bookmarks-from-Chrome follow the instructions and Export your Bookmarks from Chrome, save to your Desktop or similar. Note the instructions can also be used to Import the bookmarks..... Continue for a clean install: Download Chrome installer and save to install later: https://www.google.com/intl/en_uk/chrome/browser/desktop/index.html https://www.google.com/intl/en_usa/chrome/browser/desktop/index.html Next, Open Chrome and sign into your account, open a new tab and type or copy paste chrome://settings/syncSetup hit enter... In the new window that opens "Sync everthing" will probably be selected, scroll down to and select "Managed sync data on Google Dashboard" A new window will open, scroll down to and select "Reset Sync" that will clear synced data from Google Server... Continue to next step to completely Uninstall Chrome.... Next. Uninstall Chrome: https://support.google.com/chrome/answer/95319?hl=en-GB follow those instructions, ensure the option to "Also delete your browsing data" is selected. <<--- Very important!! Navigate to C:\Users\Your user name\Appdata\Local from that folder delete the folder named Google (you will need to show hidden files/folders to see the folder Appdata) For XP that will be My Computer > C:\ Documents and Settings\Your User Name\Application Data\Roaming How to show hidden files and folders for windows: http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/ Next, Install Google Chrome : Next, Import your Bookmarks... (instructions in the first step) Next, Install uBlock Origin for Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en Does that help...? Thank you, Kevin..

[TheArtBeacon]

It looks like that did the trick! Thank you so much for the clear instructions and all of your help!

[kevinf80]

You`re very welcome TheArtBeacon, happy to help....

[TheArtBeacon]

It's back. I'm getting the notice "Website Blocked Due to Trojan" which references eluxer.net.

I can follow the instructions again and reinstall Chrome, but I'm afraid that won't do it.  Is there an additional step to make sure it doesn't reinstall again? Any idea where this is coming from so I can avoid it?

[kevinf80]

Scan with Autoruns Please download Sysinternals Autoruns from the following link: https://live.sysinternals.com/autoruns.exe save it to your desktop. Note: If using Windows Vista, Windows 7, Windows 8/8.1 or Windows 10 then you also need to do the following:   Right-click on Autoruns.exe and select Properties Click on the Compatibility tab Under Privilege Level check the box next to Run this program as an administrator Click on Apply then click OK   Double-click Autoruns.exe to run it. Once it starts, please press the Esc key on your keyboard. Now that scanning is stopped, click on the Options button at the top of the program and verify that the following are checked, if they are unchecked, check them: Hide empty locations Hide Windows entries   Click on the Options button at the top of the program and select Scan Options... then in the Autoruns Scan Options dialog enable/check the following two options: Verify code signatures Check VirusTotal.com   Once that's done click the Rescan button at the bottom of the Autoruns Scan Options dialog and this will start the scan again, this time let it finish. When it's finished and says Ready. on the lower left of the program window, please click on the File button at the top of the program and select Save and save the file to your desktop and close Autoruns. Right click on the file on your desktop that you just saved and hover your mouse over Send To and select Compressed (zipped) Folder Attach the ZIP folder you just created to your next reply

[TheArtBeacon]

It's downloading in an .am format, which I can't attach to this message. I guess it is a format specific to that program, but I don't see where I can save it as a zip file.

[TheArtBeacon]

Oops, didn't see that last instruction. Zip file is attached to this response.

JKSHOME.zip

[kevinf80]

Download Dr Web Cureit from here http://www.freedrweb.com/cureit save to your desktop.   The file will be randomly named Reboot to safe mode <<<<<------------ http://www.computerhope.com/issues/chsafe.htm Run Dr Web Tick the I agree box and select continue Click select objects for scanning   Tick all boxes as shown Click the wrench and select automatically apply actions to threats   Press start scan The scan will now commence   Once the scan has finished click open report <<<--- Do not miss this step   A notepad will open Select File > Save as.. Save it to your desktop This log will be excessive, Please attach it to your next reply…

[TheArtBeacon]

It looks like it didn't find anything. What should I try next?

cureit.log

[kevinf80]

Follow the instructions from this link:

 

[TheArtBeacon]

So far so good. None of the scans found anything, but I reset as per the instructions.  I'll check back if it didn't work. Thanks again!

[kevinf80]

Thanks for the update, see what happens over the next couple of hours..

[kevinf80]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks