laubeyrietechnology Ads X not removed by MWB

[warriors77]

I have "laubeyrietechnology Ads X" malware on chrome, probably caused by installing FVD_Downloader_Module_1.0.8.msi for chrome.
As a result, I see advertising blocks before and after Google search results in chrome (not on firefox).
After clicking on links in this ads, they are redirected to laubeyrietechnology.com
The advertising block disappear after clicking "x" next to Ads.

I tried all the usual things such uninstalling and reinstalling chrome, resetting chrome, disabling chrome extensions, look for suspicious programs, run malwarebytes, adwcleaner_7.2.4.0.exe, all to no avail. Even if I boot in safe mode with networking, the adds still appear.

Attached are (malware bytes scan log, FRST.txt, Addition.txt)

MWB_Log.txt

FRST_25-11-2018 12.12.55.txt

Addition_25-11-2018 12.12.55.txt

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Let me know if the problem persists in Chrome.

fixlist.txt

[warriors77]

Hello nasdaq,

Thank you for your help. I followed your instructions but unfortunately the problem persists in Chrome.
This is really a tough one to crack! It is in none of the obvious places, very well disguised!
Attached is the Fixlog.txt file.

Fixlog.txt

[nasdaq]

HI,

This could be a Syncing issue if you are Syncing Chrome with other devices?
To remove it you will have to reset the Sync in Chrome.

Read this article and proceed.

Chrome Secure Preferences detection always comes back
https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/
<<<>>>
 

 

[warriors77]

Hi,

Thank you for the suggestion. I have never used Syncing on Chrome.  When I go to chrome://settings/people I see "turn on sync". It have never turned it on before.

[warriors77]

I nevertheless enabled syncing, followed all the steps of that article, but the problem persists in Chrome.

[warriors77]

Update: I just discovered something interesting. When I use ExpressVPN and change my IP to another country, the ads do not appear in Chrome.
Changing my IP to another IP in my country does not help. It only helps if I change to another country.
This is regardless of whether I am signed in or not.
Hope this new clue can help us track down this malware.

[warriors77]

Touch wood, but for now it looks like it is gone, even without having to change my IP to another country.

The change of IP clue gave me the idea to have a look in C:\Windows\System32\drivers\etc\hosts
I saw that on the date of infection this was added to the host file:

5.149.253.143 www.gstatic.com
5.149.253.143 www.google-analytics.com
5.149.253.143 adservice.google.com

I removed and rebooted but I also needed to "Restore Settings to their Original Defaults" in Chrome for the ads to disappear.
I also delete any cookies in the last weeks but I am not sure if this was necessary as I only tested after having done both the Restore Settings and clearing cookies.

[nasdaq]

Hi,

Just for my information have you been using this Domain?

https://www.ip-tracker.org/locator/ip-lookup.php?ip=5.149.253.143

[warriors77]

No, I never used that IP before. I certainly did not add it to the host file. I am based in Asia, not in Canada, and never used a Canadian VPN. The date stamp of the host file corresponded with the date the infection, so these three entries must have been made on that date because I only modified my host file many years ago.

[nasdaq]

Thank you.

Glad we could help.

 

[warriors77]

Thank you for your assistance.

Do you think that just those entries in the host file were enough for Chrome to show those ads? Or do you think Chrome still needs to make use of remnant malware on my computer to do so?

I also wonder why changing my IP to another country also made them disappear. Possibly it checks back the IP of the computer the redirect comes from? I wonder why it would do that.

[warriors77]

Item 6 of this article also mentions the host file issue with browser redirect viruses:
https://www.techadvisor.co.uk/how-to/security/how-remove-browser-redirect-virus-3499499/

[nasdaq]

You got me thinking, it happens at my age. 😃

It may be that your Internet Settings\ZoneMap\Domains were compromised.

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

How is the computer running now?

fixlist.txt

Edited November 27, 2018 by nasdaq

[warriors77]

haha... that makes two of us, this nasty virus definitely got me thinking as well 😃
The computer works fine now, no more ads, so in the spirit of "if it ain't broke, don't fix it", I am bit reluctant to make changes because I wasted about 4 days on killing this virus.

I need to get my restore point working first as that apparently did not work with the previous FRST. Alternatively I could make a backup of the registry first.

So I have not run FRST yet. However, when having a quick look at the current registry Iand  observed the following:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
\Domains] and \Ranges] of your fxlist.txt are there,
but I also see \EscDomain] and\ProtocolDefaults]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
only has \Protocols],
\Domains], \Ranges], \EscDomains] of your fxlist.txt are missing

Not sure if that is normal.
 

[nasdaq]

That's OK you do not have these keys.

If you were to run the fix, the new keys would be created but would be empty.

If all is well you can forget about it.

 

 

[warriors77]

Thank you. At least it is good to know this is an area to look for in case of future problems.

There does seem to be nothing suspicious in the zonemap area. Jhere and there I see a haxadecimal value like 0, 1, 2, or 3, except perhaps for this @ivt

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]@ivt
Reg_DWORD 0x00000001 (1)

Safe to delete?

 

[nasdaq]

Hi,

Cannot find anything real about @ivt

This fix will change the Reg_DWORD 0x00000001 (1) value to 0.
Meaning it will be disabled.

Copy all the text IN THE QUOTE BOX below to notepad. Save it as fixme.reg to your desktop.
Be sure the "Save as" type is set to "all files" Once you have saved Right click the .reg file and allow it to merge with the registry.

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]@ivt
Reg_DWORD 0x00000001 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]@ivt
Reg_DWORD 0x00000000 

Restart the computer when completed.

You can delete the fixme.reg file when done.
===

Has your problem been solved?

p.s.
We can reset the value if needed.
 

[warriors77]

Hi,

Thank you. Just curious as to whether there is any difference between the method you describe and opening the registry with regedit and change the value from 1 to 0?

[nasdaq]

One is automatic with the fix, the other a Human can do it but must be very careful.

Not every one is at ease with editing the registry.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks