Jump to content

Malware keeps coming up after using Google Chrome


Recommended Posts

Hi,      :welcome:
My name is Maurice. I will be helping and guiding you, going forward on this case.
Let me know what first name you prefer to go by.

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me. 
If you will be away for more than 3 consecutive days,  do try to let me know ahead of time, as much as possible. 
  
Please only just attach   all report files, etc  that I ask for as we go along.
 

[   1   ] 
Use Chrome browser   to go to https://www.google.com/settings/chrome/sync and sign into your account.
Scroll down until you see the "reset sync" button and click on the button
At the prompt click on "Ok". 
[   2   ] 
for Chrome, while Chrome is running:
Press & hold SHIFT+CTRL+Del keys  on keyboard to get menu for clearing browsing data:

Check mark the line  "Browsing history" 
Check mark the line "Download history" 
Check mark the lined "Cached images and files"
and press Clear Data button  ( in blue ) 
[   3   ] 
After that, make real sure that Chrome is "NOT" set to reload the pages from the last session 
Go into the settings menu of Chrome by first clicking  the control icon of Chrome on upper right of the adress bar 
Then look deeper in SETTINGS 
 
  image.png.651d8bd36b1bd2bbf425760b3b8150fc.png
Make real sure it is "NOT" set to "continue where you left off" 

[   4   ] 
See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/
  
You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera. 
Scroll down to the tips section "How do I disable them". 
[   5   ] 
I suggest you install the Malwarebytes Browser guard for Chrome. 
To get & install the Malwarebytes Browser Guard extension for Chrome, 
  
Open this link in your Chrome   browser:  
https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

  
Then proceed with the setup. 
  
[   6    ] 
I  would suggest to download, Save, and then run Malwarebytes ADWCLEANER. 
Please close Chrome and all other open web browsers after you have saved the Adwcleaner and before you start Adwcleaner scan. 
Adwcleaner  detects factory Preinstalled applications too! 
  
Please download  Malwarebytes AdwCleaner  https://downloads.malwarebytes.com/file/adwcleaner
  
Be sure to Save the file first, to your system.  Saving to the Downloads folder should be the default on your system. 
  
Go to the folder where you saved Adwcleaner. Double click Adwcleaner  to start it. 
At the prompt for license agreement, review and then click on I agree. 
  
You will then see a main screen for Adwcleaner. ( if you do not see it right away, minimized the other open windows, so you can see Adwcleaner). 
Then click on Dashboard button. 
Click the blue button "Scan Now". 
  
allow it a few minutes to finish the Scan.   Let it remove what it finds. 
NOTE:  When it comes to the section " 
Pre-installed applications 
  
You can skip that. 
Please find and send the Adwcleaner "C" clean report. 
In Adwcleaner, click the "Reports" button.  Look at the list of reports for the latest date & type "Clean". 
Double Click that line & it will open in Notepad.   Save the file to your system and then Attach that with your reply. 
  
That C clean report will be the one with the most recent Date and time at folder  C:\AdwCleaner\Logs 
Thanks.  Keep me advised. 
  

Link to post
Share on other sites

Thanks for the report.   wow, that was quick on your part.

I would appreciate  getting some key details from this machine in order to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

Do have patience while the report tool runs.  It may take several minutes.  Just let it run & take its time.  You may want to close your other open windows so that there is a clear field of view.
Download Malwarebytes Support Tool   from here
    
   
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.6.0.774.exe  to run the report
        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
    You will be presented with a page stating, "Get Started!"
    Do NOT use the button “Start repair” !
    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
    Please attach the ZIP file in your next reply.
 

Link to post
Share on other sites

Thank you very much for the report ZIP file.  There are a few very suspicious files revealed by the reports.  In addition, there seems to be a likely rootkit here.

We will have much more to do.   For now, this one special tool.

Please read all of these lines first so that it is all clear to you about our plan. I need a one time run of MBAR like listed here, please.

Please download Malwarebytes Anti-Rootkit (MBAR) from this link here

and save it to your desktop.

Doubleclick on the MBAR file and allow it to run.

•Click OK on the next screen, to allow the package to extract the contents of the file to its own folder named mbar.

•mbar.exe will launch automatically. On some systems, this may take a few extra seconds. Please be patient and wait for the program to open.

•After reading the Introduction, click 'Next' if you agree.

•On the Update Database screen, click on the 'Update' button.

•Once you see 'Success: Database was successfully updated' click on 'Next', then click the Scan button.

With some infections, you may see two messages boxes:

1.'Could not load protection driver'. Click 'OK'.
2.'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.

•If malware is found, press the Cleanup button when the scan completes. .

Please attach the log it produces, you'll find the log in that mbar folder as MBAR-log-<date and time>***.txt . Please attach that to your next reply.
  
 

Link to post
Share on other sites

That is good to see.  Thank you for the report.

There is a custom script that we need to run to look for & remove suspicious file.

Please Close and Save any open work you may have open.
Please close as many un-needed app-windows that you yourself may have open at this point.   So you can have a clear field of view.

This custom script is for  RaduVRS    only / for this machine only.
Close and save any open work files before starting this procedure. 

Please Close and save any open work files before you start this next step.  It will involve a Windows Restart at the end of it.
I am sending a   custom Fix script which is going to be used by the FRSTENGLISH tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE  link AS and save it directly ( as is) to the  Downloads  folder

The tool named FRSTENGLISH.exe   tool    is already on the Downloads folder
Start the Windows Explorer and then, to the Downloads folder.


RIGHT click on  FRSTENGLISH    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

IF you get a block message from Windows about this tool......
click line More info information on that screen
and click button Run anyway on next screen.

on the FRST window:
Click the Fix button just once, and wait.

image.png.df8c9e1c362153aa043db1092c8a5d8f.png
 
PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. This run here should be fairly quick.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.
Please attach the FIXLOG.txt with your next reply later, at your next opportunity   

 

Also, do let me know how things look after this.

Sincerely,

Maurice

Fixlist.txt

Link to post
Share on other sites

Thanks for that report.   Overall, that is a good run.

We need to do a run with the Windows System File Checker tool.

This procedure will use the Windows System File Checker tool  ( SFC ).

Open an elevated command prompt window i.e. run Command Prompt as an administrator .
It is best to use the Windows Copy ( CTRL+ C )  and paste  ( CTRL+V )  for the whole line, as-is
To Get the elevated command prompt, press Windows-key + X key  and then selected Command prompt ( Admin )
On that command prompt,  Copy & Paste this command

sfc /SCANNOW

& tap Enter-key.   Have patience.  Monitor the progress.   Keep eyes out for the bottom line results.

 

Also let me know the overall status about "Chrome".

Link to post
Share on other sites

SFC did a successful repair.

Good to know that Chrome is working normal, without adwares or hiccups.

I believe that at this point, there is not a malware.  But we can do a new scan with Malwarebytes for Windows.

Please do a new Scan on this machine, using Malwarebytes for Windows.
To run a Threat Scan, open Malwarebytes for Windows and click the blue Scan button.
Have patience during the run.
When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.
Then click on Quarantine selected.

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

Link to post
Share on other sites

Thank you.  That is a very fine report result.   Is there anything that you need at this point?

 

I would like you to run a tool named SecurityCheck to inquire on the current-security-update  status  of some applications.
Download SecurityCheck by glax24 from here

and save the tool on the desktop.

If Windows's  SmartScreen block that with a message-window, then
Click on the MORE INFO spot and over-ride that and allow it to proceed.

This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt
 

Link to post
Share on other sites

Thanks for the report.   I call your attention to some notations in the report/

The elevation prompt for administrators disabled
^It is recommended to enable (default): Win+R typing

UserAccountControlSettings and Enter^

& Enable that

 

This pc has Kaspersky Internet Security v.19.0.0.1088

Kaspersky has had a Version 20  for quite a while.   I believe their upgrades are for free.

If perhaps this is a unpaid one,  then I would posit to uninstall Kasperky.   After which, the built-in Microsoft Defender Antivirus will be on.

 

Patch J for Kaspersky Internet Security version 20.0.14.1085 was released on April 6, 2020.

If you want to upgrade the Kaspersky, then   see  https://support.kaspersky.com/15074#block1

 

I am happy t have helped you.  This next section is to cleanup the tools I had you use.

Delete mb-support-1.6.0.774.exe      on the Downloads folder

Delete  mbst-grab-results.zip  on the Desktop

Delete MBAR.exe

Delete SecurityCheck.exe

 

To remove the FRSTENGLISH tool & its work files, do this.  Go to your Downloads folder.  Do a RIGHT-click on FRSTENGLISH.exe & select RENAME & then change it to UNINSTALL.exe .
Then run that ( double click on it)  to begin the cleanup process.

 

Adwcleaner you may keep & use on demand to check for adwares.

 

Link to post
Share on other sites

Backup is your best friend.  Keep backups of your system on a regular basis to offline storage & keep those safe. https://forums.malwarebytes.com/topic/136226-backup-software/

It is not enough to just have a security program installed. Each pc user needs to practice daily safe computer and internet use.

 

Best  practices & malware prevention:
Follow best practices when browsing the Internet, especially on opening links coming from untrusted sources.
First rule of internet safety: slow down & think before you "click".
Never click links without first hovering your mouse over the link and seeing if it is going to an odd address ( one that does not fit or is odd looking or has typos).

Free games & free programs are like "candy". We do not accept them from "strangers".

Never open attachments that come with unexpected ( out of the blue ) email no matter how enticing.
Never open attachments from the email itself. Do not double click in the email. Always Save first and then scan with antivirus program.

Pay close attention when installing 3rd-party programs. It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed.
Take great care in every stage of the process and every offer screen, and make sure you know what it is you're agreeing to before you click "Next".

Use a Standard user account rather than an administrator-rights account when "surfing" the web.
See more info on Corrine's SecurityGarden Blog http://securitygarden.blogspot.com/p/blog-page_7.html
Dont remove your current login. Just use the new Standard-user-level one for everyday use while on the internet.

 
Do a Windows Update.

Make certain that Automatic Updates is enabled.
https://support.microsoft.com/en-us/help/12373/windows-update-faq

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

For other added tips, read "10 easy ways to prevent malware infection"
 

I wish you all the best.  Stay safe.

Sincerely,

Maurice
 

Link to post
Share on other sites

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.