google.hit.gemius.pl in computer

[Positron]

Malware Antimalware detects google.hit.gemius.pl but when I perform a scan, it does not find nor get

rid of the problem. What should I do to get rid of it?

Cheers

Positron

[Maurice Naggar]

Hi @Positron

Please see this  https://forums.malwarebytes.com/topic/249247-valid-malicious-site/

In Malwarebytes, on the Dashboard, right side pane, do a Update run.   You just need to have the current updates.

 

[Positron]

1 hour ago, Positron said:

Malware Antimalware detects google.hit.gemius.pl but when I perform a scan, it does not find nor get

rid of the problem. What should I do to get rid of it?

Cheers

Positron

I think I found a way to delete googlecm.hit.gemius.pl.

I clicked the start, searched for googlecm.hit.gemius.pl and found it. I simply deleted it. However, I wonder why Antimalware premium

failed to find the file, and delete it? Are there other problems that I should be checking out? Just asking.

 

Thanks for that piece of advice, but I always check the updates and it says "Current". Am I missing something?

Thanks for time and efforts.

Positron

[Maurice Naggar]

Where did you find and delete " googlecm.hit.gemius.pl " ??

Was it not the case that there were website block notice messages?   Those were determined to be false positives.

 

Could you run the Support tool, so I can review.

    Download Malwarebytes Support Tool
    
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.4.0.615.exe to run the report
        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
    You will be presented with a page stating, "Get Started!"

    Do NOT use the button “Start repair” !
    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
    Please attach the ZIP file in your next reply.

 

Thank you.

[Positron]

Thanks Maurice, much appreciated. Attached is the zip file for your inspection.

By the way, my HP Deskjet 1050  J410 will print a first line and then just stop, the power light blinking. Any connection?

 

cheers

positron

mbst-grab-results.zip

[Maurice Naggar]

Thanks for the Support tool report.

First, the printer issue is unrelated.

The most recent website block event notices are with Firefox and are about "quickremovevirus.com" & "www.removemalwaretip.com"

 

[ 1 ]

I would like you to delete all Cache & history in Firefox.  Start Firefox.    press and hold SHIFT + CTRL + DELete keys to start the process to delete all browser cache & history.

[ 2 ]

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera.

Scroll down to the tips section "How do I disable them".

 

[ 3 ]

Your pc has both Firefox & Chrome browsers.

also, if you use Chrome or Firefox browser, install the Malwarebytes beta browser extension.  There is one for Chrome & another for Firefox.

To get & install the Malwarebytes beta Chrome extension,

Open this link in your Chrome browser: https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

Then proceed with the setup.

 

To get & install the Malwarebytes beta Firefox extension.

Open this link in your Firefox browser: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

Then proceed with the setup.

.

Restart Windows after making those adjustments.   Then, over the next day or so, let me know how things are regarding any website Block notices.

Thanks,

[Positron]

Thank you so much for your time and expertise Maurice. It is much appreciated. I checked "Block new requests 

asking to allow notifications" and added the malwarebytes add on. So that is done.

 

I have a question or two though. I checked "programs and features" in control panel and "chrome" never comes up.

I know I had it at one time but uninstalled it.

I also checked in "start" and searched "chrome" and did not find it. I take it that Chrome was not fully uninstalled, some files are left?

 

So what I have on my desktop right now is Firefox and Internet Exployer 11.0.9600.19399. Chrome files must be hidden somewhere?

Thanks again for your help Maurice.

steve

[Maurice Naggar]

Hi,  About Chrome.  You indicated you uninstalled it.   How and when ?

While Windows does not list Chrome as a currently installed program, the reports do show remains / traces of Chrome.

Quote

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com
CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default [2019-07-14]
CHR Extension: (Docs) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-03-17]
CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-17]
CHR Extension: (YouTube) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-17]
CHR Extension: (Google Docs Offline) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-07-24]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-17]
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-03-17]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

 

QUESTION:  Do you see a Chrome icon on the desktop or else on the Windows Taskbar ?

 

The report tool named FRSTENGLISH is on the Downloads folder.  Lets use it to do a search for the remains of Chrome on this machine.

Use Windows Explorer and go to the Downloads folder.

Start FRSTENGLISH by double clicking it.
Type the following into the search box exactly as show then press the Search Files button

SearchAll: google chrome;chrome

Please wait while the program searches for all entries relating to this program, when done a search.txt log will be saved to the desktop.

Please attach this log to your next reply.

 

.

[Positron]

4 hours ago, Maurice Naggar said:

Hi,  About Chrome.  You indicated you uninstalled it.   How and when ?

While Windows does not list Chrome as a currently installed program, the reports do show remains / traces of Chrome.

 

QUESTION:  Do you see a Chrome icon on the desktop or else on the Windows Taskbar ?

 

The report tool named FRSTENGLISH is on the Downloads folder.  Lets use it to do a search for the remains of Chrome on this machine.

Use Windows Explorer and go to the Downloads folder.

Start FRSTENGLISH by double clicking it.
Type the following into the search box exactly as show then press the Search Files button

SearchAll: google chrome;chrome

Please wait while the program searches for all entries relating to this program, when done a search.txt log will be saved to the desktop.

Please attach this log to your next reply.

I believe I uninstalled it less than a year ago. I forgot to uncheck the box when downloading another program and chrom was installed. I used

"programs and features" in control panel to delete it.

No Chrone icon on the desktop.

4 hours ago, Maurice Naggar said:

 

.

 

Search.txt

[Maurice Naggar]

Hi.  Thanks for the Search log.   There are traces of Chrome still present.

This  is for Positron  only.

 

Please Close and save any open work files before you start this next step.  It may involve a Windows Restart at the end of it.

I am sending a   custom Fix script which is going to be used by the FRSTENGLISH tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE AS and save it directly ( as is) to the Downloads folder

The tool named FRSTENGLISH.exe  is already on the Downloads folder.

Start the Windows Explorer and then, open the Downloads folder.


Double click FRSTENGLISH

  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
Click the Fix button just once, and wait.

 

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. Some machines take longer than others.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Kindly attach the Fixlog.txt with your next reply

and

Let me know how this goes.   Let me know if the original issue is now gone.   Let me know if you need anything else.

 

Regards,

Maurice

Fixlist.txt

[Positron]

31 minutes ago, Maurice Naggar said:

Hi.  Thanks for the Search log.   There are traces of Chrome still present.

This  is for Positron  only.

 

Please Close and save any open work files before you start this next step.  It may involve a Windows Restart at the end of it.

I am sending a   custom Fix script which is going to be used by the FRSTENGLISH tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE AS and save it directly ( as is) to the Downloads folder

The tool named FRSTENGLISH.exe  is already on the Downloads folder.

Start the Windows Explorer and then, open the Downloads folder.


Double click FRSTENGLISH

  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
Click the Fix button just once, and wait.

 

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. Some machines take longer than others.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Kindly attach the Fixlog.txt with your next reply

and

Let me know how this goes.   Let me know if the original issue is now gone.   Let me know if you need anything else.

 

Regards,

Maurice

Thanks so much for taking the time and efforts involved Maurice. I ran the program, and restarted quicker than I thought. I  attached

the fixlot.txt file.

Again, thank you so much for your time and efforts. I will keep in touch.

steve

31 minutes ago, Maurice Naggar said:

Fixlist.txt 1.03 kB · 1 download

 

Fixlog.txt

[Maurice Naggar]

Hi Steve,

Thanks for the Fixlog.  The run did what it was intended to do.  There is no more traces of Chrome on this machine.

I am glad to have helped.

You are better off not having, not using Chrome.  It is the hardest to clean when it comes to pesky situations.

I believe your pc should be good to go.  If you have other issues at this point, let me know.

I will have this case marked for closure.   You can delete the files I had you download.

All the best to you.

Sincerely,

Maurice

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks