Trojan a.securing-request.com blocked accessing any site using Chrome

[nick_f]

My Norton anti-virus and Malwarebytes is currently blocking a Trojan from accessing a.securing-request.com each time I visit a site in Chrome.

I've run a Threat Scan and Farbar Recovery scan (logs attached).

Please advise...

Thanks!

 

Addition.txt FRST.txt threatscan-log.txt

[Maurice Naggar]

Hi, 

I will be helping and guiding you, going forward.

Thank you for the FRST & log.

We need to get  additional information from this machine in order to have fuller  detail to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

    Download Malwarebytes Support Tool
    
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.4.0.615.exe to run the report
        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
    You will be presented with a page stating, "Get Started!"
    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
    Please attach the ZIP file in your next reply.

 

Thank you.

 

[nick_f]

Hi Maurice

Thanks for getting back to me...

I've attached the requested file.

mbst-grab-results.zip

[Maurice Naggar]

Hi Nick,

Thanks for the zip file report.  These events were website block notices by the Malwarebytes web protection.

They seem to only have started on the 16th & only happen when Chrome is in use.   ( makes you wonder if you get similar blocks with Edge browser or Mozilla Firefox ?

 

The web protection is keeping the pc safe.   Lets do a first test with Chrome.  I am suggesting this just because Chrome looks to have a rather heavy number of browser extensions.

You can make Chrome to start in reduced mode, called Incognito mode, by putting a parameter at startup.
First, close any prior instances of Chrome by closing it via the X close button or  via Task Manager.
Then press Windows-key+R for the RUN option and then put a command line similar to this {do use COPY & PASTE}

....copy the whole line as is

chrome.exe -incognito

Does Chrome now load ok, without issue?

 

[nick_f]

Yes - this only started happening yesterday (15th) - and it only happens in Chrone, not Firefox or Edge.

I've now opened Chrome in incognito mode.

[Maurice Naggar]

In incognito mode.....  has it run into a website block notice?   That is something I very much need to know.

 

Further, just as a pointer, when a website block message box shows up, it should time out and go away after a  few seconds.

Do you notice that ?     we can also make the program close those messages after 3 seconds.

Also, lets please be slow and observant.    Even with the notice message, we can click the X control on the mini window & force it to close.   and then, still be able to use the Address bar of Chrome browser to go to a regular site.

[nick_f]

I haven't had the block notice pop up using Chrome in incognito yet - I've tested for a few minutes.

It's intermittent using Chrome in normal mode - it doesn't happen every time. There doesn't seem to be any logic to when it happens. Sometimes it happens on a Google search, or opening sites I use regularly - and sometimes not.

Yes - the block message disappears after a few seconds. It never prevents the regular website from loading.

I can also close the notice message with the X control. Again, it never prevents the regular website I was trying to access from opening in the first place.

Let's say I'm trying to access bbc.co.uk - the message pops up - but the browser still navigates to bbc.co.uk

[Maurice Naggar]

Thank you for those notes.  That is a big useful clarification.   That is exactly as it should be.  The notice shows, but one is still able to use the browser and get around to where you need to.

Lets make this tweak.   Mind you it is not meant as a solution.   Just a tweak.

Start Malwarebytes.   Click Settings.  Click the Application tab.  Scroll down to Notifications.

on the 2nd line in that section, "Close notifications after"   use the drop down list control to select "After 3 seconds" .

Apply that adjustment.   Close the window.  3 seconds is the least amount one can pick.

 

Back to Chrome in Incognito mode.....  try visiting bbc.co.uk

does the block notice happen or not ?

My view is that it is likely that either the sites visited may have a corrupted ad network advertiser,   some sort of malvertising,

or else, here on this machine, that one of the Chrome extensions is the source.

This is why testing in Incognito mode is key.

 

 

[nick_f]

I've made that change in MWB.

I haven't had the notice occur on visiting any sites in Incognito mode, BBC included, as of yet.

I don't think it's a website issue - I've visited many diverse clean sites in Chrome (normal mode) where the message has popped up.

Also - which I think proves it's on the machine - when I just visited the extensions page in Chrome ( chrome://extensions/ ) - the warning notice popped up...

[Maurice Naggar]

To the last point you mention  ..... Chrome extensions.....

It would be worthwhile for you to do a full review of the list of add-on Extension in Chrome

with a special focus on the most recent ones added.......

see about disabling ones you really really do not need.

 

such as for example ....    Video Downloader professional

[nick_f]

I've now removed several extensions. There were none that I installed recently, though - and certainly not within the last 2 days when the issue started.

[Maurice Naggar]

What did you remove from Chrome ?

and

did you remove Video Downloader professional ?

 

then, how is Chrome doing since then?

[nick_f]

I don't have the full list I removed - but I got rid of several. The only ones left I've used for a long time and trust.

Yes I removed Video Downloader Professional.

The problem still persists after doing this...

[nick_f]

Hi Maurice

Any ideas on what I can try next?

Thanks!

[Maurice Naggar]

Hi,

I believe you reported that when using Chrome Incognito mode there is no block notice.

That the block notices only happen if you are using Chrome.

.

You may do some browser "beefing up" to help in general  to reduce unwanted ads.

beef up each web browser ( put an ad block extension).
Malwarebytes has a browser extension for Chrome & a separate one for Firefox browser.

 

See this article on our Malwarebytes Blog
How to tighten security and increase privacy on your browser

.

Look at the following Malwarebytes Blog article and scroll down to the section marked *Clear your browser's cache* 
and do that for each of your web browser programs.
https://blog.malwarebytes.com/puppum/2017/04/adware-the-series-part-1/

.

Look at the following Blog article & turn off push notifications for Chrome, Firefox, Edge, Opera
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

.

I would suggest to download, Save, and then run Malwarebytes ADWCLEANER.

Please close Chrome and all open web browsers after you have saved the Adwcleaner and before you start Adwcleaner.

 

 

Please download the current release for Malwarebytes AdwCleaner from here:
https://downloads.malwarebytes.com/file/adwcleaner

 

Go to the folder where you saved Adwcleaner. Double click Adwcleaner to start it.

At the prompt for license agreement, review and then click on I agree.

 

You will then see a main screen for Adwcleaner. ( if you do not see it right away, minimized the other open windows, so you can see Adwcleaner).

Click the blue button "Scan Now".

 

allow it a few minutes to finish the Scan.

 

You should then see a screen showing "Scan results".

Review what is listed. If something is listed that you know for sure is safe, then for that line, click the check-box on the left so that it is un-checked.

(NOTE, clicking the small right pointed little arrow, will cause the screen to refresh & show all line items . )

 

When ready, click on the button "Clean and repair".

If prompted to restart then click on "Clean & Restart Now".

 

 

 

When You see screen with "Your cleanup is complete", click on the View Log file button.

It should then show as a open window in your text editor ( normally Notepad).

Do a File >> Save As, given it a unique name and Save to your Desktop or some other permanent folder.

 

Kindly provide a copy of that run report. Attach it with reply.

 

When done with Adwcleaner, click the X button to Exit out.

Thank you.

[nick_f]

I've cleared out my Chrome cache. There's no issue with push notifications - I have it set to permisson based, and I never accept them.

I've run the AdwCleaner - and the logs are attached below.

The problem is still persisting, in Chrome only as ever.

Thanks...

 

AdwCleaner[C00].txt AdwCleaner[S00].txt

[nick_f]

I've just sorted this problem. I disabled all my Chrome extensions, and then re-enabled them one at a time.

It turned out it was one of them - the Vimeo Video Downloader - that was the problem.

I hadn't suspected it, as I'd been using that extension for years, with no issue.

Anyway, I've removed the extension, and I'm getting no more notices.

Thanks for your help getting to the bottom of this...

[Maurice Naggar]

I appreciate your information about Vimeo Video Downloader .

Much appreciated.

I had a view all along that it was some add-on in the Chrome browser that was at the source of it all.

You may keep and use Adwcleaner as desired.

You may if you wish delete the tools I had you download.

I am glad to have helped.   If you need something at this time, let me know.

All the best to you.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks