Jump to content

Recommended Posts

I've started getting Windows notifications that the site cloud1.pw has been updated in the background on Chrome.  Have run adware cleaner and it found 1 registry link for a video downloader I use and something to do with banggood but nothing else.  Very disappointed that nothing was picked up by my paid version of malwarebytes but more importantly how do I get rid of it?

Share this post


Link to post
Share on other sites

Hi,  @findeep     :welcome:

My name is Maurice. I will be helping and guiding you, going forward on this case.


We need to get information from this machine in order to have the proper detail to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

    Download Malwarebytes Support Tool
    
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.4.0.623.exe to run the report
        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
    You will be presented with a page stating, "Get Started!"

    Do NOT use the button “Start repair” !
    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
    Please attach the ZIP file in your next reply.

 

Thank you.

 

Share this post


Link to post
Share on other sites

Maurice

I've attached the logs.  I did download hitmanpro from Sophos which did find some things and cleaned them ...seeing as MB didn't find anything

mbst-grab-results.zip

Share this post


Link to post
Share on other sites

Thanks for the report file.  The Chrome  browser has an extension called "Cloud Browser"

Lets get that uninstalled  & then see if the "cloud1" thing goes away.

 

Start Chrome.

Look on the upper top right and click on the 3 dots ( or dashes) menu icon of Chrome ( top bar). 

Then click on More Tools > then click on EXTENSIONS.

 

Look for " Cloud Browser "

then if you see on its right a blue color slider, click or slide it to the left so that it is dimmed to grey color ( turned off)

Then click on REMOVE with your mouse.

Please confirm the uninstall on your next reply.

.

also do these tips to tighten up the web browsers.

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera.

Scroll down to the tips section "How do I disable them".

 

also, if you use Chrome or Firefox browser, install the Malwarebytes beta browser extension.  There is one for Chrome & another for Firefox.

To get & install the Malwarebytes beta Chrome extension,

Open this link in your Chrome browser: https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

Then proceed with the setup.

 

To get & install the Malwarebytes beta Firefox extension.

Open this link in your Firefox browser: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

Then proceed with the setup.

.

Keep me advised.  IF you see the same "cloud1" message, lets have you get a screen-grab-image copy of that display.

Use the following how-to article  ( "take a Screenshot on Windows" )
https://lifehacker.com/how-to-take-a-screenshot-or-picture-of-whats-on-your-co-5825771

 

Sincerely,

 

.

Share this post


Link to post
Share on other sites

Hi,

The following procedure will remove the remaining traces of the browser extension "cloud browser".

 

This fix is for Findeep  only.

 

Please Close and save any open work files before you start this next step.  It may involve a Windows Restart at the end of it.

I am sending a   custom Fix script which is going to be used by the FRSTENGLISH tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE AS and save it directly ( as is) to the Downloads  folder

The tool named FRSTENGLISH.exe  is already on the Downloads folder.

Start the Windows Explorer and then, open the Downloads folder.


Double click FRSTENGLISH

  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
Click the Fix button just once, and wait.

 

FRST_Fixl.png.c4c1c0dddcc49b11fa400590f070bd5e.png

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. Some machines take longer than others.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your reply.    Also advise on the situation after this run.

Fixlist.txt

Share this post


Link to post
Share on other sites

Hi.   Thanks for the fixlog.   Very good run.

You can delete the FIXLIST.txt file I had you save.

 

I believe this pc should be good to go.   You should do one new Threat Scan with Malwarebytes for Windows, just as a check.

https://support.malwarebytes.com/docs/DOC-1549

 

Let me know the result of this scan.   Let me know if you need other help.

Share this post


Link to post
Share on other sites

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.