Redirect Virus not detected by Malwarebytes

[ivansvi]

Hello, I am having problems detecting and getting rid of a redirect virus on my pc. 

I use Google Chrome & it redirects me through a variety of links. Through some sleight of hand & hotkeys I was able to secure the links it would redirect me through. The websites follow this order respectively:

Lastly it redirects me to Bing's results page of whatever it was that I wrote in the search engine.

Moreover, it pops up a Command Prompt box of Microsoft Powershell.

 

I followed Settings > Search Engines and found these, it's worth mentioning I only use Google. I deleted all of them but they showed up again.

 

Things I have done that did NOT help:

-Clean & Full reinstall of Google Chrome

-Google Chrome scan (Absolutely nothing detected)

-Malwarebytes scan (Scanned multiple times, nothing detected)

-Went through Control Panel and to the Applications panel, scrolled through every one of them but nothing seems fishy or suspicious, all applications in that list there are fine.

 

The closest thing I've come to a solution was managing to restore Google Chrome to its normal attitude for about 10 minutes after a fresh install. I believe that Chrome is not infected.

[Maurice Naggar]

Hello @ivansvi     

My name is Maurice.  I will guide you.  In order to begin to help you properly, I will need a diagnostic report in order to review & diagnose.
Specifically the FRST Farbar diagnostic report.  It is safe to get & use.
https://support.malwarebytes.com/hc/en-us/articles/360039025013-Run-Farbar-Recovery-Scan-Tool-to-gather-logs

Attach FRST.txt + Addition.txt with your reply.  You may if you wish, ZIP the 2 into a zip file & then attach.
{ just please do not copy, paste their contents in main body of reply box here.)
 

[ivansvi]

7 hours ago, Maurice Naggar said:

Hello @ivansvi     

My name is Maurice.  I will guide you.  In order to begin to help you properly, I will need a diagnostic report in order to review & diagnose.
Specifically the FRST Farbar diagnostic report.  It is safe to get & use.
https://support.malwarebytes.com/hc/en-us/articles/360039025013-Run-Farbar-Recovery-Scan-Tool-to-gather-logs

Attach FRST.txt + Addition.txt with your reply.  You may if you wish, ZIP the 2 into a zip file & then attach.
{ just please do not copy, paste their contents in main body of reply box here.)
 

Hello @Maurice Naggar

I ran the diagnostic report as asked. You'll find both files attached. 

FRST.txt Addition.txt

[Maurice Naggar]

I will review & get back with you.  Just so you know, you & I are the only 2 on this topic / case. Please do not use the Quote button ....it is not needed.

I get notified of each reply you make.  You and I are the only 2 participants on this case.

[Maurice Naggar]

I will be preparing a custom script fix for this machine.  The language of this machine is a non-English one so my first request is to make one adjustment for the FRST tool.

Go to the Downloads folder.  Look for FRST64.exe  & then with the right-mouse pointer on FRST64  do a RIGHT-click & choose 

rename

and rename it to

FRSTENGLISH.exe

and press Enter key.   Please confirm that that is done.  This will help me on the future custom run.  Thank you.

[Maurice Naggar]

We need to do 2 adjustments & then one custom script fix.

[   1    ]

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

[   2   ]

Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

Close Malwarebytes.

[   3    ]

We will use FRSTENGLISH.exe  on the Downloads    folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  IVAMSVI  only / for this machine only.

This custom script has some specific things, plus some general aspect to help the system overall. This run hopefully will be under one hour run-time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will also run the Windows  DISM to check the system integruty.  It will reset the Winsock.

NOTE-2:  It will remove a scheduled task called Chromeloader that is the source of the odd / suspect invocation of powershell.

NOTE-3: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. 

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome,  and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 
If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.

Please save the (attached file named) FIXLIST.txt   to the   Downloads  folder   

Fixlist.txt

Start the Windows Explorer and then, to the  Downloads  folder

RIGHT click on  FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

IF you get a block message from Windows about this tool......
click line More info information on that screen
and click button Run anyway on next screen.

on the FRST window:
Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity   

Please know this will do a Windows Restart.   Just let it run and finish.   I will look forward to getting the log.

[ivansvi]

Completed. No suspicious behavior so far. 

 

 

Fixlog.txt

[Maurice Naggar]

Thank you.  That is a good run.

Can you please zip the C:\FRST\Quarantine  folder and attach for me so that our Research Team can review?

I'd also like to get this folder too  (also in a ZIP file)

C:\Users\30694\AppData\Local\chrome

Thank you in advance.   Also, please advise if there is any further oddities or redirects ( hijacks) with Chrome browser.

[   2   ]

Next steps.      Do a new scan with Malwarebytes for Windows.

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

[ 2 ]  Next, the Malwarebytes scan.

Then click the Security tab.  Scroll down and lets be sure the line in SCAN OPTIONs for 

"Scan for rootkits" is ON 👈   Click it to get it ON if it does not show a blue-color .

 

[ 3 ] Next, click the small x on the Settings line to go to the main Malwarebytes Window.   Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

 

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

😉  Please just only attach reports as we go alog.

Edited January 6, 2022 by Maurice Naggar
added new scan

[Maurice Naggar]

Good morning.  Curious.  How are you doing ?

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you