Virus occasionally tries opening Amazon & Buying something, undetectable?

[Maxwell_Edison]

Have a very weird virus affecting me.   It opens Amazon from time to time and attempts to buy something like an iPad.  It's succeeded once, prompting my immediate refunding of said Ipad.

I know it's a virus not a compromised account because I can check my  Chrome history and see the Amazon links - I can even see it happening sometimes, opening a window/tab and immediately closing it.

 

Scanning with Malwarebytes couldn't find anything.  I have the settings such as Root-Kit scanning turned on, and such.  
I tried running RKill which did detect something nasty that I removed, and for a week I did not have the problem, until it suddenly snapped again - 

I could see the right-click menu randomly opening up with the Chrome right click menu for opening a link - Clearly what it's using to get me to a website.  

I ran Rkill a few more times, scanned, etc, Nothing could be found - I disabled the 2 Chrome extensions I had remaining - Malwarebytes Browser Guard and Ad-Block.  

It had already stopped at this point - it never seems to last very long - so I can't really tell if any of that did anything.  Hard to believe it'd be either, though.

My browser guard did have a "installed by third party" stamp on it, but it seems like it's from a verified source so I'm guessing that was legit.     

 

Has anyone encountered this odd virus before?  How do you deal with it?  Kind of funny that it, as of now, has not shown up again since I removed Browser Guard.. Just gonna hope that's a coincidence. 

Forgot to mention, ran the Malwarebytes AdwCleaner seperately on default settings - it did find a pup or whatever but I kind of doubt that was it either.

Sure felt good when it nuked every running program, however - Maybe it terminated whatever was causing this.     

[MKDB]

Hello @Maxwell_Edison  and 

 

My name is MKDB and I will assist you.

 

• Please follow the steps in the given order and post back the logs as an attachment when ready. Thank you very much for your cooperation.
• Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
• Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
• As English is not my native language, please do not use slang or idoms. It may be hard for me to understand.

 

 

I will guide you along on looking for potential malware. Lets keep these principles as we go along.

• Searching, detecting and removing malware isn't instantaneous, please be patient. Please stick with me until I give you the "all clear".
• Only run the tools I guide you to.
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.

 

Please run Farbar Recovery Scan Tool (FRST) for me to check for malware (Step 1).

Thank you!

 

 

Step 1

Please download the suitable version of Farbar Recovery Scan Tool (FRST) and save it to your desktop: 32bit | 64bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Check the box in front of Shortcut.txt.
• Press the Scan button.
• FRST will create three logs (FRST.txt + Addition.txt + Shortcut.txt) in the same directory the tool is run.
• Please attach these logfiles to your next reply.

 

 

[MKDB]

Hi @Maxwell_Edison,

do you still need help? If so, please follow my instructions and post the logfiles.

Thank you.

[MKDB]

Due to the lack of feedback, I do not follow this topic any longer.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection.

Thank you.