Ads appear in new tabs

[Sakyre]

Hello,

Recently while using Chrome I've started getting ads in new tabs on website where there shouldn't  be any ads. They appear when I double click somewhere on the site or when I click download file from site.

I can't really recall why or when this has started to appear but I believe it is when I downloaded some files from a site called "https://dat-games.com/". I might be wrong but the damage has already been done and now I'm receiving ads in new tabs.

I've tried almost everything: Malwarebytes 3.7.1, Malwarebytes AdwCleaner 7.3.0,  Zemana AntiMalware, CCleaner and HitmanPro 3.8.11 but they didn't do anything after deleting the infected/malicious files to fix the problem I still keep getting random ads in new tabs (I go to the same supposedly ad free website where there shouldn't be any ads and test by double clicking or downloading some .docx files) and the same files keep appearing in malware scan results.

I'm open to suggestion of what should I do to fix this occurring problem.

(I've also uploaded some result of recent scans from above mentioned programs.)

Addition.txt FRST.txt

[Sakyre]

I've decided to do another scan using HitmanPro 3.8.11 and here are the results of the scan. As you can see they keep coming back no matter what.

[AdvancedSetup]

Hello  @Sakyre and

Please follow the directions from the following topic and let me know if that corrects the issue.

 

Thanks

Ron

 

[Sakyre]

Hello,

I've completed both instructions step by step and it appears that the ad tabs have finally disappeared however I am not 100% certain it's true are still appearing.

Checking the file it appears to be "chrome.exe"

I've uploaded almost every image of what I've done by the sent instructions and I have also uploaded the new ad tab that appeared after completing the instructions.

[AdvancedSetup]

Okay, let's go ahead then and run some scans and see what we can find.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[Sakyre]

Here are all the reports.

malwarebytes-scan-04-28.txt AdwCleaner[C16].txt FRST.txt Addition.txt

[Sakyre]

This is one of the tabs that would appear after I double click in the safe site (this safe site should not have any ads).

[AdvancedSetup]

But, as you can see. That is from Chrome again. I would be that other browsers don't get this, at least not yet.

 

You do have some old versions of Java that are compromised. Please uninstall all older versions of Java.

Java SE Development Kit 7 Update 80 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170800}) (Version: 1.7.0.800 - Oracle)
Java SE Development Kit 8 Update 191 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180191}) (Version: 8.0.1910.12 - Oracle Corporation)

Then try running this version of cleanup for Chrome

Temporarily disable your Avast antivirus and run the following.

 

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• Open Chrome and at the top right, click  More tools  Extensions
• Write down the list of Extensions installed.
• Next, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the run dialog box.
   
  • 
     
• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks

 

Restart your computer and let me know if the detection is gone

Thanks

Ron

 

 

[Sakyre]

Just like before the new tabs with ads still appear in the site after I double click.

[AdvancedSetup]

If you mean the suspicious items from HitmanPro you'll need to take it up with them. That is not our product and those are not a threat or an issue. As for the cookie we don't detect cookies as they're not a threat, they are used for tracking which is on purpose and designed to be that way. There are means and tools to remove cookies if you don't want them.

Using an Ad Blocker will typically stop those too.

 

Let's get real. If you're not backing up your data and you're still using Google Chrome then you're just not serious about Privacy, Safety, and protecting your data. Malwarebytes is a fantastic program but you still need to back up your data and you still need to block scripts and Ads in your browser. 
If you're still using Google Chrome I would highly suggest you consider using Firefox instead. For more advanced users you might consider installing NoScript as well (it does have a higher learning curve though)

Help Secure your browsers

Please install uBlock Origin for your browsers to better protect your system

FireFox, Chrome, Opera , Safari, Microsoft Edge
AdBlock for Internet Explorer
How to use uBlock Origin to protect your online privacy and security | uBlock Origin tutorial 2018

This video tutorial above explains how to use uBlock Origin in advanced user mode and all the advanced settings to protect your online privacy and help prevent unwanted sites from changing your browser settings

Follow-up Reading

Everything you need to know about cybercrime
10 easy ways to prevent malware infection 
Keep your data backed up

Thank you for choosing Malwarebytes and tell your friends and family too. We're here to help.

Ron

 

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks