--use-spdy%3Doff & --disable-http2 popups

[BarryJackson]

Anytime I hit a web link I get --use-spdy%3Doff & --disable-http2 popups.  Have run Malwarebytes and Adwcleaner, as well as antivirus full scan, and nothing has worked.  Have also uninstalled and re-installed Chrome.  Any suggestions?

[kevinf80]

Hello BarryJackson and welcome to Malwarebytes, Continue with the following: If you do not have Malwarebytes installed do the following: Download Malwarebytes version 3 from the following link: https://www.malwarebytes.com/mwb-download/thankyou/ Double click on the installer and follow the prompts. If necessary select the Blue Help tab for video instructions.... When the install completes or Malwarebytes is already installed do the following: Open Malwarebytes, select > "settings" > "protection tab" Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Go back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes quarantine any found entries... To get the log from Malwarebytes do the following:   Click on the Report tab > from main interface. Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply   Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Next, Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status...   Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans"   Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Let me see those logs in your reply... Thank you, Kevin....

[BarryJackson]

Thanks for the help Kevin.  I did already have Malwarebytes installed but did not have Rootkits set to on.  However, after the scan it still didn't find anything.  The malwarebytes log is below and I've attached the two from Farbar.

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 12/3/18
Scan Time: 12:38 PM
Log File: 9be222ee-f72a-11e8-a66c-847beb1ee2b2.json

-Software Information-
Version: 3.6.1.2711
Components Version: 1.0.482
Update Package Version: 1.0.8145
License: Free

-System Information-
OS: Windows 10 (Build 17134.407)
CPU: x64
File System: NTFS
User: BARRY_LAPTOP\Barry Jackson

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 314162
Threats Detected: 0
Threats Quarantined: 0
Time Elapsed: 4 min, 30 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

 

 

 

FRST.txt

Addition.txt

[kevinf80]

Hello BarryJackson,

Is this private IP address known to you and trusted: 10.1.10.1

Does the popup issue only happen in Chrome..

Thanks,

Kevin...

[BarryJackson]

Kevin - I have no idea about IP addresses.  I'm not an IT guy.  I can tell you this computer is my work computer (I own a small business) and I do have an IT person I call when I need something done but I do most of the little things myself.  

I did just make Edge my default browser and when I clicked on a link I did not get the popups.  So it does seem to be just with Chrome (which previous to posting this issue on here I did uninstall and re-install Chrome).  

Thanks

[kevinf80]

If the issue was only with Chrome then a clean install is required to ensure all adware etc is gone....

If your Chrome Bookmarks are important do this first: Go to this link: http://www.wikihow.com/Export-Bookmarks-from-Chrome follow the instructions and Export your Bookmarks from Chrome, save to your Desktop or similar. Note the instructions can also be used to Import the bookmarks..... Continue for a clean install: Download Chrome installer and save to install later:   https://www.google.com/intl/en_uk/chrome/browser/desktop/index.html https://www.google.com/intl/en_usa/chrome/browser/desktop/index.html Next, Open Chrome and sign into your account, open a new tab and type or copy paste chrome://settings/syncSetup hit enter... In the new window that opens "Sync everthing" will probably be selected, scroll down to and select "Managed sync data on Google Dashboard" A new window will open, scroll down to and select "Reset Sync" that will clear synced data from Google Server... Continue to next step to completely Uninstall Chrome.... Next. Uninstall Chrome: https://support.google.com/chrome/answer/95319?hl=en-GB follow those instructions, ensure the option to "Also delete your browsing data" is selected. <<--- Very important!! Navigate to C:\Users\Your user name\Appdata\Local from that folder delete the folder named Google (you will need to show hidden files/folders to see the folder Appdata) For XP that will be My Computer > C:\ Documents and Settings\Your User Name\Application Data\Roaming How to show hidden files and folders for windows: http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/ Next, Install Google Chrome : Next, Import your Bookmarks... (instructions in the first step) Next, Install uBlock Origin for Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en Does that help Kevin....

 

[kevinf80]

Forgot to add, can you check with your IT guy about the IP address, did he set it up...?

[BarryJackson]

I just checked with my IT guy who logged in and confirmed the IP address is good (I think he said it's my router).  I'll go through your steps for a clean Chrome install and let you know the result. 

[BarryJackson]

Question Kevin - when you say sign in to your Chrome account - I'm not sure I'm following you as I don't know that I have an account.  I just use the browser.  When I click on the person icon in the top right it shows sync is turned off.  When I paste chrome://settings/syncSetup and hit enter I don't see anything that shows sync everything, but I do see a blue button at the top that says Turn on Sync.  

[kevinf80]

If sync is not setup then that section can be ignored, just continue with the other steps....

[BarryJackson]

OK, followed all the instructions exactly as you requested and after installing uBlock Origin I closed Chrome and clicked on a link and I'm still getting the pop ups.  Any more ideas?

[kevinf80]

Are you opening the links in Chrome.. If so run this:

Please download Zemana AntiMalware and save it to your Desktop.   Install the program and once the installation is complete it will start automatically. Without changing any options, press Scan to begin. After the short scan is finished, if threats are detected press Next to remove them. Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please re-boot your computer manually.   Open Zemana AntiMalware again. Click on icon and double click the latest report. Now click File > Save As and choose your Desktop before pressing Save. Attach saved report in your next message. Thanks, Kevin...

[BarryJackson]

Typically I'm clicking a link from an email and then it opens in Chrome.  After running Zemana it found 3 items and it appears it may have fixed it as I just clicked on the link Go To This Post from your last email and I don't have the pop ups.  I've attached the Zemana report.  

Based on this, should I run Zemana instead of Malwarebytes or do they work differently and I should use both?

Thanks for your help!

2018.12.03-15.09.44-i0-t92-d3.txt

[kevinf80]

I have Malwarebytes Premium, I also have Zemana free version. I would not use or pay for Zemana, just use the free version and use as a stand alone scanner when required. Malwarebytes Premium is also an Antivirus where Zemana is not, other functions are similar but Zemana is also good for issues like you`ve just experienced...

The logs from FRST did not show any obvious Malware or Infection. When looking for problems on a system, sometimes we have to use several tools before we make headway. How is your system responding now, any remaining issues or concerns...?

[BarryJackson]

The system is working well and I've clicked on a couple of links from my email to test and no pop ups.  I currently have Webroot Secure Anywhere (paid) and use Malwarebytes free and Adwcleaner to supplement.  Really appreciate your help and will make a donation. 

[kevinf80]

Hiya BarryJackson,

I`d also keep Zemana, it will currently be running with realtime protection active for its trial period, just turn that off... If you prefer you can uninstall it.

Uninstall Zemana http://www.askvg.com/how-to-completely-uninstall-remove-a-software-program-in-windows-without-using-3rd-party-software/ Next, Right click on FRST here: C:\Users\BARRY-PC\Desktop\FRST64.exe and rename uninstall.exe when complete right click on uninstall.exe and select "Run as Administrator" If you do not see the .exe appended that is because file extensions are hidden, in that case just rename FRST64 to uninstall That action will remove FRST and all created files and folders... Next, Remove all System Restore Points: https://www.tenforums.com/tutorials/33593-delete-system-restore-points-windows-10-a.html#option2 Create clean fresh Restore Point: http://www.thewindowsclub.com/create-system-restore-point Run Windows Disk Clean Up Utility - https://neosmart.net/wiki/disk-cleanup/ From there you should be good to go... Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[kevinf80]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks