rick455 Posted March 31, 2019 ID:1306127 Share Posted March 31, 2019 I keep getting the same 29 threats coming up over and over. They look like something to do with Chrome. I exported the report which is attached. How do I make this stop? 29 threats over and over.txt Link to post Share on other sites More sharing options...
nasdaq Posted April 1, 2019 ID:1306192 Share Posted April 1, 2019 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Download the Farbar Recovery Scan Tool (FRST).Choose the 32 or 64 bit version for your system. and save it to a folder on your computer's Desktop. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. How to attach a file to your reply: In the Reply section in the bottom of the topic Click the "more reply Options" button. Attach the file. Select the "Choose a File" navigate to the location of the File.Click the file you wish to Attach.Click Attach this file.Click the Add reply button. === Please post the logs for my review. Wait for further instructions Link to post Share on other sites More sharing options...
rick455 Posted April 2, 2019 Author ID:1306250 Share Posted April 2, 2019 I am not sure if the "Logs" you refer to are these TXT files or something else. Anyway here ya go:-) Thanks Rick FRST.txt Addition.txt Link to post Share on other sites More sharing options...
nasdaq Posted April 2, 2019 ID:1306329 Share Posted April 2, 2019 Hi, Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Reset Chrome... Open Google Chrome, click on menu icon or the 3 vertical dots located right side top of the google chrome. Click "Settings" then "Show advanced settings" at the bottom of the screen. Click "Reset and clean up" > "Restore settings to their original defaults" Restart Chrome. <<<>>> If the problem persists and you Sync Chrome with other devices reset the Sync. Read this article and proceed. Chrome Secure Preferences detection always comes backhttps://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/ === Please post the Fixlog.txt and let me know what problem persists. fixlist.txt Link to post Share on other sites More sharing options...
rick455 Posted April 2, 2019 Author ID:1306370 Share Posted April 2, 2019 Here is the fixlog.txt file you requested:-) Rick Fixlog.txt Link to post Share on other sites More sharing options...
nasdaq Posted April 3, 2019 ID:1306443 Share Posted April 3, 2019 Is your problem solved? Link to post Share on other sites More sharing options...
rick455 Posted April 3, 2019 Author ID:1306499 Share Posted April 3, 2019 Not sure yet...got 31 items today, they could be new. I quarantined and then deleted them... so we'll see tomorrow. Should I be hesitant to delete? Link to post Share on other sites More sharing options...
nasdaq Posted April 4, 2019 ID:1306569 Share Posted April 4, 2019 Next time post the Malwarebytes log so I can see what is spawning. Link to post Share on other sites More sharing options...
rick455 Posted April 4, 2019 Author ID:1306638 Share Posted April 4, 2019 4 hours ago, nasdaq said: Next time post the Malwarebytes log so I can see what is spawning. That's funny...see the attached...thank you. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
nasdaq Posted April 5, 2019 ID:1306748 Share Posted April 5, 2019 May I see the MBAM log. Link to post Share on other sites More sharing options...
rick455 Posted April 5, 2019 Author ID:1306777 Share Posted April 5, 2019 2 hours ago, nasdaq said: May I see the MBAM log. What and where is the MBAM log? When I said funny yesterday, I was referring to the word "spawning" Here is today's addition and first txt files. Instead of 29 files every day now it's 31 Addition.txt FRST.txt Link to post Share on other sites More sharing options...
nasdaq Posted April 5, 2019 ID:1306787 Share Posted April 5, 2019 Hi, Not sure yet...got 31 items today, What do you get if you execute the Malwarebytes programs? Are these just IP's that were stopped by MBAM? Are you getting any adds in the lower right corner of the browsers? Please explain what is wrong. Link to post Share on other sites More sharing options...
rick455 Posted April 6, 2019 Author ID:1306966 Share Posted April 6, 2019 Hi, Still don't know how to find the MBAM log How do i determine if they are just IP's? I do get an ADD now and then. May fewer than before MBAM. What's wrong is I have to go into the APP every day to quarantine what appears to be the same 31 (was 29) items. See attached scan from Saturday April 6th. Rick Addition.txt FRST.txt Link to post Share on other sites More sharing options...
rick455 Posted April 7, 2019 Author ID:1306984 Share Posted April 7, 2019 Hi, I did an export...what I've labeled as a scan report on the 31 items that keep coming up. I captured them into a PDF file which is attached. Is this what your calling an MBAM log? Rick Scan report April 6th.pdf Link to post Share on other sites More sharing options...
nasdaq Posted April 7, 2019 ID:1307023 Share Posted April 7, 2019 Hi, This is my instructions on how to run MBAM. Please download Malwarebytes Anti-Malware from here Right-click on the MBAM icon and select Run as administrator to run the tool. Click Yes to accept any security warnings that may appear. Once the MBAM dashboard opens, on the right detail pane click on the word "Current" under the Scan Status to update the tool database. On the left menu pane click the Settings tab, and then select the Protection tab on the top. Under the Scan Options, turn on the button Scan for rootkits and Scan within archives. Click the Scan tab on the right detail pane, select Threat Scan and click the Start Scan button Note: The scan may take some time to finish, so please be patient. If potential threats are detected, ensure to check mark all the listed items, and click the Quarantine Selected button. While still on the Scan tab, click the View Report button, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop. The log can also be viewed by clicking the log to select it, then clicking the View Report button. Please post the log for my review. There should be a .txt log created on your Desktop. Can you attach the log or open it with Notepad copy the text and past it on your next reply. If I understand correctly you have deleted all these entries and they are coming back. Yes? Link to post Share on other sites More sharing options...
rick455 Posted April 7, 2019 Author ID:1307062 Share Posted April 7, 2019 I followed your instructions and created to TXT file you requested...see it attached Your understanding is correct these entries keep coming back! MBAM Log April 7th.txt Link to post Share on other sites More sharing options...
nasdaq Posted April 8, 2019 ID:1307103 Share Posted April 8, 2019 (edited) Hi, This is just a value in the Registry. Let see if we can delete it. Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Please post the Fixlog.txt and let me know what problem persists. If the problem persists I suggest you start a service ticket in the support Forum.https://forums.malwarebytes.com/forum/41-malwarebytes-3-support-forum/ Post the MBAM log for their review. The should be able to add the deletion to their program. Keep me posted. fixlist.txt Edited April 8, 2019 by nasdaq Link to post Share on other sites More sharing options...
rick455 Posted April 9, 2019 Author ID:1307206 Share Posted April 9, 2019 Here is the fixlog.txt...Will evaluate resulting situation tomorrow. Thanks Fixlog.txt Link to post Share on other sites More sharing options...
nasdaq Posted April 9, 2019 ID:1307228 Share Posted April 9, 2019 We may have to delete the whole key. Before attempting it I need to see what the key holds. Lets see what we can find in the Registry. Run the Farbar program .exe as an Administrator. In the Search text area, copy and paste the following: HKU\S-1-5-21-2855577990-1137388761-2144549305-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default Once done, click on the Search Registry button and wait for FRST to finish the search On completion, a log will open in Notepad. Copy and paste its content in your next reply ==== Link to post Share on other sites More sharing options...
rick455 Posted April 13, 2019 Author ID:1307810 Share Posted April 13, 2019 Registry scan attached. SearchReg.txt Link to post Share on other sites More sharing options...
nasdaq Posted April 14, 2019 ID:1307857 Share Posted April 14, 2019 Hi, Your copy of Chrome may have been compromised Remove Chrome from your Computer and reinstall a fresh copy later. If you remove the syncing of your account you must remove it before you save your bookmarks etc... Delete Your Google Chrome Browser Sync Data if you sync with other devices. <- Important ...https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/ Before you remove Chrome Export your Bookmarks Chrome will export your bookmarks as a HTML file, which you can then import into another browser. How To: http://ccm.net/faq/31791-how-to-backup-your-google-chrome-bookmarks Before you remove Chrome Export your Passwords How to export your saved passwords from Chromehttps://betanews.com/2018/03/09/export-chrome-passwords/ Clear your Chrome cache and cookieshttps://support.google.com/chromebook/answer/183083?hl=en Remove Chrome using the the instructions on this page.https://support.google.com/chrome/answer/95319?hl=en Re-install Chrome and the Bookmarks. <<<>> Let me know if the problem is solved or not. Link to post Share on other sites More sharing options...
rick455 Posted April 18, 2019 Author ID:1308508 Share Posted April 18, 2019 I uninstalled Chrome as instructed. Same condition exists:-( See attached files. Addition.txt Exported Scan report.txt FRST.txt Link to post Share on other sites More sharing options...
nasdaq Posted April 19, 2019 ID:1308672 Share Posted April 19, 2019 Hi, Open Chrome Setting and remove the extension is present My Inbox Helper If Chrome is Synced with other Devices check if the extension is installed on the device. Remove it if found. === This application is using the Notification notice to show ads. If you get ads in the Lower Right corner of the browser disable it. How to Disable Notifications in Google Chromehttps://gadgets.ndtv.com/apps/features/how-to-disable-notifications-in-google-chrome-643057 Add the site to your block list. === How did I get this.https://forums.malwarebytes.com/topic/245131-random-i_bongacash-javascript-injection/ Keep me posted. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 25, 2019 Root Admin ID:1309475 Share Posted April 25, 2019 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts