Persistent and Malicious Cookie

[TitanInsane]

Hi, I regularly use Chrome and I've recently been plagued by a very, very annoying cookie that I cannot get rid of for some reason.

The reason its annoying is because it automatically forces whichever site I'm using to scroll to the bottom and stay there, which is incredibly annoying. It also forces Youtube to skip videos continuously. The reason I think its a cookie is because Adware and Malwarebytes didn't find anything and this particular cookie "sirius.mwbsys.com" always shows up, even after being repeatedly deleted and after me avoiding the site that creates it. I downloaded a cookie deleting extension but its not really solving my problem, especially since I still end up having to manually delete the cookie responsible every single time.

I've also tried to disable Google Sync and clear all my data, as well as logging out of any other device that I might have used. But it still reappeared, even after clearing all the data in the Sync, which somehow still synced data, even though I disabled it last year.

Is there a solution for this ? Or am I going to have to live with it ?

Here are the required files.

Thank You

Addition.txt FRST.txt Malware.txt

Edited August 16, 2021 by AdvancedSetup
corrected font issue

[AdvancedSetup]

Hello @TitanInsane

Please review the following to help clean up and reset Google Chrome. If that still does not correct your issue please let me know. I'll check back on you again sometime tomorrow.

Thanks

 

[TitanInsane]

Umm, did you share any links ? I can’t see anything. If by resetting Chrome you mean clearing the cache, memory and cookies, I’ve tried it but it doesn’t work. The cookies return even after that. 

[AdvancedSetup]

Sorry about that 🤫 forgot to post the link.

Here  you go

 

[TitanInsane]

Hi @AdvancedSetup

I did everything as given in your Chrome Reset Guide. I did a soft reset by going to Chrome's Settings, then I deleted the relevant files as per the forced Reset method and then I finally uninstalled Chrome. Each time the problem persisted and I eventually reinstalled Chrome. The problem is that it affects all scrolling functions in every single application, not just Chrome. And it persists even after Chrome is gone, so I'm guessing its a sign of a deeper problem.

I ran Malwarebytes in the morning after you made this post. It found two infections when I ran a custom scan on my main drives. I couldn't complete the scan due to a power failure, so the next time I ran the scan, I stopped the scan after it detected the infections and disinfected the computer. It did not change anything and did not solve my problem.

I've attached the log of the Malwarebyte scan.

Malwarebytes.txt

[AdvancedSetup]

Okay, we may need you to take a short series of screenshots or perhaps a small video from the computer to show what you mean as I'm not sure at this point.

Let's do another scan for possible infection and go from there.

 

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started. 
• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes 
• When prompted for scan type, Click on Full scan 
• Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on the Start scan button.
• Have patience.  The entire process may take an hour or more. There is an initial update download.
• There is a progress window display.
• You should ignore all prompts to get the ESET antivirus software program.   ( e.g. their standard program).   You do not need to buy or get or install anything else.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.
• If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at the bottom).
• Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

 

[TitanInsane]

Hi @AdvancedSetup

 

 

 

I hope this screenshot helps. Notice how the scroll is at the bottom ? That's my problem. It forces all my web pages, pdf readers , anything with a scroll function to go to the bottom and stay there. Its nearly impossible to move the scroll back up unless I delete the cookies, which is effective for about 5 minutes before the cookie returns and starts the process all over again.

Also, I'm going to be a little late to get you those ESET Scan logs. I'm definitely not going to be able to finish them tonight, so I'm going to have to do it tomorrow and that's if power failures don't screw me over. I'll try to get them as fast as possible. Thanks in advance.

[AdvancedSetup]

Do you have a keyboard and mouse from another computer you can temporarily swap out and see if that helps?

 

[TitanInsane]

Sorry, I don't have a spare keyboard or a mouse. Do you think this is a hardware problem ?

[TitanInsane]

Hi @AdvancedSetup

I ran the scan like you said. The first time I ran it, it found an infection but a power failure disrupted the scan. I ran another scan and it didn't find the infection this time. Should I run it again ? My computer seems to be normal but I'm not sure if its a temporary thing.

[AdvancedSetup]

Hello @TitanInsane

It does look like a possible hardware issue, thus a quick keyboard/mouse change could possibly rule that out.

Perhaps a friend, family member, etc has one you could borrow for testing purposes?

Please run a new Malwarebytes Threat scan and post back the results.

Then let's try a Microsoft scan again

 

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system.

The download links & the how-to-run-the tool are at this link at Microsoft

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

Please let me know the results of this scan.

The log is named MSERT.log 

the log will be at  %SYSTEMROOT%\debug\msert.log   which in most cases is

C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

 

[TitanInsane]

Hi @AdvancedSetup

I tried running the scanner but my computer kept crashing throughout the scan. I've tried running it multiple times and even the custom scan but to no avail. It doesn't work in safe mode either.

It did find several infected files though, although the scan kept crashing before it could do anything.

[AdvancedSetup]

Were you able to ever run the ESET scan and get that log @TitanInsane

 

 

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started. 
• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes 
• When prompted for scan type, Click on Full scan 
• Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on the Start scan button.
• Have patience.  The entire process may take an hour or more. There is an initial update download.
• There is a progress window display.
• You should ignore all prompts to get the ESET antivirus software program.   ( e.g. their standard program).   You do not need to buy or get or install anything else.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.
• If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at the bottom).
• Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

 

[TitanInsane]

I'll try running this and then get back to you @AdvancedSetup.

[AdvancedSetup]

If that won't run either then please try the following

 

[TitanInsane]

Hi @AdvancedSetup

So I finally finished running the ESET scan. As expected, it didn't find anything. The first time I ran the scan, it found one detection but then a power failure occurred. When I restarted the scan the detection never showed up again. My laptop has been working mostly normally since the scan, so I'm glad but the cookies I told you about "sirius.mwbsys.com" still returns every time even after deletion, so I'm concerned about this happening again.

I also the Anti-Rootkit scan and it too found nothing. Attaching the scan log as requested. I'm really sorry for the delay.

ESTScan.txt

Edited August 19, 2021 by TitanInsane

[AdvancedSetup]

The https://sirius.mwbsys.com  is our site. Perhaps I misunderstood when I first looked at your post.

As you can see, this is the cookie entry in my own Firefox browser. This is due to running our Malwarebytes program.

 

[TitanInsane]

Ohhhhhhh. Is “ogs.google.com” also a safe cookie ? Because it also shows up after repeated deletions.

The reason I thought Sirius.mwbsys.com was a malicious cookie was because deleting it seemed to temporarily fix the browser, although now I’m not sure.

At any rate, my laptop is pretty much back to normal now. So thank you for all your help.

[AdvancedSetup]

I think it possibly stands for One Google Signin ? Possibly for signing into one of Google apps? It does look like it's a custom one by Google though as normal scans get an error trying to access it, but it does belong to Google.

Virus Total finds nothing wrong with that domain

https://www.virustotal.com/gui/url/9be4323eec5fac6b79c0a599f75e525f0b740618be0c441c307ed0697788ada0/detection

 

You're quite welcome for the help.

Take care and stay safe out there

Cheers @TitanInsane

 

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you

 

 

[AdvancedSetup]

Topic has been reopened per request.

Thanks

 

[TitanInsane]

Hi @AdvancedSetup,

I wanted to restart this thread because the problem we faced resurfaced after a few days. I’m talking about my functionality of my scroll across all applications being affected.

I ran all the same scans as last time, however, I wasn’t able to find a single thing this time. I’m hoping you have a solution to this problem.

Thank You

[AdvancedSetup]

We did not run anything that would typically affect the function of the mouse or keyboard. If all applications are experiencing this issue I still believe it is probably due to a bad keyboard and would still suggest borrowing one to test it out and see if that fixes it assuming this is a desktop computer.

 

 

[TitanInsane]

Hi @AdvancedSetup, 
I’m using a laptop so changing the keyboard is not going to be possible for now. 

The problem did go away after we ran the ESET scan but repeated scans have not picked anything up. Do we have any other options ?

[AdvancedSetup]

Odd that running the ESET scan would have done anything. It found nothing.

 

19-Aug-21 22:15:03 PM
Files scanned: 577041
Detected files: 0
Cleaned files: 0
Total scan time: 08:30:41
Scan status: Finished

 

Go ahead and get me some new logs and I'll review.

What is the Manufacturer and model of your laptop?

 

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you