Trojan and Fraud when trying to launch att.com in Chrome

[stanoak]

When I try to go to the att.com website in Chrome, Malwarebytes blocks two websites, one as a Trojan (netcheckcdn.xyz) and one as Fraud (worldnaturenet.xyz), however scanning with Malwarebytes doesn't find anything.  This is the only URL that causes this problem.  How do I get rid of this?

Fraud details.txt

Trojan details.txt

[stanoak]

As requested, I'm posting these files here and will await further assistance.

Malwarebytes Threat Scan Report.txt

FRST.txt

Addition.txt

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Reset Chrome...
Open Google Chrome, click on menu icon or the 3 vertical dots located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset and clean up" > "Restore settings to their original defaults"
 
Restart Chrome.
<<<>>>

Let me know if the problem persists.

p.s.

Are you using Chrome Sync function to your other devices?
 

fixlist.txt

[stanoak]

Hi Nasdaq,

Here's the fixlog.txt file.

I followed the instructions to reset Chrome but the problem persists.  I am using Chrome Sync on my smartphone; should I shut that off?

Stan

Fixlog.txt

[nasdaq]

Quote

I am using Chrome Sync on my smartphone; should I shut that off?

Yes, then restart the computer and check if the problem persists.

Read this article and proceed.

Chrome Secure Preferences detection always comes back
https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/
<<<>>>

Edited February 15, 2019 by nasdaq

[stanoak]

I turned off sync on my phone and restarted the computer but am still getting the same two blocked websites.

I went through the Secure Preference article and followed the instructions to no avail.  Chrome sync was off to begin with; also, I do not have a "Reset Sync" button on my Google Dashboard.

I also tried running AdwCleaner but it didn't find anything.

Stan

[nasdaq]

Your copy of Chrome has probably been compromised

Remove Chrome from your Computer and reinstall a fresh copy later.

If you remove the syncing of your account you must remove it before you save your bookmarks etc...
Delete Your Google Chrome Browser Sync Data if you sync with other devices. <- Important ...
https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/

Before you remove Chrome Export your Bookmarks
Chrome will export your bookmarks as a HTML file, which you can then import into another browser.
How To: http://ccm.net/faq/31791-how-to-backup-your-google-chrome-bookmarks

Before you remove Chrome Export your Passwords
How to export your saved passwords from Chrome
https://betanews.com/2018/03/09/export-chrome-passwords/

Clear your Chrome cache and cookies
https://support.google.com/chromebook/answer/183083?hl=en

Remove Chrome using the the instructions on this page.
https://support.google.com/chrome/answer/95319?hl=en

Re-install Chrome and the Bookmarks.
<<<>>>

Keep me posted.

[nasdaq]

Hi,

Experts here are beginning to suspect ATT.COM.

Contact them.

We have many topics with that error and no solution found yet.

[nasdaq]

Hi,

Your issue and the others are not exactly the same.

It's bothering me also that we cannot find a solution.

2 things you may want to try that were not suggested in the other topics.
This  fix will reset the \ZoneMap\Domains registry list.

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

If that fails to solve the problem.

Reset your router. It may be corrupted. 

If your router came with ATT then this may not be the right way. Check with them.

How to Reset a Router Back to the Factory Default Settings
http://www.ehow.com/how_2110924_reset-back-factory-default-settings.html

Then, please reconfigure it back to your preferred setting.. Below is the list of default username and password, should you don't know it

http://www.routerpasswords.com/
http://www.phenoelit-us.org/dpl/dpl.html

Reset for Linksys, Netgear, D-Link and Belkin Routers
http://www.techsupportforum.com/2763-reset-for-linksys-netgear-d-link-and-belkin-routers/

===

Keep me posted.

 

[stanoak]

Hi -

I don't see the new Fixlist.txt file....

[stanoak]

Also, what's strange is that the problem only occurs with Chrome, not with Edge or Firefox or IE.

[nasdaq]

Hi,

Sorry about that.

p.s.

Normally resetting the Chrome Sync helps.

See my post no. 7 #2.

 

fixlist.txt

[stanoak]

Success!  I ran the new fixlist.txt file and that seems to have solved the problem.  I've attached the log file...

Thanks for all your help!

Stan

 

Fixlog.txt

[nasdaq]

Which one worked?

The resetting the Sync or the Fixlist?

Remember that I had previously suggested the resetting of the Sync.

[stanoak]

The fixlist.  Nothing else had any effect.

Stanoak

[nasdaq]

Tanks.

Stay safe.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks