Malware keeps reappearing

[Catalysm]

Hello,

Every time I scan with Malwarebytes, a total of around 40 different malwares/PUPs show up. They're all (from what I can see) in the Google Chrome appdata. I was ignoring it at first, but now it's growing so I don't want to ignore it any longer. Can anyone help me with this?
Logs:
 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 9/24/20
Scan Time: 8:39 AM
Log File: 11bbed9c-fe7c-11ea-b7f8-100501460f3d.json

-Software Information-
Version: 4.2.1.89
Components Version: 1.0.1045
Update Package Version: 1.0.30326
License: Trial

-System Information-
OS: Windows 10 (Build 18362.1082)
CPU: x64
File System: NTFS
User: System

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Scheduler
Result: Completed
Objects Scanned: 460977
Threats Detected: 39
Threats Quarantined: 39
Time Elapsed: 1 hr, 20 min, 57 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 1
Adware.Hijacker, HKU\S-1-5-21-224454824-3464333530-1444894450-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|fkopaaikpmfhpmoobnmklgmcgmhgfkcd, Quarantined, 360, 853383, , , , , , 

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 12
Adware.Hijacker, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd, Quarantined, 360, 853383, , , , , , 
Adware.Hijacker, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 360, 853383, , , , , , 
Adware.Hijacker, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\EXTENSIONS\fkopaaikpmfhpmoobnmklgmcgmhgfkcd, Quarantined, 360, 853383, 1.0.30326, , ame, , , 
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 237, 720184, , , , , , 
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 237, 720184, , , , , , 
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 237, 720184, , , , , , 
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 237, 720184, , , , , , 
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 237, 720184, , , , , , 
PUP.Optional.ASK, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 281, 454822, , , , , , 
PUP.Optional.ASK, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 281, 454822, , , , , , 
PUP.Optional.Conduit, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 193, 454832, , , , , , 
PUP.Optional.Conduit, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 193, 454832, , , , , , 

File: 26
Adware.Hijacker, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, 360, 853383, , , , , 8DB4C05E3B03BD827E2ED485A66EF032, F089DE0F9394B3652C08A534B6887B14A4181710AD6A548DC15B8F4AA594C995
Adware.Hijacker, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, 360, 853383, , , , , 170CF3662F49AC49DC01896613B2A877, 53E00F1385AFB90B12ACE841AC0348F619E0DD58019AC74500EA22143FDFBD29
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd\000003.log, Quarantined, 360, 853383, , , , , 9B318491B206FC98CC5160F523DCFC23, C5B40BB498D22F61033DF0E1AC03F7120CACC2050F75EEF2B678080C0B2EE3EC
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd\CURRENT, Quarantined, 360, 853383, , , , , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd\LOCK, Quarantined, 360, 853383, , , , , , 
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd\LOG, Quarantined, 360, 853383, , , , , 4D6CEA16961DDDF230C4EC6619BE4C6A, 4069EFFA9358ABB8228BF235565459B099396413F7E9034C7623E0E838053546
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd\LOG.old, Quarantined, 360, 853383, , , , , 8AEF99B01D10437FA732C72BE8CD5134, 88979DFFA497DBD09BF40BD129596374042C3D1B5573FF1754264466190114FF
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd\MANIFEST-000001, Quarantined, 360, 853383, , , , , 5AF87DFD673BA2115E2FCF5CFDB727AB, F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000005.ldb, Quarantined, 360, 853383, , , , , 8037800B152268ACE107A18155F47007, 818136EF3D57AEB21872A458612274FC70D4FE184C81079060CAB5C64CEE5D52
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000021.ldb, Quarantined, 360, 853383, , , , , AE03AE01D149A236B6DA77FF1CB2CC77, 4F5AB1762EE9EC24248BC5BC403EC76BACD5636E7BAFA98C67DA402E0FCCEB68
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000023.log, Quarantined, 360, 853383, , , , , 79380D909A583369759BE185FED6822B, 07BF96FA571E60E43FCE89577FBC63169C50AB96F4EE31DDC9D76A811833466A
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000024.ldb, Quarantined, 360, 853383, , , , , 1B3693EEB05BE46BE96D1CA06EE8BD4E, 23CF4EC08309AA64EDBB5CABCB2254433FE562D6A1F15C48259FA6F8D992A057
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT, Quarantined, 360, 853383, , , , , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK, Quarantined, 360, 853383, , , , , , 
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG, Quarantined, 360, 853383, , , , , 33B3FEFF9602D227EC2143F30A8B0BE3, E850E0E77BAC45FE7537020E154930FB1B53442C2928E97D415D40491A623942
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old, Quarantined, 360, 853383, , , , , 906CBF985E6C0EED37E55F7696B1F421, 7AC6F1799D93C95C821DF7821277D17AC5C4706E5C9DC24A9C97B366E6FA746D
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001, Quarantined, 360, 853383, , , , , FC39CBC34E12C1F7AA243F5BD4A08E0D, C15E68DDAA1CCA5FEC77B1F6953983179126F7EDD6975B1953743477292A9C9D
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, 237, 720184, 1.0.30326, , ame, , 8DB4C05E3B03BD827E2ED485A66EF032, F089DE0F9394B3652C08A534B6887B14A4181710AD6A548DC15B8F4AA594C995
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 237, 720184, 1.0.30326, , ame, , 52CDE253AEA40A4FB3A6B16AA2143073, 4775D9C3F11A91277668F2313E2B96D4BFD85E253640003400FF78100B8B6787
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 237, 720184, 1.0.30326, , ame, , 52CDE253AEA40A4FB3A6B16AA2143073, 4775D9C3F11A91277668F2313E2B96D4BFD85E253640003400FF78100B8B6787
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 237, 720184, 1.0.30326, , ame, , 52CDE253AEA40A4FB3A6B16AA2143073, 4775D9C3F11A91277668F2313E2B96D4BFD85E253640003400FF78100B8B6787
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 237, 720184, 1.0.30326, , ame, , 52CDE253AEA40A4FB3A6B16AA2143073, 4775D9C3F11A91277668F2313E2B96D4BFD85E253640003400FF78100B8B6787
PUP.Optional.ASK, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 281, 454822, 1.0.30326, , ame, , 52CDE253AEA40A4FB3A6B16AA2143073, 4775D9C3F11A91277668F2313E2B96D4BFD85E253640003400FF78100B8B6787
PUP.Optional.ASK, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 281, 454822, 1.0.30326, , ame, , 52CDE253AEA40A4FB3A6B16AA2143073, 4775D9C3F11A91277668F2313E2B96D4BFD85E253640003400FF78100B8B6787
PUP.Optional.Conduit, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 193, 454832, 1.0.30326, , ame, , 52CDE253AEA40A4FB3A6B16AA2143073, 4775D9C3F11A91277668F2313E2B96D4BFD85E253640003400FF78100B8B6787
PUP.Optional.Conduit, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 193, 454832, 1.0.30326, , ame, , 52CDE253AEA40A4FB3A6B16AA2143073, 4775D9C3F11A91277668F2313E2B96D4BFD85E253640003400FF78100B8B6787

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

[Maurice Naggar]

Hi,       
My name is Maurice. I will be helping and guiding you, going forward on this case.
Let me know what first name you prefer to go by.   

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me. 
Please only just attach   all report files, etc  that I ask for as we go along.

I would appreciate  getting some key details from this machine in order to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

Do have patience while the report tool runs.  It may take several minutes.  Just let it run & take its time.  You may want to close your other open windows so that there is a clear field of view.
Download Malwarebytes Support Tool
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.7.0.827.exe  to run the report

Once it starts, you will see a first screen with 2 buttons.  Click the one on the left marked "I don't have an open support ticket".

        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
Now click the left-hand side pane "I do not have an open support ticket"

    You will be presented with a page stating, "Get Started!"
    Do NOT use the button “Start repair” !   But look instead at the far-left options list in black.

    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer.  Please do have patience.  It takes several minutes to gather.
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK.  Then Exit the tool.

    Please attach the ZIP file in your next reply.

Please know I help here as a volunteer.  and that I am not on 24 x 7.
Help on this forum is one to one.   Again, please be sure to ONLY attach report files  with your reply (s)  as we go along.  Do not do a copy / paste into main body.

Thank you,
Sincerely.

[Catalysm]

Here you go!

mbst-grab-results.zip

[Maurice Naggar]

Thank you.   There is one too many antivrus installed on this machine.   IF Webroot SecureAnywhere  is licensed & paid for, then you need to Uninstall ""    McAfee VirusScan "

It is not a good practice to have both of these as active & running.   Uninstall whichever one is not licensed & paid.

.

Next, here is what we will do for P U P  and adware type things, especially noticing the Google Chrome involvement.

[   1   ]

Set the Chrome "sync"  to OFF.

Use Chrome browser   to go to https://www.google.com/settings/chrome/sync and sign into your account.
Scroll down until you see the "reset sync" button and click on the button
At the prompt click on "Ok".

 

After we are all finished with this case, you may if you wish / if you need to /  turn the Google Sync back On.

[   2   ]

for Chrome, while Chrome is running:
Press & hold SHIFT+CTRL+Del keys  on keyboard to get menu for clearing browsing data:

Check mark the line  "Browsing history"

Check mark the line "Download history"

Check mark the lined "Cached images and files"
and press Clear Data button  ( in blue )

[   3   ]

After that, make real sure that Chrome is "NOT" set to reload the pages from the last session

Go into the settings menu of Chrome by first clicking  the control icon of Chrome on upper right of the adress bar

Then look deeper in SETTINGS

 

Make real sure it is "NOT" set to "continue where you left off"

.

[   4   ]

I suggest you install the Malwarebytes Browser guard for Chrome.

To get & install the Malwarebytes Browser Guard extension for Chrome,

 

Open this link in your Chrome   browser: 

https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

 

Then proceed with the setup.

[   5   ]

I would like you to do a new scan with Malwarebytes for Windows.  One of the major goals here is to have it remove all that it detects.  If it finds anything that is.
Start Malwarebytes from the Windows  Start menu.
Click Settings ( gear icon)   at the top right of Malwarebytes window.   We want to see the SETTINGS window.
Then click the Security tab.   Look for the section "Automatic Quarantine".   Be sure it is clicked On   ( to the far right side)

Then scroll down to the section Potentially Unwanted items.   We need the next 2 lines   ( for P U P  & for P U  M)  to be set to "Always ( Recommended) ".
You can make the change by clicking on the down-arrow selection list-control.   We want all P U P  &  P U M to be marked for removal.

Next, click the small x on the Settings line   to go to the main Malwarebytes Window.
Next click the blue button marked Scan.
When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.
You can actualy click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).

Then click on Quarantine selected.
Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

[Catalysm]

after following all your steps, I still have the same results. Any idea what's going on here? I'm pretty sure I did everything correctly...

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 9/24/20
Scan Time: 3:15 PM
Log File: 69a28df4-feb3-11ea-a499-100501460f3d.json

-Software Information-
Version: 4.2.1.89
Components Version: 1.0.1045
Update Package Version: 1.0.30342
License: Trial

-System Information-
OS: Windows 10 (Build 18362.1082)
CPU: x64
File System: NTFS
User: OMEN-GAMING-PC\nimar

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 465249
Threats Detected: 39
Threats Quarantined: 38
Time Elapsed: 1 hr, 44 min, 36 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 1
Adware.Hijacker, HKU\S-1-5-21-224454824-3464333530-1444894450-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|fkopaaikpmfhpmoobnmklgmcgmhgfkcd, Quarantined, 360, 853383, , , , , , 

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 12
Adware.Hijacker, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd, Quarantined, 360, 853383, , , , , , 
Adware.Hijacker, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Removal Failed, 360, 853383, , , , , , 
Adware.Hijacker, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\EXTENSIONS\fkopaaikpmfhpmoobnmklgmcgmhgfkcd, Quarantined, 360, 853383, 1.0.30342, , ame, , , 
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 237, 720184, , , , , , 
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 237, 720184, , , , , , 
PUP.Optional.ASK, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 281, 454822, , , , , , 
PUP.Optional.ASK, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 281, 454822, , , , , , 
PUP.Optional.Conduit, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 193, 454832, , , , , , 
PUP.Optional.Conduit, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 193, 454832, , , , , , 
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 237, 720184, , , , , , 
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 237, 720184, , , , , , 
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 237, 720184, , , , , , 

File: 26
Adware.Hijacker, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, 360, 853383, , , , , 695E76935FFA76D5F1FA8DDD2B83CDC2, 5180B5DC4E678DC22F6E8FE2F804726410E84B05DE22DF3EA29E453935D4C106
Adware.Hijacker, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, 360, 853383, , , , , DD12876B152617D68E8FDD171F67449E, 58D0BC158FFB287E0847ABF2CAA60D290A46650B58120EE062E179BF7A6C8781
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd\000003.log, Quarantined, 360, 853383, , , , , 9B318491B206FC98CC5160F523DCFC23, C5B40BB498D22F61033DF0E1AC03F7120CACC2050F75EEF2B678080C0B2EE3EC
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd\CURRENT, Quarantined, 360, 853383, , , , , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd\LOCK, Quarantined, 360, 853383, , , , , , 
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd\LOG, Quarantined, 360, 853383, , , , , 8493494BCA4462598D8E4D2EFF806314, 76EAF28B0A8830F62400EA915008B0915C6C8C2D12DBBD022157B9EDE6EC07B4
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd\LOG.old, Quarantined, 360, 853383, , , , , DDF6208B2AD0E6C1F03243DCAF35661B, A1D42A939C9F137C921971182B8964329F5B85DE1EF2613D811C26E5A850C397
Adware.Hijacker, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fkopaaikpmfhpmoobnmklgmcgmhgfkcd\MANIFEST-000001, Quarantined, 360, 853383, , , , , 5AF87DFD673BA2115E2FCF5CFDB727AB, F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
PUP.Optional.StartPageSearch, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000005.ldb, Quarantined, 237, 720184, , , , , 3C86DFE0B4C1E5BDB89E73027E31D802, 855FBD4E32C110459F096B2EC1C3293103E1109E38E79159C33B095BD6102FD4
PUP.Optional.StartPageSearch, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000019.ldb, Quarantined, 237, 720184, , , , , 15B7C74DFB8A9AF549C5C82AB25C0B07, D90F4DE2B61D11C830564E3D437866C691E4E7689B7BDBFDF4A5369FC7F86898
PUP.Optional.StartPageSearch, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000021.log, Quarantined, 237, 720184, , , , , 1515431E2059FE3377E2B923086BBA8F, CF3E71CB1C44AC531615DE3B5E2FAE23422034265CAA552F28ED83C668B361DD
PUP.Optional.StartPageSearch, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000022.ldb, Quarantined, 237, 720184, , , , , C6C142B35D4BE4DE3E4DCC3A861C3793, E908A030F3427D41B2AC5B6466B0782FDFA43195462274E9180B6010579F67F0
PUP.Optional.StartPageSearch, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT, Quarantined, 237, 720184, , , , , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
PUP.Optional.StartPageSearch, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK, Quarantined, 237, 720184, , , , , , 
PUP.Optional.StartPageSearch, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG, Quarantined, 237, 720184, , , , , 2D86EA62A34D8DCB8804F7B3311367F4, 233B71C297BD8AE3D65C880D6E7440037CCF318E4FFB5ADA46D498E94639521E
PUP.Optional.StartPageSearch, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old, Quarantined, 237, 720184, , , , , B06C154320D9F082F6C2581BF2C92EC5, 4B9B759C6419104B2BD94D864C38636712A1A0B4060B1874285B277DC92828FE
PUP.Optional.StartPageSearch, C:\Users\nimar\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001, Quarantined, 237, 720184, , , , , 7318873147FEE847E25618532C503164, 8995DB3D3768D8989F4BF2777B7BD0DBFADB6E8517372FA84EAEB7A05BF1E1F5
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, 237, 720184, 1.0.30342, , ame, , DE8C440EA92D03AD96E0F14709B6B349, 12994AD70880FE7CD9DA4DC9D52794095BD0BDBF786C70AAADC32E365D02EDE7
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 237, 720184, 1.0.30342, , ame, , 61FB40E27405C57573718A0F0CDAA014, 7E2D03C8D79700CADFF45F71DD2D3DECADF3B4763DB50390DA9398C0187B0577
PUP.Optional.ASK, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 281, 454822, 1.0.30342, , ame, , 61FB40E27405C57573718A0F0CDAA014, 7E2D03C8D79700CADFF45F71DD2D3DECADF3B4763DB50390DA9398C0187B0577
PUP.Optional.ASK, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 281, 454822, 1.0.30342, , ame, , 61FB40E27405C57573718A0F0CDAA014, 7E2D03C8D79700CADFF45F71DD2D3DECADF3B4763DB50390DA9398C0187B0577
PUP.Optional.Conduit, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 193, 454832, 1.0.30342, , ame, , 61FB40E27405C57573718A0F0CDAA014, 7E2D03C8D79700CADFF45F71DD2D3DECADF3B4763DB50390DA9398C0187B0577
PUP.Optional.Conduit, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 193, 454832, 1.0.30342, , ame, , 61FB40E27405C57573718A0F0CDAA014, 7E2D03C8D79700CADFF45F71DD2D3DECADF3B4763DB50390DA9398C0187B0577
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 237, 720184, 1.0.30342, , ame, , 61FB40E27405C57573718A0F0CDAA014, 7E2D03C8D79700CADFF45F71DD2D3DECADF3B4763DB50390DA9398C0187B0577
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 237, 720184, 1.0.30342, , ame, , 61FB40E27405C57573718A0F0CDAA014, 7E2D03C8D79700CADFF45F71DD2D3DECADF3B4763DB50390DA9398C0187B0577
PUP.Optional.StartPageSearch, C:\USERS\NIMAR\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 237, 720184, 1.0.30342, , ame, , 61FB40E27405C57573718A0F0CDAA014, 7E2D03C8D79700CADFF45F71DD2D3DECADF3B4763DB50390DA9398C0187B0577

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

[Maurice Naggar]

Hello.   I need to ask for a huge  favor, to please only just attach any report that you send me or that I ask for.   Pastng them into the main body makes for huge large amount of screen space to scroll thru, plus make my task a bit harder.

• To upload attachments please click the link as shown below. Then browse to where your file is located and select it and click the Open button.

 

Lets take a time out and do this next special run

 

I  would suggest to download, Save, and then run Malwarebytes ADWCLEANER.
Please close Chrome and all other open web browsers after you have saved the Adwcleaner and before you start Adwcleaner scan.
Adwcleaner  detects factory Preinstalled applications too! 

Please download  Malwarebytes AdwCleaner https://downloads.malwarebytes.com/file/adwcleaner

 
Be sure to Save the file first, to your system.  Saving to the Downloads folder should be the default on your system.

Go to the folder where you saved Adwcleaner. Double click Adwcleaner  to start it.
At the prompt for license agreement, review and then click on I agree.

You will then see a main screen for Adwcleaner. ( if you do not see it right away, minimized the other open windows, so you can see Adwcleaner).
Then click on Dashboard button.
Click the blue button "Scan Now".

allow it a few minutes to finish the Scan.   Let it remove what it finds.
NOTE:  When it comes to the section "
Pre-installed applications

You can skip that.
Please find and send the Adwcleaner "C" clean report.
In Adwcleaner, click the "Reports" button.  Look at the list of reports for the latest date & type "Clean".
Double Click that line & it will open in Notepad.   Save the file to your system and then Attach that with your reply.

That C clean report will be the one with the most recent Date and time at folder  C:\AdwCleaner\Logs
Thanks.  Keep me advised.
 

[Catalysm]

Here you go! I'd also like to point out that, like with malwarebytes, I did a scan earlier and the same 5 items were detected. I removed them, restarted my pc, and when I did this scan, they're back again.

AdwCleaner[C08].txt

[Maurice Naggar]

Be real clear whether  you are now just only meaning that Adwcleaner is what shows the repeats.

When you first started this case, you had a report from Malwarebytes for Windows.

.

Please take some time and do all the tips on this pinned topic

https://forums.malwarebytes.com/topic/258886-chrome-secure-preferences-detection-always-returns/

 

 

[Catalysm]

Yes, it was ADW cleaner and malwarebytes. (Both show repears)
I didn't see in your original post that i had to scan BEFORE i re-enabled sync, I am doing that now on both malwarebytes and adw cleaner.
I'll do it twice for both and let you know how it goes!

[Catalysm]

repeats*

[Maurice Naggar]

You do not need to do double runs.   

Looking again at earlier scan reports, there is a browser extension  Video Speed Manager    that is  tagged as Adware.Hijacker

That extension is on the Google Chrome browser  &  also on the EDGE browser.

I would urge you to uninstall    Video Speed Manager     on each browser

Let me know after that has been done.

 

 

[Catalysm]

Just did it, should I scan again after uninstalling?

 

[Catalysm]

Good news! Just finished the malwarebytes scans (both of them) and I got non-repeating results! In the first scan (mbr1), there's the usually 40 or so malware detections. However, in the second scan (mbr2), there's no detections. I will continue to do the same with adwcleaner and let you know the results!

mbr1.txt mbr2.txt

[Catalysm]

Sorry bout the delay, here's the adwcleaner results! Looks like everything worked. Thank you for your time and patience, could not have done it without you!

AdwCleaner[S09].txt

[Maurice Naggar]

Thanks for the reports.

Looking back on earlier information, this pc has one too many antivirus programs installed.   There are what looks like 2 third-party ( non-Microsoft ones)

Webroot SecureAnywhere    & also McAfee VirusScan

If either or both of those are not licensed  ( paid)  then uninstall.

Having more than one antivirus does lead to conflicts.

.

Java 8 Update 191 is way out of date & also not secure.  Uninstall it.

.

There is a one step I need you to do in order to set Windows to show all hidden folders,  all files.

lets make sure that Windows File Explorer is able to show all folders, including any Hidden ones.

 Use the Option Two as in this article at Tenforums

https://www.tenforums.com/tutorials/9168-show-hidden-files-folders-drives-windows-10-a.html

.

[     2    ]

The custom script Fixlist is intended to help out with the recurring issues on Chrme browser.

The system will be rebooted after the script has run.

.

This custom script is for  Catalysm  only / for this machine only.

 
Close and save any open work files before starting this procedure.    If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.

I am sending a    custom Fix script which is going to be used by the FRSTENGLISH  tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE  link AS and save it directly ( as is) to the  Downloads  folder

The tool named FRSTENGLISH .exe   tool    is already on the Downloads 
Start the Windows Explorer and then, to the Downloads   folder.

RIGHT click on  FRSTENGLISH    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

IF you get a block message from Windows about this tool......
click line More info information on that screen
and click button Run anyway on next screen.

on the FRST window:
Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. This run here should be fairly quick.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity   

Please know this will do a Windows Restart.   Just let it do its thing.  

Let me know, after this,  How things are.

Fixlist.txt

[Catalysm]

Here you go! I updated Java (which i'd forgotten to do for awhile, thanks for the reminder!) Please let me know if I have to fully uninstall Java, or just updating it to the newest version is fine. Also, I'm pretty sure I uninstalled both Webroot and mcaffee. I uninstalled them in the control panel, and then manually deleted the empty folders in the Program Files. Do I need to do something else to fully uninstall them? Also, things are going well. My computers been running pretty smooth, and everything is still working fine!

Fixlog.txt

[Maurice Naggar]

Hi.   Old Java versions need to be uninstalled the standard way to uninstall from Windows.   You ought to have uninstaled  Java 8 Update 191

Thanks for the Fixlog report.

I noticed that the Chrome browser had had a very large amount of cache files.   They have been deleted.   But you need to make it a habit to periodically clear out Cache files on Chrome or any other browser you use.

see  https://support.google.com/accounts/answer/32050

Just the cached images and files   ( not necessarily the cookies).

.

 

 get & install the Malwarebytes Browser Guard  Firefox extension.

Open this link in your Firefox browser:   

https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

Then proceed with the setup.

That link is for English US.   There are other language version.  Just go to the very bottom right of the page and look at “Change language” list drop down.

.Let me know if you need other help.

Sincerely.

[Catalysm]

I deleted the cached files, I should hopefully remember to do this on some basis. For java, can I keep the newest update (Java 8 Update 261)? Or should I completely uninstall all versions of java on my pc? Java update 191 should be uninstalled now, I don't see any traces of it anywhere in the apps and features or control panel. I also installed browser guard on chrome. I don't have firefox, though.

After I've done all this, am I good?
Thanks!

[Maurice Naggar]

The only occasions anyone wants Java is ONY  if you have some old app or application that has to have Java.   Otherwise, it is just not necessary.

Windows does not need Java.   Malwarebytes for Windows certainly does not use Java.

As toy your original issue,  you should be all good to go.    You can do a new scan just to re-check.

Start Malwarebytes.   Click the Scan button.    Let me know the findings of that run.

Thanks.

[Catalysm]

Just uninstalled it. Also, my premium trial did a few scans over the past few days and got no detections, so we're looking good! Thanks for the help!

[Maurice Naggar]

I am happy to have helped you.

These are to cleanup after the tools we used.

Delete   mb-support-1.7.0.827.exe

Delete mbst-grab-results.zip  on the Desktop

To remove the FRST  tool & its work files, do this.  Go to your  Downloads folder.  Do a RIGHT-click on FRSTENGLISH.exe & select RENAME & then change it to UNINSTALL.exe .
Then run that ( double click on it)  to begin the cleanup proceed.

.

Adwcleaner you should keep and run as warranted to check for adwares ( on-demand ).

Any other file I had you download you may delete.

I do wish you all the best.    🤑

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you