Jump to content

Malware/Adware deleted with malwarebytes shows back up in next scan


Recommended Posts

Hello, 

I discovered malware/adware with a recent scan using malwarebytes and when I quarantined/deleted them and rescanned right after and they showed up again.  I also scanned with adwcleaner (some things showed up, and when I deleted them and restarted the computer they showed up in the next scan), and sophos virus remover (nothing showed up).  I also tried scanning in safe mode but that had similar results.  I also did a scan with FRST64 but I do not have a fixit file so I couldn't do anything else with that.  I have run out of ideas since every scan finds the same things and when they are deleted they show up in the next scan right after.  

 

I will attach the files I have seen asked for in other questions.  

Addition.txt FRST.txt AdwCleaner[C05].txt malwarebytes scan log.txt

Link to post
Share on other sites

Hi,  @pyrosoad     :welcome:

My name is Maurice. I will be helping and guiding you, going forward on this case.

The two items flagged by Malwarebytes are PUP  & are associated to Chrome.

Using Chrome browser,   go to https://www.google.com/settings/chrome/sync and sign into your account.
Scroll down until you see the "reset sync" button and click on the button
At the prompt click on "Ok".

+

Other suggestions, for Chrome, while Chrome is running:
Press & hold SHIFT+CTRL+Del keys to get menu for clearing browsing data:

Check "Empty the cache"
and press Clear browsing data button

now, Exit out of Chrome.   Restart Chrome.   Let me know if now it is normal.   IF you get another block notice, let me know what website link it is on  & what other programs are running on this box.

You should also do a new scan run with Malwarebytes for Malware.  And then one run with Adwcleaner.

 

Regards,

Link to post
Share on other sites

The 4 items are P U P  with Chrome browser at

C:\USERS\MITCHELL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\Web Data

P U P are Potential Unwanted Programs.   In this situation, it is more like leftover trace history in Chrome history.

PUP are not malware.

PUP.Optional.WinYahoo  >>  see  https://blog.malwarebytes.com/detections/pup-optional-winyahoo/

PUP.Optional.ASK   >> see   https://blog.malwarebytes.com/detections/pup-optional-ask/

PUP.Optional.Conduit  >> see https://blog.malwarebytes.com/detections/pup-optional-conduit/

Fact is, Chrome browser is the hardest to clean out.

.

The next thing I would like you to do is to run the cleanup tool from Chrome - https://www.google.com/chrome/cleanup-tool/
It is made specifically by Chrome to cleanup Chrome browser.
 

.

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera.

Scroll down to the tips section "How do I disable them".

also, if you use Chrome or Firefox browser, install the Malwarebytes beta browser extension.  There is one for Chrome & another for Firefox.

To get & install the Malwarebytes beta Chrome extension,

Open this link in your Chrome browser: https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

Then proceed with the setup.

 

After all is done, let me know how things are.

Link to post
Share on other sites

Thank you for the status update.

I would suggest a free scan with the ESET Online Scanner
Go to https://www.eset.com/us/home/online-scanner/

Look on the right side of the page.  Click Scan Now
It will start a download of "esetonlinescanner_enu.exe"
Save the file to your system, such as the Downloads folder, or else to the Desktop.

Go to the saved file, and double click it to get it started.
When presented with the initial ESET options, click on "Computer Scan".

Next, when prompted by Windows, allow it to start by clicking Yes

When prompted for scan type, Click on Full scan
Click on the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.

Have patience.  The entire process may take an hour or more. There is an initial update download.
There is a progress window display.
You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.

Link to post
Share on other sites

Thanks for the ESET scan log report.  It did not find anything on your live system.  The 2 items it tagged & removed  were inert.  They were in sub-folders under the "Windows.old"  which is the older (prior ) installation of Windows.

 

This  is for pyrosoad  only.

Please Close and save any open work files before you start this next step.  It may involve a Windows Restart at the end of it.

I am sending a   custom Fix script which is going to be used by the FRST64 tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE AS and save it directly ( as is) to the Desktop

The tool named FRST64.exe  is already on the Desktop folder.

Start the Windows Explorer and then, open the Desktop folder.


Double click FRST64

  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
Click the Fix button just once, and wait.

 

FRST_Fixl.png.c4c1c0dddcc49b11fa400590f070bd5e.png

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. Some machines take longer than others.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Kindly attach the Fixlog.txt with your next reply

Fixlist.txt

Link to post
Share on other sites

OK, Thanks for the Fixlog.   That is a good run.  Previously, I had you turn off the Sync feature in Chrome, and also suggest to set notification push ads in Chrome to off; and to install the Malwarebytes Chrome browser extension.

 

I would like for you to locate where you saved Adwcleaner and delete it.

I  would suggest to download, Save, and then run Malwarebytes ADWCLEANER.

Please close Chrome and all other open web browsers after you have saved the Adwcleaner and before you start Adwcleaner.

 

Please download  Malwarebytes AdwCleaner from here:
Click the blue Download button.   ( do not pay attention to the other text displayed on that screen).

Be sure to Save the file first, to your system.  Saving to the Downloads folder should be the default on your system.

 

Go to the folder where you saved Adwcleaner. Double click AdwcleanerGUI  to start it.

At the prompt for license agreement, review and then click on I agree.

 

You will then see a main screen for Adwcleaner. ( if you do not see it right away, minimized the other open windows, so you can see Adwcleaner).

Then click on Dashboard button.

Click the blue button "Scan Now".

 

allow it a few minutes to finish the Scan.   Let it remove what it finds.

NOTE:  When it comes to the section "

Pre-installed applications

 

You can skip that.

Please find and send the Adwcleaner "C" clean report.

In Adwcleaner, click the "Reports" button.  Look at the list of reports for the latest date & type "Clean".

Double Click that line & it will open in Notepad.   Save the file to your system and then Attach that with your reply.

Thanks.  Keep me advised.

 

Link to post
Share on other sites

  • Root Admin

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.