mendsit Posted December 12, 2018 ID:1286648 Share Posted December 12, 2018 I see some others who are affected by this trojan on here. Currently when I open chrome, it attempts to go to go.microsoft.com but then is redirected (appropriately) to blank tab. Most of the time if I click on any link, Malwarebytes alerts me that a trojan has been quarantined. FRST.txt Addition.txt Any help would be appreciated Link to post Share on other sites More sharing options...
mendsit Posted December 12, 2018 Author ID:1286653 Share Posted December 12, 2018 Scan.txt Link to post Share on other sites More sharing options...
LDTate Posted December 12, 2018 ID:1286704 Share Posted December 12, 2018 Hello and mendsit Please take your time. Windows 7 Restart your computer in Safe Mode. Using the F8 or F5 Method: Restart your computer. When the computer starts you will see your computer's hardware being listed. When you see this information start to gently tap the F8 key on your keyboard repeatedly until you are presented with the Windows 7 Advanced Boot Options select the Safe Mode With Networking Then press the enter key on your keyboard to boot into Windows 7 Safe Mode. When Windows starts you will be at a typical logon screen. Logon to your computer and Windows 7 will enter Safe mode. Open Malwarebytes (MBAM), run a new scan and delete all in Quarantine **Power Off** (shutdown, the pc. Wait a few minutes. Restart in Normal Mode, run a new scan and make sure it's gone Link to post Share on other sites More sharing options...
mendsit Posted December 12, 2018 Author ID:1286748 Share Posted December 12, 2018 I did this and computer froze during rescan after normal boot. After normal restart again, repeat scan showed one persistent threat. I was in the process of running frst when it froze again. This is a new issue. Link to post Share on other sites More sharing options...
LDTate Posted December 12, 2018 ID:1286751 Share Posted December 12, 2018 Can you give me the scan results from MBAM? Open Malwarebytes > Reports Double Click the **Scan Report** to open it On the lower left select **Export** > Export to Text Save as mbamscan.txt and Save it to your desktop Attach the mbamscan.txt text file in your next reply. Link to post Share on other sites More sharing options...
mendsit Posted December 12, 2018 Author ID:1286769 Share Posted December 12, 2018 So here is the scan from the last post I then started in safemode again and ran malwarebytes again but no threats were detected. Restarted in normal mode and scanned (represented by scan2) FRST running now. but will post in case it freezes again. Chrome opened appropriately to blank tab and I did not see it attempt to redirect to go.microsoft.com, however I am still getting alerts from malwarebytes of a trojan scan.txt scan2.txt Link to post Share on other sites More sharing options...
mendsit Posted December 12, 2018 Author ID:1286771 Share Posted December 12, 2018 Here are the others. FRST.txt Addition.txt Link to post Share on other sites More sharing options...
LDTate Posted December 12, 2018 ID:1286777 Share Posted December 12, 2018 I have attached A file I need you to download and save it to the same place that you saved the FRST program Download attached **fixlist.txt** and save it to same location where the FRST tool is located. NOTE: Both FRST.exe and the fixlist.txt must be in the same location or the fix will not work. Close all browsers before running. Double click FRST to run the tool. If the tool warns you the version is outdated, please download and run the updated version. •Click the **Fix Button**. •If you receive a message that a reboot is required, please make sure you allow it to restart normally. •The tool will complete its run after restart. When finished, the tool will make a log (Fixlog.txt) in the same location from where it was run. Please attach the Fixlog.txt in your reply. Restart the pc and let me know how it's running now. fixlist.txt Link to post Share on other sites More sharing options...
mendsit Posted December 13, 2018 Author ID:1286785 Share Posted December 13, 2018 Seems good. Has not frozen. Chrome opens to blank tab and no warnings from malwarebytes about the trojan with opening links. I could not find any file named fixlog.txt Link to post Share on other sites More sharing options...
LDTate Posted December 13, 2018 ID:1286789 Share Posted December 13, 2018 Give it until tomorrow and then let me know. Link to post Share on other sites More sharing options...
mendsit Posted December 14, 2018 Author ID:1287105 Share Posted December 14, 2018 I'm still seeing intermittent popups from malwarebytes for the trojan. When I start chrome, it is opening to a blank tab and I don't see where it is trying to go to go.microsoft.com. mabmscan.txt Addition.txt FRST.txt Link to post Share on other sites More sharing options...
LDTate Posted December 14, 2018 ID:1287111 Share Posted December 14, 2018 The issues appear to be only happening with Chrome. We will need to create new profile. If you have Chrome Bookmarks that you want to save, you want to do that first. Export / Import Bookmarks. https://support.google.com/chrome/answer/96816?hl=en Open your Chrome on all devices using Chrome as we need to make sure Chrome sync doesn't allow it back in. • Go to Settings > People > Sync (or alternatively, enter the following in the address bar: chrome://settings/syncSetup) • On the page, you'll see what synced data is enabled. Move all sliders to the left in order to disable all the syncing. Please make sure Chrome is closed before running the fix Keep in mind the fix requires a restart of the computer =========================== I have attached A file I need you to download and save it to the same place that you saved the FRST program Download attached **fixlist.txt** and save it to same location where the FRST tool is located. NOTE: Both FRST.exe and the fixlist.txt must be in the same location or the fix will not work. Close all browsers before running. Double click FRST to run the tool. If the tool warns you the version is outdated, please download and run the updated version. •Click the **Fix Button**. •If you receive a message that a reboot is required, please make sure you allow it to restart normally. •The tool will complete its run after restart. When finished, the tool will make a log (Fixlog.txt) in the same location from where it was run. Please attach the Fixlog.txt in your reply. Restart the pc and let me know how it's running now. fixlist.txt Link to post Share on other sites More sharing options...
mendsit Posted December 14, 2018 Author ID:1287114 Share Posted December 14, 2018 Nothing on there named sync. Link to post Share on other sites More sharing options...
LDTate Posted December 14, 2018 ID:1287115 Share Posted December 14, 2018 That's fine if you're not using Chrome's sync. Move on to the next part Link to post Share on other sites More sharing options...
LDTate Posted December 14, 2018 ID:1287117 Share Posted December 14, 2018 While you're doing that, Help Secure your browsers Please install uBlock Origin for your browsers. uBlock Origin For Fire Fox, Chrome and Safari https://www.ublock.org/ Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 3, 2019 Root Admin ID:1290378 Share Posted January 3, 2019 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts