Trojan.LNKHijacker.ClnShrt

[Sicko]

Hello, 

I have scanned my laptop with Malwarebytes, recently. It ended up showing several PUPs and this Trojan.LNKHijacker.ClnShrt as well. It moved them into quarantine, deleted them and restarted my laptop. It's ok until I'm still without internet connection. When I turn my internet connection on and start scanning, it finds it again with these PUPs. It shows that they are somehow connected with chrome browser, even though i have already deleted the chrome browser. Can you help me, please? Can you provie me with some advice, which can solve this problem?

Thanks, 

Sicko

[Maurice Naggar]

Hello,

My name is Maurice.  I will be helping and guiding you.

We need to get information from this machine in order to have the proper detail to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

    Download Malwarebytes Support Tool
    
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.4.0.615.exe to run the report
        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
    You will be presented with a page stating, "Get Started!"

    Do NOT use the button “Start repair” !
    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
    Please attach the ZIP file in your next reply.

 

Thank you.

[Sicko]

Hi,

I have followed your instructions and I´m sending the .zip file.

Thanks,

Sicko

mbst-grab-results.zip

[Maurice Naggar]

Hi,

Thank you for the support tool report.  I see that Malwarebytes is running in the Free trial mode.

The "Trojan.LNKHijacker.ClnShrt"  is about some Chrome "default web data"  ( history on Chrome).

Chrome can be the hardest to clean up.

First thing, set the Google Chrome "Sync" to OFF

I need you to go to https://www.google.com/settings/chrome/sync and sign into your account.
Scroll down until you see the "reset sync" button and click on the button
At the prompt click on "Ok".

[ 2 ]

I would suggest to download, Save, and then run Malwarebytes ADWCLEANER.

Please close Chrome and all other open web browsers after you have saved the Adwcleaner and before you start Adwcleaner.

 

 

Please download the current release for Malwarebytes AdwCleaner from here:
https://downloads.malwarebytes.com/file/adwcleaner

 

Go to the folder where you saved Adwcleaner. Double click Adwcleaner to start it.

At the prompt for license agreement, review and then click on I agree.

 

You will then see a main screen for Adwcleaner. ( if you do not see it right away, minimized the other open windows, so you can see Adwcleaner).

Then click on Dashboard button.

Click the blue button "Scan Now".

 

allow it a few minutes to finish the Scan.

 

You should then see a screen showing "Scan results".

Review what is listed. If something is listed that you know for sure is safe, then for that line, click the check-box on the left so that it is un-checked.

(NOTE, clicking the small right pointed little arrow, will cause the screen to refresh & show all line items . )

 

When ready, click on the button "Clean and repair".

If prompted to restart then click on "Clean & Restart Now".

 

When You see screen with "Your cleanup is complete", click on the View Log file button.

It should then show as a open window in your text editor ( normally Notepad).

Do a File >> Save As, given it a unique name and Save to your Desktop or some other permanent folder.

 

Kindly provide a copy of that run report. Attach it with reply.

 

When done with Adwcleaner, click the X button to Exit out.

Thank you.

[Sicko]

Hello,

I´m sending the report from the Adwcleaner. I have done everything like in the instructions.

 

Thanks,

Sicko

AdwCleaner[C00]-Sicko.txt

[Maurice Naggar]

That is a good cleanup run by Adwcleaner.  The majority of those were inert registry entries  ( no payload).

 

How are things now ?

 

Run a scan with Malwarebytes.
Start Malwarebytes from the Start menu.

Click Settings. Then click the Protection tab.
Scroll down and lets be sure the line in SCAN OPTIONs for "Scan for rootkits" is ON
Click it to get it ON

Click the SCAN button.
Select a Threat Scan ( which should be the default).

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

Then click on Quarantine selected.

 

Be sure all items were removed.

When that is completed, kindly send the report.
In Malwarebytes.
Click the Reports button ( on the left )
Look for the "Scan Report" that has the most recent Date and time.

When located, click the check box for it and click on View Report.
Then click the Export button at the bottom left.
Then select Text File (*.txt)

Put in a name for that file and remember where the file is created.

Then attach that file with your reply.

Cheers,

[Sicko]

I´m atttaching a report from Malwarebytes.

Regards,

Malwarebytes-cleanup-Sicko.txt

[Maurice Naggar]

Thank you for the Malwarebytes scan report.   Malwarebytes reports Nahradené   ~ ~ ~ > = " replaced "

 

The Google Chrome sync can make Chrome cleanups more difficult.

I suggest you  go to https://www.google.com/settings/chrome/sync and sign into your account.
Scroll down until you see the "reset sync" button and click on the button
At the prompt click on "Ok".

.

Now then, earlier you wrote

Quote

i have already deleted the chrome browser.

?

If all you use is only the AVG Secure browser, it is likely what is causing this oddity.

[Sicko]

Yes I had uninstalled the chrome before. Then i followed your instructions where you suggested me to do the sync reset so I downloaded the chrome again to do it. My main browser,which i use is chrome, i also have avg security browser installed but i´m not using it. Now i´m using Edge to write on this forum. I have made another scan and all it shows is still Trojan.LNKHijacker.ClnShrt. No other PUPs were detected during that scan.

Thanks for answering me,

 

[Sicko]

Hi,

It´s me again and I made another scan. It shows no other PUPs, just the Trojan.LNKHijacker.ClnShrt as before. I´m also attaching a report from the Malwarebytes.

What would you suggest me to do now? I was searching on the internet again and found this post, which was posted yesterday, about deleting it from the system. https://uninstallandremoveit.com/trojan-lnkhijacker-clnshrt-removal-steps/ 

Should I follow all the steps and try to remove it?

Thanks 

 

Malwarebytes-scan-Sicko.txt

[Maurice Naggar]

I do not recommend spyhunter.   That articles main goal is to entice you to use it.   Dont.

The first generic tips are very generailzed.  Most folks are not familiar with Windows Task Manager & also are untrained on what is good & safe & normal & what is not.

And please do not go to using Regedit, unless you are trained about it.

.

 

The next thing I would like you to do is to run the cleanup tool from Chrome - https://www.google.com/chrome/cleanup-tool/
It is made specifically by Chrome to cleanup Chrome browser.



If running the cleanup tool for Chrome did not help the problem then I would like to reset chrome back to defaults.


You can keep your "Bookmarks" if you want to keep them, but you have to export them first - http://support.google.com/chrome/bin/answer.py?hl=en&answer=96816 - Everything else should be removed.

Then I need you to go to https://www.google.com/settings/chrome/sync and sign into your account.
Scroll down until you see the "reset sync" button and click on the button
At the prompt click on "Ok".
 

Reset Your Browser Settings

 

1. In the top-right corner of the browser window, click the "Chrome Menu" icon (Three horizontal lines)
2.  
3. At the bottom, click "advanced "
4. Scroll down until you see "Reset", Then click where it says "restore settings to their original defaults".
5. In the dialog that appears, click "Reset".

Close Chrome and restart it and check it out for me please

[Maurice Naggar]

p.s.  IF your pc really does not have Chrome browser, but you use the AVG secure browser, you will need to research about the AVG browser.

See about saving bookmarks  & Resetting that browser.

[Sicko]

Hi,

I hope this is my last post about this problem. I followed your instructions.

Firstly, I looked on Internet to find out more about AVG browser. I´m not sure but it seems to me that Chrome and AVG browser share majority of the files and I think that´s why i couldn´t get rid of it. Ok, so  what i did was I reset the settings in AVG browser (didn´t help), so i uninstalled it. 

Secondly, I tried to run the Chrome cleanup tool, which didn´t find anything suspicious. Then I reset the settings in Chrome, as you suggested.

In the end, I uninstalled it to check if it would help. I can´t really tell if it was some kind of a hidden extention  because when I ran the Malwarebytes scan again it didin´t find anything. I checked the quarantine, there was still  a Trojan.LNKHijacker.ClnShrt, which was found earlier but couldn´t be delleted from previous scans. Quarantine was totally cleaned up. I made last 2 scans (one default, one with all storage devices) and it didn´t find anything again. I´m also attaching the reports.

I hope I did everything right and it won´t somehow come back again. Can it be installed back (Trojan...) after installing the Chrome browser?

What do you think? What´s your opinion on this?

Is it completely removed from the system? Should I run some scans with other specific antimalware programs?

Anyway, I´d like to thank you Maurice for helping me to solve this problem. I wish you good luck with solving other problems on this forum.

Thanks for answering me,

Sicko

 

PS. It looks like the laptop is running faster, but again, I can´t really tell, maybe it´s just a feeling. 

 

 

Final-cleanup-Sicko.txt Final-allcleanup-Sicko.txt

[Maurice Naggar]

The 2 scan reports are good.   Thanks for sending the copies.

The link hijacker is gone.  I would not expect for it to re-appear on its own.  And I would not expect it to come from a new browser install.

Though I would suggest to be using some other browser than Chrome.

Firefox with Noscript will do better.

 

 

Your pc is good to go.  We can plan to close this case.   You can delete the tools I had you get.

Be sure you do Backups on a regular basis of all important personal documents, files, etc. Backup is your best friend.
 

If you will practice safe computer & web practices, you should do well.

It is not enough to just have a security program installed. Each pc user needs to practice daily safe computer and internet use.

 

Safer practices & malware prevention:
Follow best practices when browsing the Internet, especially on opening links coming from untrusted sources.
First rule of internet safety: slow down & think before you "click".
Free games & free programs are like "candy". We do not accept them from "strangers".

Never open attachments that come with unexpected ( out of the blue ) email no matter how enticing.
Never open attachments from the email itself. Do not double click in the email. Always Save first and then scan with antivirus program.

Never click links without first hovering your mouse over the link and seeing if it is going to an odd address ( one that does not fit or is odd looking or has typos).

 

Pay close attention when installing 3rd-party programs. It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed.
Take great care in every stage of the process and every offer screen, and make sure you know what it is you're agreeing to before you click "Next".

Use a Standard user account rather than an administrator-rights account when "surfing" the web.
See more info on Corrine's SecurityGarden Blog http://securitygarden.blogspot.com/p/blog-page_7.html
Dont remove your current login. Just use the new Standard-user-level one for everyday use while on the internet.


Check in at http://windowsupdate.microsoft.com 
Windows Update and install any Important Updates offered.

Make certain that Automatic Updates is enabled.
https://support.microsoft.com/en-us/help/12373/windows-update-faq

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

For other added tips, read "10 easy ways to prevent malware infection"

 

Special NOTE:

This Windows is running Windows 10 Build 1803.    

The Windows 10 May 2019 Update is  available to download and install from the Windows Update page in Settings. Choose a time that works best for you to download the update. You'll then need to restart your device and complete the installation. After that, your device will be running Windows 10, version 1903.

To manually check for the latest recommended updates, select the Start  button, then select Settings > Update & Security  > Windows Update .

This build is metered and controlled by Microsoft.  If you do not get offered 1903, do keep trying.   I'd suggest trying every day or every other day, at the top of the hour.

.

If you have any questions at this time, let me know.

I am glad to have helped you.

Best wishes,

Sincerely,

Maurice

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks