Same Same threats keep coming back after being quarantined

[Dr_Bombay]

Hello - Need some help please!  Working on a computer that keeps getting the same 59 threats even after MWB says they are quarantined. I have also run ADWcleaner and it also keeps finding threats, not as many and sometime none but I can't seem to keep the system clean.  All 59 treats are for MindSpark and all are located/related to Chrome extensions.  Attached are the log files from a scan with FarBar.  Any suggestion would be appreciated!!

Addition.txt FRST.txt

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab on the left column
   
7. Click the Gather Logs button
   
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

[exile360]

Greetings,

Please see if the instructions in this post help.  It is a common issue with Chrome for detections to return and those instructions can usually resolve it.

Please let us know how it goes.

Thanks

[Dr_Bombay]

Thanks for the suggestions.  It appears that the issue here is Google Sync.  I was not able to fully complete the instruction regarding Sync but got far enough to turn it OFF.  Since SYNC has been off I have re-scanned and re-booted the computer multiple times and the result is that the threats are not longer coming back or being detected. So that is success!  I don't know if SYNC can be fixed and re-enabled (I do not have full access to this google account) and not have MWB detect threats but that is for another day.  Thanks!

[exile360]

Excellent, I'm glad I was able to help

If there's anything else we might assist you with please let us know.

Thanks

[AdvancedSetup]

Please run the following and we'll double-check that the system is clean

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[Dr_Bombay]

Reply to: Advance Setup post.  Follow you procedure per you post and all seems to be good. Files attached as requested.  However, I am wondering if the issue could come back if the user re-enables Google Sync.  Once I disable (turned off) sync MWB was able to clean and keep the threats from coming back.  I also tried to follow the procedure that was linked in exile360's post above regarding turning off and resetting Google Sync but I was not able to follow the entire procedure only up to the point of turning off sync not resetting sync which seem to do the trick.   I have also attached the original threat scan that shows the repeating threats so that maybe you can tell if these are really issue or not, file name "threat scan 59 issues".  Thanks for the follow up!

Addition.txt AdwCleaner[C05].txt FRST.txt Threat scan results.txt Threat scan 59 issues.txt

[AdvancedSetup]

Please uninstall the following software. From Control Panel, Programs, Add/Remove

Bonjour
Java 8 Update 45
Java 8 Update 51
 

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

 

Ron

 

[Dr_Bombay]

Ok - followed you procedure exactly - attached is the fixlog file.  Just as FYI, it saved to the FRST64 folder not to the desktop.

Fixlog.txt

[AdvancedSetup]

Thanks. The log looks good. The reason it did not save to the Desktop is that in STEP 3 above the program was not saved to the Desktop. It was saved and ran from C:\Users\GM\Documents\Temp Bernd\FarBar so it saved the log there.

When you remove the Google Chrome Sync that deletes it. As long as you don't have another device like a phone that also has Sync enabled then you can setup Sync again. However, please read the following below first to help you keep your system clean going forward.

 

Let's get real. If you're not backing up your data and you're still using Google Chrome then you're just not serious about Privacy, Safety, and protecting your data. Malwarebytes is a fantastic program but you still need to back up your data and you still need to block scripts and Ads in your browser. 
If you're still using Google Chrome I would highly suggest you consider using Firefox instead. For more advanced users you might consider installing NoScript as well (it does have a higher learning curve though)

Help Secure your browsers
 
Please install uBlock Origin for your browsers to better protect your system

FireFox, Chrome, Opera , Safari, Microsoft Edge
AdBlock for Internet Explorer
How to use uBlock Origin to protect your online privacy and security | uBlock Origin tutorial 2018

This video tutorial above explains how to use uBlock Origin in advanced user mode and all the advanced settings to protect your online privacy and help prevent unwanted sites from changing your browser settings

Delete Cookies Automatically

Cookie AutoDelete plugin
Chrome  | Firefox 

Browser push notifications: a feature asking to be abused
HTTPS Everywhere
NOTHING TO HIDE documentary

Review your email and Office choices

Quit Gmail for free encrypted email - Tutanota
Why ProtonMail Is More Secure Than Gmail
LibreOffice - Free and open source office suite

Use Password Management software

Bitwarden
KeePass Password Safe

Encrypted Instant Messenger and Voice Calls

Riot
Signal
Wickr Me

Follow-up Reading

Everything you need to know about cybercrime
10 easy ways to prevent malware infection 
Keep your data backed up

Thank you for choosing Malwarebytes  as your preferred security protection software and tell your friends and family too. We're here to help.

Ron

 

Edited August 5, 2019 by AdvancedSetup
updated information

[Dr_Bombay]

Thanks for all the help and great information for going forward.  Please consider this issue resolved/closed.

PS - MWB 3 and its support just got you another new customer!

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks