Jump to content

Recommended Posts

Hello,

Recently while using Chrome I've started getting ads in new tabs on website where there shouldn't  be any ads. They appear when I double click somewhere on the site or when I click download file from site.

I can't really recall why or when this has started to appear but I believe it is when I downloaded some files from a site called "https://dat-games.com/". I might be wrong but the damage has already been done and now I'm receiving ads in new tabs.

I've tried almost everything: Malwarebytes 3.7.1, Malwarebytes AdwCleaner 7.3.0,  Zemana AntiMalware, CCleaner and HitmanPro 3.8.11 but they didn't do anything after deleting the infected/malicious files to fix the problem I still keep getting random ads in new tabs (I go to the same supposedly ad free website where there shouldn't be any ads and test by double clicking or downloading some .docx files) and the same files keep appearing in malware scan results.

I'm open to suggestion of what should I do to fix this occurring problem.

(I've also uploaded some result of recent scans from above mentioned programs.)

hitmanpro_3.8.11-latest_scan.png

mwb_website_blocked.png

mwb_found_threat.png

mwb_fist_time_scan.png

mwb-adw-cleaner_7.3.0.png

mwb_latest_scan_report.png

Addition.txt FRST.txt

Share this post


Link to post
Share on other sites

I've decided to do another scan using HitmanPro 3.8.11 and here are the results of the scan. As you can see they keep coming back no matter what.

01.png

07.png

02.png

03.png

08.png

04.png

05.png

06.png

Share this post


Link to post
Share on other sites

Hello,

I've completed both instructions step by step and it appears that the ad tabs have finally disappeared however I am not 100% certain it's true are still appearing.

Checking the file it appears to be "chrome.exe"

I've uploaded almost every image of what I've done by the sent instructions and I have also uploaded the new ad tab that appeared after completing the instructions.

2nd_scan_mwb_after_unsync.png

adwcleaner_scan_result.png

sync.png

cleared_search_engine.png

1st_scan_mwb.png

current_blocked_site.png

ad_tab_blocked.png

Share this post


Link to post
Share on other sites

Okay, let's go ahead then and run some scans and see what we can find.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

  • If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • If you don't have Malwarebytes 3 installed yet please download it from here and install it.
  • Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
  • If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

  • Right-click on the program and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Accept the Terms of use.
  • Wait until the database is updated.
  • Click Scan Now.
  • When finished, please click Clean & Repair.
  • Your PC should reboot now if any items were found.
  • After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
  • Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

Share this post


Link to post
Share on other sites

This is one of the tabs that would appear after I double click in the safe site (this safe site should not have any ads).

pup_site_blocked.png

Share this post


Link to post
Share on other sites

But, as you can see. That is from Chrome again. I would be that other browsers don't get this, at least not yet.

 

You do have some old versions of Java that are compromised. Please uninstall all older versions of Java.

Java SE Development Kit 7 Update 80 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170800}) (Version: 1.7.0.800 - Oracle)
Java SE Development Kit 8 Update 191 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180191}) (Version: 8.0.1910.12 - Oracle Corporation)

Then try running this version of cleanup for Chrome

Temporarily disable your Avast antivirus and run the following.

 

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

  • Open Chrome and at the top right, click ellipse.png.2829aeeb2aea006bc956de077091and then More tools and then Extensions
  • Write down the list of Extensions installed.
  • Next, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
  • Scroll down until you see the  reset_chrome_sync.png "reset sync" button to clear your data from the server and remove your passphrase.
  • Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
  • Press the Windows key + R at the same time, to bring up the run dialog box.
     
    • run_command.png
       
  • Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\
  1. Press Ctrl + A to select all the files and folders.
  2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
  3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
  4. Example of all files and folders selected, except Bookmarks

chrome_files_folders.png.00938ead26fa2bd

 

Restart your computer and let me know if the detection is gone

Thanks

Ron

 

 

Share this post


Link to post
Share on other sites

Just like before the new tabs with ads still appear in the site after I double click.

daf0c95d75b9f0164c307e7e99c6094a.png

Share this post


Link to post
Share on other sites

If you mean the suspicious items from HitmanPro you'll need to take it up with them. That is not our product and those are not a threat or an issue. As for the cookie we don't detect cookies as they're not a threat, they are used for tracking which is on purpose and designed to be that way. There are means and tools to remove cookies if you don't want them.

Using an Ad Blocker will typically stop those too.

 

Let's get real. If you're not backing up your data and you're still using Google Chrome then you're just not serious about Privacy, Safety, and protecting your data. Malwarebytes is a fantastic program but you still need to back up your data and you still need to block scripts and Ads in your browser. 
If you're still using Google Chrome I would highly suggest you consider using Firefox instead. For more advanced users you might consider installing NoScript as well (it does have a higher learning curve though)

Help Secure your browsers

Please install uBlock Origin for your browsers to better protect your system

FireFox, ChromeOpera , SafariMicrosoft Edge
AdBlock for Internet Explorer
How to use uBlock Origin to protect your online privacy and security | uBlock Origin tutorial 2018

This video tutorial above explains how to use uBlock Origin in advanced user mode and all the advanced settings to protect your online privacy and help prevent unwanted sites from changing your browser settings

Follow-up Reading

Everything you need to know about cybercrime
10 easy ways to prevent malware infection 
Keep your data backed up

Thank you for choosing Malwarebytes and tell your friends and family too. We're here to help.


Ron

 

 

Share this post


Link to post
Share on other sites

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.